RoseFI
4-10-14, 8:21pm
First off, know that I alerted Alan & Iris Lily to this first thing this morning (Pacific time) and Alan verified that the SLF log-in does not use HTTPS - which is the encryption method that has the vulnerability. However, goDaddy hosts our website, and it was vulnerable, and they have patched that vulnerability (http://godaddyblog.com/open-ssl-heartbleed-weve-patched-servers/). Not that SLF stores any sensitive data of yours on the server, but I think it's wise for people to change their passwords just as a precautionary measure (and I'll post this recommendation in other appropriate areas.)
As far as I can tell from the limited reporting so far, this vulnerability has been active for possibly up to two years (when the vulnerable version of the software was published.) Any website that you logged in to that uses HTTPs:// may have been compromised. So I would advise you to check the websites on which you are registered and may have logged in. Just going in and changing your password will not necessarily protect you -- UNLESS you know that the website has applied the upgrade that closes the back door. Otherwise, you're just giving the hacker your new password. So before you log in anywhere, go to the place on the site where they give news updates, or support, or contact them directly to check if they were vulnerable to Heartbleed in the first place, and if so, have they fixed it. And if so, in addition to changing your password, review what transactions you may have done through that site. If a sensitive-data transaction has occurred there in the last two years, be on alert that information may have been compromised.
Today I checked the online banking user agreement for Wells Fargo. WF was NOT vulnerable to this attack, but I was just curious -- looks like their new online banking user agreement (which I have never agreed to, though they tell me they will cut off access if I don't) says in very vague terns that users have no claim against them if they are robbed as a result of accessing online banking. I imagine other banks' agreements may say the same. So don't think that your bank will take care of you -- as the Russian proverb goes, so often attributed to Reagan: Trust, but verify!
As far as I can tell from the limited reporting so far, this vulnerability has been active for possibly up to two years (when the vulnerable version of the software was published.) Any website that you logged in to that uses HTTPs:// may have been compromised. So I would advise you to check the websites on which you are registered and may have logged in. Just going in and changing your password will not necessarily protect you -- UNLESS you know that the website has applied the upgrade that closes the back door. Otherwise, you're just giving the hacker your new password. So before you log in anywhere, go to the place on the site where they give news updates, or support, or contact them directly to check if they were vulnerable to Heartbleed in the first place, and if so, have they fixed it. And if so, in addition to changing your password, review what transactions you may have done through that site. If a sensitive-data transaction has occurred there in the last two years, be on alert that information may have been compromised.
Today I checked the online banking user agreement for Wells Fargo. WF was NOT vulnerable to this attack, but I was just curious -- looks like their new online banking user agreement (which I have never agreed to, though they tell me they will cut off access if I don't) says in very vague terns that users have no claim against them if they are robbed as a result of accessing online banking. I imagine other banks' agreements may say the same. So don't think that your bank will take care of you -- as the Russian proverb goes, so often attributed to Reagan: Trust, but verify!