Skip to Content

What Should You Do About Heartbleed? Excellent Question.

An Internet bug had massive potential security implications. But good luck getting information on whether any actual damage was done.
April 9, 2014

A long-lasting bug called Heartbleed has undermined basic security across the Internet. In theory, it exposed encryption keys, users’ names, and passwords, and data for two-thirds of the world’s websites. This is because of a newly discovered flaw in software called OpenSSL, which is supposed to allow for encrypted data exchange (see “The Under-Funded Project Keeping the Web Secure”).

So what does it mean for you? Ordinary Web users really have no way of finding out how relatively safe or unsafe the websites they use are, or to know what, if anything, to do at this point. Yes, you can visit this site to see if a website you use is still unpatched now (if so, don’t change your password yet).  Or this one to see if it was vulnerable during a scan done Tuesday. If it had a problem and was fixed, you should change your password.

But was a website vulnerable at some earlier point, but then quietly fixed? There’s no easy way to answer that. Did anyone actually walk through open front doors and take anything? Nobody knows. Were some websites safer than others all along, or quicker in fixing the error? Also a black box. Are websites being forthcoming about their own interactions, if any, with Heartbleed?  This morning I looked at a few banking and other websites and found no reference to this, either way. Bottom line: the Internet can be a very challenging place, from the consumer-rights point of view.

As to whether actual damage occured, the worst fears may be unfounded. I emailed Stephen Farrell, a cryptologist at Trinity College, Dublin. He is trying to make the Internet more secure through wider encryption of basic transactions, something he’s doing as part of the Internet Engineering Task Force, the band of engineers who write Internet code. “Don’t panic,” he replied. “People who administer servers should be, or have finished, patching. I think all mine are done.” And ordinary people “should be, as always, using up to date browsers.”

But how bad is this? Were encryption keys stolen and damage done? “I’ve not yet come to a conclusion as to whether or not this justifies revoking and re-generating keys. While in principle the exploit could have extracted keys from servers, I have not so far seen details of whether specific platforms are more or less likely to leak quite so badly … I’ve not seen details yet that’d help me decide if I need to regenerate the keys for my servers so I’ve not done that so far.” He suggested that some larger websites “probably will regenerate keys and get new certificates but that should be invisible to end users.”  His initial assessment on damage done is that “it’s very hard to know just yet.”

Millions of websites allow all sorts of information to be free, but their own operations and level of security can be scarily opaque.

Keep Reading

Most Popular

DeepMind’s cofounder: Generative AI is just a phase. What’s next is interactive AI.

“This is a profound moment in the history of technology,” says Mustafa Suleyman.

What to know about this autumn’s covid vaccines

New variants will pose a challenge, but early signs suggest the shots will still boost antibody responses.

Human-plus-AI solutions mitigate security threats

With the right human oversight, emerging technologies like artificial intelligence can help keep business and customer data secure

Next slide, please: A brief history of the corporate presentation

From million-dollar slide shows to Steve Jobs’s introduction of the iPhone, a bit of show business never hurt plain old business.

Stay connected

Illustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at with a list of newsletters you’d like to receive.