So its been about a week since the Heartbleed thing broke and I am still, as of last night, not done changing passwords. Im not going to explain the whole bug in detail because if you havent read the xkcd comic yet (the one with the guy reading a library book without leaving fingerprints, comic #1354) just go read that first, its the best two-minute explanation Ive seen and I say that as someone who tried to read the actual OpenSSL changelog and immediately regretted it.
Quick version for anyone who somehow missed it: theres a bug in OpenSSL, the encryption library something like two thirds of the web uses, that CVE-2014-0160 covers, and it basically let anyone quietly read chunks of a servers memory. Not "hacked in" access, just leaking little 64KB scraps that could contain session cookies, private keys, sometimes literal usernames and passwords. And the scary part isnt the bug itself, its that it was sitting there since 2012 and there was no way to know if anyone had actually been exploiting it before Codenomicon and a Google researcher found it and it got disclosed publicly.
Anyway. My actual weekend project became: go through every account I have and figure out (a) was the service affected, (b) did they patch it yet, and (c) is it actually safe to change my password now or would I just be handing the new one to the same broken lock.
Here's the checklist Ive been using, for what its worth:
1. Check if the site was even vulnerable. LastPass put up a checker at heartbleed.lastpass.com pretty fast and its been my first stop for basically everything. You put in a domain and it tells you if it looks vulnerable right now, and sometimes it'll tell you when the SSL cert was last reissued, which matters more than people realize.
2. Dont change your password before they patch. This is the part that trips people up. If a site is still running the broken OpenSSL version, changing your password does nothing, you're just typing your new password into the same leaky server. I made this mistake on day one with one of my accounts before I understood the timeline properly. Wait for the patch, then change it.
3. Check if they reissued their SSL certificate. This is the step everyone skips and its honestly the important one. If a site patched OpenSSL but never revoked and reissued their cert, theres a chance someone grabbed the private key before the patch and could still spoof the site. A bunch of the big sites (Yahoo, Tumblr, imgur, OkCupid were on basically every early list of affected services) moved fast on this, but plenty of smaller stuff Im logged into hasnt bothered yet, or at least hadnt as of a couple days ago.
4. Then, and only then, change the password.
Ive gotten through Gmail, my bank (surprisingly they were never vulnerable, good for them), Github, and Dropbox so far. Still sitting on a pile of smaller accounts, some random forum I signed up for in 2012 and forgot existed, a couple of shopping sites, the works. Its tedious in a way thats hard to convey unless youve actually sat down and tried to do it properly instead of just clicking "reset password" on autopilot.
Small complaint while Im at it: this whole event has made painfully obvious how many of my old passwords were variations on the same two or three roots with a number tacked on. I know, I know, I run a tech blog and Im telling you my password hygiene circa 2013 was garbage. In my defense I think almost everyone's was. Ive finally started actually using a password manager for new stuff instead of just thinking about it, which is the one genuinely good thing to come out of this whole mess for me personally.
The bigger conversation happening in the comments sections Ive been reading is about whether an open-source project as critical as OpenSSL, something the entire internet leans on, should really be maintained by as few people and as little funding as it apparently has been. That seems like the actual lesson here, more than any individual site getting a security black eye this week. Whether that conversation goes anywhere or just fades out once everyone's done changing passwords, no idea. Ask me in a year.
If youve got a service youre not sure about, the LastPass checker link above is worth bookmarking, theyve apparently been updating it as more sites patch. Go check your stuff before you forget, like I almost did with three different accounts this week.