Read more.Quote:
But there are two simple steps, as recommended by Kaspersky, for users to follow.
Printable View
Read more.Quote:
But there are two simple steps, as recommended by Kaspersky, for users to follow.
The link for heartbleed test page isn't working
sorry, link is fixed now
Does anyone else see the irony in calling it *Open*SSL...?
I use lastpass and with in a day they had built in a vulnerability check that checks all the sites I have stored to see if they were affected or not. Cant beat that for customer service!
I also use LastPass now thanks to a friend, can't live without it.Quote:
Originally Posted by Gh0sty
Oh a slight detour from the well-covered direct impact of this flaw, I wonder if this will be a sufficient kick up the rear to get the fragmented mess of certificate revocation sorted?
As has been alluded to elsewhere, I can see any potentially stolen certificates being used in combination with MITM and/or DNS redirection to create some pretty convincing phishing websites.
I found a test page from Verisign, to see how various browsers respond: https://test-sspev.verisign.com:2443...risign.html
Firefox, IE and Chrome on desktop all call foul play and refuse to allow the connection, as you'd hope, but Chrome on Android doesn't even complain and just displays the page.
Upon further reading, it seems even Chrome and FF only really scrutinise EV certificates, and will happily accept 'standard' certificates without complaining: http://news.netcraft.com/archives/20...-practice.html
IMNSHO, the difference between standard and EV shouldn't be one of 'up-to-spec security' and 'wide open to pwnage if the certificate is stolen', and that strikes me as quite irresponsible at best.
I've not looked into whether that test site is EV or standard (although I assume the former), but either way, at least the Chrome Android fails quite spectacularly, and IMO this really isn't a trivial matter in light of recent events.
Any thoughts?
Does anyone have a list of affected sites ?
It says in the story :/
Meh, it's not like I've got any money so the only thing I'd be worried about is losing access to steam.
Thankyou! Great article! I was wondering how the hell to know which sites I needed to change passwords for, and when to change them. This should make it easier :)