What Should You Do About Heartbleed? Excellent Question.

A long-lasting bug called Heartbleed has undermined basic security across the Internet. In theory, it exposed encryption keys, users’ names, and passwords, and data for two-thirds of the world’s websites. This is because of a newly discovered flaw in software called OpenSSL, which is supposed to allow for encrypted data exchange (see “The Under-Funded Project Keeping the Web Secure”).

So what does it mean for you? Ordinary Web users really have no way of finding out how relatively safe or unsafe the websites they use are, or to know what, if anything, to do at this point. Yes, you can visit this site to see if a website you use is still unpatched now (if so, don’t change your password yet).  Or this one to see if it was vulnerable during a scan done Tuesday. If it had a problem and was fixed, you should change your password.

But was a website vulnerable at some earlier point, but then quietly fixed? There’s no easy way to answer that. Did anyone actually walk through open front doors and take anything? Nobody knows. Were some websites safer than others all along, or quicker in fixing the error? Also a black box. Are websites being forthcoming about their own interactions, if any, with Heartbleed?  This morning I looked at a few banking and other websites and found no reference to this, either way. Bottom line: the Internet can be a very challenging place, from the consumer-rights point of view.

As to whether actual damage occured, the worst fears may be unfounded. I emailed Stephen Farrell, a cryptologist at Trinity College, Dublin. He is trying to make the Internet more secure through wider encryption of basic transactions, something he’s doing as part of the Internet Engineering Task Force, the band of engineers who write Internet code. “Don’t panic,” he replied. “People who administer servers should be, or have finished, patching. I think all mine are done.” And ordinary people “should be, as always, using up to date browsers.”

But how bad is this? Were encryption keys stolen and damage done? “I’ve not yet come to a conclusion as to whether or not this justifies revoking and re-generating keys. While in principle the exploit could have extracted keys from servers, I have not so far seen details of whether specific platforms are more or less likely to leak quite so badly … I’ve not seen details yet that’d help me decide if I need to regenerate the keys for my servers so I’ve not done that so far.” He suggested that some larger websites “probably will regenerate keys and get new certificates but that should be invisible to end users.”  His initial assessment on damage done is that “it’s very hard to know just yet.”

Millions of websites allow all sorts of information to be free, but their own operations and level of security can be scarily opaque.