So that was my Saturday. Not mowing the lawn, not anything fun, just sitting here with a spreadsheet open going through every account I have and asking "did this one get patched yet." If you havent been paying attention this week, theres a bug in OpenSSL called Heartbleed that got disclosed Monday, and its bad in a way that most security bugs arent, because it doesnt just let someone break in, it lets them quietly read chunks of a servers memory. Usernames, passwords, session cookies, sometimes the private keys themselves. And it's been sitting there since 2012, apparently, which is the part that actually bugs me.
Everyone and their uncle has already written the "what is Heartbleed" post this week so Im not going to do that again. If you want the clearest explanation, go find the xkcd comic about it, its better than anything Ive read from an actual security firm and it fits on one screen.
What I want to write about instead is the dumb part nobody warned me about before I started: changing your password on a site that hasnt patched yet does basically nothing. If the server is still running the vulnerable OpenSSL version, your shiny new password is just as exposed as the old one the second you type it in. I didnt fully internalize this until I was already three passwords deep into my Saturday morning cleanup, feeling very responsible about myself, and then read a thread pointing out I might've just handed my new Gmail-adjacent password to the same leaky pipe. Great.
So the actual order of operations, if youre doing this too:
- Check whether the site has patched OpenSSL and reissued its SSL certificate. Not just patched — reissued the cert too, because if the private key leaked, the old cert is still compromised even after the patch.
- Only then change the password.
- Do the ones that matter first. Email, banking, anything tied to your primary email as a recovery address. Nobody needs a new password for a forum they posted on twice in 2009.
Yahoo confirmed Tuesday that Yahoo Mail, Tumblr, and Flickr had been vulnerable and said theyd patched them. I still made myself wait a day before touching my old Yahoo login, mostly out of spite, partly because I didnt trust the timeline. LastPass put out a little checker tool this week where you can paste in a domain and it tells you the patch status, which I ended up using for probably twenty sites, copy-paste, copy-paste, copy-paste, like some kind of miserable data entry job I assigned myself for free.
Heres my actual complaint, the one thats not really about the bug itself: I have no idea how many accounts I have. I sat down to make a list and got to sixty-something logins before I gave up counting and just started going through my email searching "welcome to" and "verify your account" instead. Half of these I dont remember signing up for. There was a coupon site from what must have been 2010 that I have apparently never once logged back into, and yet there it was, sitting in my inbox with my actual real password from that era, which, embarrassingly, I know I reused elsewhere at the time. That's the stuff that actually keeps me up at night about this, not really the technical bug — the sprawl. Every service you sign up for once is a password sitting on someone elses server forever, whether you remember it exists or not.
Anyway. I finally caved and started using LastPass properly instead of the half-assed "one good password with a number stuck on the end" system Id been running since college. Generated random passwords for the dozen sites that actually matter, and Im slowly working through the rest whenever I happen to log into something and get annoyed enough. It's not glamorous. Its also probably three years overdue on my end, and I say that as someone who writes a tech blog and really should know better.
If youre reading this and you havent done anything yet: check the site first, then change the password, and just start with your email. Everything else can wait until youre less annoyed about it than I am right now.