Heartbleed

It just gets worse and worse!

The latest article in The Washington Post is a MUST READ:

http://www.washingtonpost.com/business/economy/heartbleed-bug-fixes-threaten-to-cause-major-internet-disruptions-in-coming-weeks/2014/04/14/171e9acc-c405-11e3-b574-f8748871856a_story.html?hpid=z3

I am not totally familiar with the details of OpenSSL implementations out there today, but OpenSSL is an Open Source technology, meaning it is openly developed by a consortium of various developers and companies. Open source works well to help establish open technical standards that are not proprietary and can be adapted by many from many sources. Open Source and security are really not two words that inherently be used together due to the inherent nature of open source being "open" as opposed to "secure".

However, most commercial applications of Open SOurce technologies are done using versions of the Open SOurce Technology that is fully supported for its use by a real business/company with a skin in the game to make sure the product works as intended and is successful. I suspect that is the case with Open SSL as well, and I would expect those versions would inherently be more secure than their pure open source relatives.

However, open source implementations tend to be free, though less reliable and secure, so there is incentive for some sites/applications/companies looking to go on the cheap to use them, even if doing that with a product related to security might be as effective as hiring an 85 year old grandma as your security guard.

So it is a concern but I would expect most any reputable company to use a more robust implementation and not the free open source one.

I read somewhere that it only affects Linux and Unix operating systems ....

Although there may be some minor exceptions, I believe that is essentially true, if "Unix" is considered to include Unix-like operating systems such as the various versions of BSD.

To be sure it's clear, though, this refers to the OS of the web server used by the site, not to the OS used by the individual who is communicating with that server. The OS on an individual's computer makes no difference.

And my understanding is that the majority of the world's web servers run Linux, although many of them do not handle encrypted traffic, and many of those that do aren't using the versions of OpenSSL which have the vulnerability.

Also, yesterday Audiogon posted the following in the Hub section:

Audiogon.com is no longer vulnerable to the Heartbleed bug. All of our platform providers have taken steps to prevent exploitation of the Heartbleed vulnerability by updating OpenSSL. We have restarted all resources using OpenSSL. If you have not already, we recommend you change your password.

Best regards,
-- Al

I read somewhere that it only affects Linux and Unix operating systems and that the criminal has to be "looking" at your transaction live (while it happens), in order to get your info.

I feel pretty safe. For now.

All the best,
Nonoise

Here is the response from Audiogon Support. Sounds like they have taken some steps but are still working on it.

At this time:
1. We are patching all of our encrypted resources right now
2. We have already taken steps to prevent exploitation of this vulnerability
3. Our platform providers, Heroku and Amazon, have already taken steps to prevent exploitation of this vulnerability
4. Users can and should change their passwords as an additional precaution
Thank you for being a valued member of the Audiogon community. Please do not hesitate to contact us if there is anything else we can assist you with.

I emailed Audiogon support yesterday and asked them about this issue. When I saw this thread I sent them a link to it. Let's see how they respond.

I heard on the news last night that you shouldn't change passwords unless the organization that the password is for... has fixed this problem on their end. In-other-words, if he subject password is for AudiogoN, AudiogoN has to have applied a fix on their system... otherwise it's a waste of time to change the password.

An interesting problem. I'm surprised at vulnerability at this level of so called super secure items.

Gz3827, thanks for the info. I just read the huffingtonpost article about this, and used the link they provided to test a website. Out of the 6-8 websites I tested, the only one that showed up as possibly being vulnerable was Audiogon.