Security Catastrophe: have you changed your passwords?

[evilagent]

BBC News - Heartbleed Bug: Public urged to reset all passwords

[NickFitz]

The thing is, at the moment you can't be sure all servers have been patched, which means that if you change your password now you could just be giving away the new one, whereas your existing password might never have been compromised.

It can make more sense to wait a few days for everything to be updated, and only then change your password.

Though that may be too late, of course

Security expert Bruce Schneier has a good view on it: "On the scale of 1 to 10, this is an 11." https://www.schneier.com/blog/archiv...eartbleed.html

[OwlHoot]

The thing is, at the moment you can't be sure all servers have been patched, which means that if you change your password now you could just be giving away the new one, whereas your existing password might never have been compromised. ...

There ought to be a standard drill for a vulnerability like this, in that as soon as it is patched the site should direct users to a password replacement page where they are validated by their answers to a decent set of contextual questions (stored on a separate server solely for this purpose) and prompted to enter a new password.

[MyUserName]

To avoid this kind of issue I don't use passwords. Much more secure.

[vwdan]

To avoid this kind of issue I don't use passwords. Much more secure.

So how do you log into CUK?

[DodgyAgent]

So how do you log into CUK?

SASguru

twat

[VectraMan]

Just don't use anything that's open source. Problem solved.

Good write up of the problem:

http://www.theregister.co.uk/2014/04...eed_explained/

Not quite as stupid as the recent Apple bug.

[MyUserName]

So how do you log into CUK?

An arrogant and stubborn refusal to accept the fact I can't

[vwdan]

An arrogant and stubborn refusal to accept the fact I can't

To be honest, I think I totally misinterpreted your first post - I thought you were making some point about alternate authentication methods.

[Dactylion]

There we are, I've changed all mine from 123456 to ABCDEF.

Fixed.

AbCdEf - Sh1rLeY?