The Heartbleed bug: how freaked out do I need to be?

I changed gmail, facebook and yahoo passwords this morning. Should I have waited? Should I change them again in the near future?

I used this page as a guide: http://www.cnet.com/how-to/which-sites-have-patched-the-heartbleed-bug/
Is there a better one?

bookmarked

just done mine (those 3 plus dropbox). i used this list:

http://mashable.com/2014/04/09/heartbleed-bug-websites-affected

https://www.youtube.com/watch?v=I1sNImbI2Zw

(was surprisingly hard to find the google password change option)

took this as an opportunity to do some bulk password resetting for the first time in a long time.

Most of my websites of concern seemed to be OK. Gmail has 2-step verification, so not terribly concerned there.

LastPass Heartbleed checker https://lastpass.com/heartbleed
don't forget to check your private trackers

thanks, forgot that one

As long as your password isn't ******** you're fine.

the things people will do to get on 77

https://www.eff.org/deeplinks/2014/04/wild-heart-were-intelligence-agencies-using-heartbleed-november-2013

irl assessment by lecturer with Phd in net security topic:

don't worry bout it.

do your worst, bugthingy

person attacking even a vulnerable site would have to have been live on the same server at the same time as you in order to get any relevant info is his assessment

good to know but that means i freaked out my mom for no reason
please don't tell her

person attacking even a vulnerable site would have to have been live on the same server at the same time as you in order to get any relevant info is his assessment

i think this only applies to the session side-jacking attack cuz if the vulnerability happens to reveals the server's private key then any SSL traffic that is sniffed can be decrypted

now google.com fails to respond in firefox, 'waiting for www.google.com...' - there's probably a session using the old password kicking around...

http://i.imgur.com/AMQEQik.jpg

i can't care enough to read about this

I don't even own a computer

What's an internet

Whose hands are these?

Whose hands are these?
--art

Wait they're mine. My hands

who are you?

http://www.quickmeme.com/img/2a/2afdb16b3d5143a9feaad0116b07a778c4e7a6583a44edac128b8421c8603007.jpg

really sick of waiting for a response from xvideos, come on guys

not ashamed to note that the first website i checked was ilxor
i got no answer

a lot of the sites i never even knew or neeed https on to start with. I mean, Soundcloud!?

Got an e-mail from a colleague saying "because of security concerns related to the Heartbleed bug, we have changed the password for ********** access. The new password is 'Password1'".

ahaha

capital letter and a digit = good. needs punctuation

Password1!

Lol

Pinboard ‏@Pinboard Apr 8
Responsible disclosure (n.): coming up with a cool logo, homepage and name for your terrifying bug before panicking the Internet with it

My new password:

http://cdn4.fashionablygeek.com/wp-content/uploads/2014/02/benny-SPACESHIP.jpg

I just have to figure out how to make the Lego guy's head.

some of my old passwords, help yourself:

8{qx=L6n

-#@Ru:c2

(standard android 'Secrets' app generates passwords that are terrible to type using the android keyboard)

Hip Hop & Rappers for Ron Paul shared 11Alive's status update.

Like Page
11Alive

The National Security Agency not only knew about Heartbleed for at least two years, the agency used it to gather intelligence, according to a report.

Bloomberg News says NSA found it, used it, didn't report it. NSA and White House deny.

our favorite comic with a pretty good explanation actually http://xkcd.com/1354/

(also yeah, this seems like the sort of thing the nsa would def have found, but one never knows)

NS4 probably doesn't need stuff this basic if they already have back doors into every type of firewall or network card's firmware. But yeah, this denial keeps us all quiet and happy.

Disclaimer: not saying they do have what I just said, only that that would seem like the most obvious way to do what they supposedly do.

CRA says social insurance numbers of about 900 Canadians stolen in Heartbleed breach.
http://business.financialpost.com/2014/04/14/cra-sin-stolen-heartbleed/?__lsa=2c04-fb9f

wonder if other crimes have been reported.