Skip to Content

What Should You Do About Heartbleed? Excellent Question.

An Internet bug had massive potential security implications. But good luck getting information on whether any actual damage was done.
April 9, 2014

A long-lasting bug called Heartbleed has undermined basic security across the Internet. In theory, it exposed encryption keys, users’ names, and passwords, and data for two-thirds of the world’s websites. This is because of a newly discovered flaw in software called OpenSSL, which is supposed to allow for encrypted data exchange (see “The Under-Funded Project Keeping the Web Secure”).

So what does it mean for you? Ordinary Web users really have no way of finding out how relatively safe or unsafe the websites they use are, or to know what, if anything, to do at this point. Yes, you can visit this site to see if a website you use is still unpatched now (if so, don’t change your password yet).  Or this one to see if it was vulnerable during a scan done Tuesday. If it had a problem and was fixed, you should change your password.

But was a website vulnerable at some earlier point, but then quietly fixed? There’s no easy way to answer that. Did anyone actually walk through open front doors and take anything? Nobody knows. Were some websites safer than others all along, or quicker in fixing the error? Also a black box. Are websites being forthcoming about their own interactions, if any, with Heartbleed?  This morning I looked at a few banking and other websites and found no reference to this, either way. Bottom line: the Internet can be a very challenging place, from the consumer-rights point of view.

As to whether actual damage occured, the worst fears may be unfounded. I emailed Stephen Farrell, a cryptologist at Trinity College, Dublin. He is trying to make the Internet more secure through wider encryption of basic transactions, something he’s doing as part of the Internet Engineering Task Force, the band of engineers who write Internet code. “Don’t panic,” he replied. “People who administer servers should be, or have finished, patching. I think all mine are done.” And ordinary people “should be, as always, using up to date browsers.”

But how bad is this? Were encryption keys stolen and damage done? “I’ve not yet come to a conclusion as to whether or not this justifies revoking and re-generating keys. While in principle the exploit could have extracted keys from servers, I have not so far seen details of whether specific platforms are more or less likely to leak quite so badly … I’ve not seen details yet that’d help me decide if I need to regenerate the keys for my servers so I’ve not done that so far.” He suggested that some larger websites “probably will regenerate keys and get new certificates but that should be invisible to end users.”  His initial assessment on damage done is that “it’s very hard to know just yet.”

Millions of websites allow all sorts of information to be free, but their own operations and level of security can be scarily opaque.

Keep Reading

Most Popular

Workers disinfect the street outside Shijiazhuang Railway Station
Workers disinfect the street outside Shijiazhuang Railway Station

Why China is still obsessed with disinfecting everything

Most public health bodies dealing with covid have long since moved on from the idea of surface transmission. China’s didn’t—and that helps it control the narrative about the disease’s origins and danger.

individual aging affects covid outcomes concept
individual aging affects covid outcomes concept

Anti-aging drugs are being tested as a way to treat covid

Drugs that rejuvenate our immune systems and make us biologically younger could help protect us from the disease’s worst effects.

Europe's AI Act concept
Europe's AI Act concept

A quick guide to the most important AI law you’ve never heard of

The European Union is planning new legislation aimed at curbing the worst harms associated with artificial intelligence.

Stay connected

Illustration by Rose WongIllustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.