SoylentNews is people
SoylentNews
After reporting the problems with OpenSSL, which has been nicknamed 'HeartBleed', 2 contributors have forward articles on why you should change your passwords.
Heartbleed, and why you should change your password
I always believed Mojang would keep my details safe, now I realise they are not in control of their own data. Mojang/Minecraft passwords should be changed immediately
Heartbleed Bug: Change All Your Passwords
The fallout from the Heartbleed bug is hitting the mainstream. The BBC has an article headlined "Public urged to reset all passwords".
Bruce Schneier calls it "catastrophic", giving this advice to sysadmins: "After you patch your systems, you have to get a new public/private key pair, update your SSL certificate, and then change every password that could potentially be affected." He also links to a webpage that will let you test servers for the bug, and an article on Ars Technica discussing the bug.
(Score: 3, Insightful) by NCommander on Friday April 11 2014, @12:54AM
Wow, there's so much wrong here that I'm going to need to break it down.
First, using crypto everywhere means that its difficult to capture in transit. While it is possible to MITN with a fake CA, certificate pinning can go a *long* way in stopping that in its tracks. Once we've finished the site rename, and generated new SSL certificates, I'm going to look into pinning the site so that browsers will explode if they get a MITN certificate. With a pinned certificate, MITN is essentially impossible. Furthermore, we've got security precautions in place to give us a heads up if the server software has been tampered with in case of intrusion, NSA or otherwise. We terminate SSL on the webheads and not on a loadbalancer, so data is only unencrypted within the machine itself; a much harder target to penetrate.
Secondly, a lot of things use SSL with self-signed certificates; we use it internally all over the place; if its not public facing, its signed by our own internal CA. All of that has to be redone because of heartbleed.
Third, do you really want anyone to be able to scope information? No security (or privacy protection) is perfect and a dedicated attacker can probably find a chink in the armor and get in. Right now, if a bank or health care provider is heartbleedable, your information can be leaked, and sold to whoever will buy it.
Yes, having proper security is hard, but your comment is to roll over and let whoever they want screw us. With an attitude like that, the United States would still be a British colony. A battle is only lost when the last person gives up fighting, and apathy is not the solution to the problems in the world.
Still always moving
(Score: 2) by Hairyfeet on Friday April 11 2014, @04:06AM
Exactly HOW am I wrong? remember the "$5 wrench" comrade? Well thanks to Snowden we now know they don't even need a $5 wrench, they just need a side room at AT&T,Google,Yahoo, and pretty much every major ISP and terminal in the country. you might want to look up the telecom immunity blowup and what the whistleblower put out there about what is EXACTLY going on to see why they really don't need your keys, they can flash a badge and copy every single packet not to mention the contents of your emails or anything else they want, no pesky warrants required.
Again if you want to do it to stop script kiddies? Go right ahead, but seeing as it'll take most big places a month or more to get switched probably not gonna help ATM but if you think its gonna stop big bro? Well there is a REASON why we say "if they have access to the hardware you've already lost" because once the hardware is compromised everything else is fucked. unless you are using a VPN to tunnel AND don't have the tunnel ending anywhere in the USA then you are just you are just playing security theater because some lackey at the NSA can push a button and see everything you've done going back years....why do you think they built that massive bunker datacenter in Utah, for fun? when you are blanket capturing THAT much data you gotta have some big ass boxes to pour through the stuff.
ACs are never seen so don't bother. Always ready to show SJWs for the racists they are.