nylyon-(Admin) 7,878 #1 Posted April 9, 2014 You may be hearing about a serious internet bug (click here). What does this mean to RedSquare and more importantly what does this mean to you? Click the link to read the technical portion. First - RedSquare does NOT use SSL or OpenSSL to process login information. What this means in non-technical terms is RedSquare is NOT affected by this issue. BUT because we don't use any encryption on your passwords, they are open for interception. When we established the site, I elected not to use SSL because we do not handle any financial transactions (PayPal is used for any financial transactions more on that later). As a worst case scenario, anyone who wanted to "hack" your RS account would gain access to your PM's, and honestly there's no interest in a hacker doing so as there's no gain for them and we're a low volume site and don't show on their radar! Second - You are likely affected by other sites that you visit. These include sites where you enter financial information such as credit cards, e-mail passwords, banking systems etc. This BUG is not new, it's been around for a couple of years but it's just coming to the surface. The exposure is very large. It's important to realize that because the bug was announced today, the exposure is greater now than yesterday because hackers NOW know what they need to do. What can you do? If you've been following "Safe Computing" practices you know already that rule #1 is NEVER EVER have the same password for your bank account / PayPal / credit cards etc as your email, forum, or others. Until the issue is resolved by your institution, simply DO NOT log into their site is patched. Now, if you're among the vast majority who's password IS the same as your e-mail avoid accessing your e-mail. Going forward NEVER EVER have the same password for your critical accounts (bank, credit card etc) as your non-critical accounts (RedSquare, eMail etc) When these things are announced stop accessing the critical sites. When they are patched, change your password (in the event your was disclosed). I hope that none of you are affected, but this is something to be aware of. 1 Share this post Link to post Share on other sites
nylyon-(Admin) 7,878 #2 Posted April 9, 2014 Additional information is here: http://heartbleed.com Share this post Link to post Share on other sites
bmsgaffer 2,053 #3 Posted April 9, 2014 Thanks for the extra info! Share this post Link to post Share on other sites
Hodge71 665 #5 Posted April 9, 2014 (edited) Thanks so much Karl. I had no clue this was even going around. The internet is a wonderful thing but at the same time is very easy to lose everything by relying on it too much Edited April 9, 2014 by hodge71 Share this post Link to post Share on other sites
rexman72 210 #6 Posted April 9, 2014 this is scarey stuff Share this post Link to post Share on other sites
AMC RULES 37,195 #7 Posted April 9, 2014 How will we know when it's safe to get back into the water? Share this post Link to post Share on other sites
KATO 115 #8 Posted April 9, 2014 WOW all our servers at work are open source linux ... i just notified the I.T guys they had no idea Share this post Link to post Share on other sites
GlenPettit 1,717 #9 Posted April 9, 2014 Thank gosh I'm a Mackie boy (MacIntosh, Apple), I have no idea what a bug or virus is, after 20+ years. Glen Share this post Link to post Share on other sites
nylyon-(Admin) 7,878 #10 Posted April 9, 2014 Me too Glen, BUT this isn't a Windows thing, it's an SSL thing.... bottom line you're just as vulnerable with a Mac as with a PC or Tablet. How will we know when it's safe to get back into the water? It all depends on how diligent the store / bank / credit card company etc... is. I have read that sites like Yahoo have already been repaired, my one credit card company will be fixed Thursday others I have no word, including my bank! Share this post Link to post Share on other sites
HorseFixer 2,013 #11 Posted April 9, 2014 Thanks for the heads up! ~Duke Share this post Link to post Share on other sites
nylyon-(Admin) 7,878 #12 Posted April 10, 2014 Still being fixed, but here's an update: Who was, and who wasn't, affected by Heartbleed Prominent sites and services openly attacked using Heartbleed, for which you absolutely have to change passwords: Yahoo and, by association, its subsidiaries Flickr and Tumblr. Prominent sites that have sent out Heartbleed-related password-change emails: Ars Technica, IFTTT.com. Prominent sites and services formerly vulnerable to Heartbleed attacks, for which you probably should change passwords: Blogger/Blogspot, Dropbox, Facebook, Electronic Frontier Foundation, Etsy, Google, Imgur, Instagram, Netflix, Pinterest, Stack Overflow, Twitter, Wikipedia, Woot, Wordpress.com/Wordpress.org and YouTube. Prominent sites and services that don't appear to have been vulnerable to Heartbleed (but we can't be certain): Amazon, AOL, Apple, Ask.com, Bank of America, Bing, Buzzfeed, Capital One, Chase, CNET, Craigslist, eBay, ESPN, Evernote, GoDaddy, Hotmail, HSBC, Huffington Post, Intuit, LinkedIn, Live.com, Microsoft, Newegg, The New York Times, PayPal, Reddit, Salesforce, Target, TD Bank, Walmart, Wells Fargo and Zillow. If you want the gory technical details on what Heartbleed is and how it works, visit Heartbleed.com, read this excellent but dense explanation of Heartbleed by Australian security researcher Troy Hunt or watch this video by security researcher Zulfikar Ramzan. Share this post Link to post Share on other sites
nylyon-(Admin) 7,878 #13 Posted April 10, 2014 The issue doesn't seem to get a lot of news air time, but don't let that fool you to thinking this is a cry wolf type of deal. It's serious enough that in Canada, they took down the tax services site due to this bug and late filers will not be penalized. http://www.ctvnews.ca/canada/canadians-filing-taxes-late-due-to-heartbleed-bug-won-t-face-penalties-cra-1.1767727 Share this post Link to post Share on other sites
KATO 115 #14 Posted April 10, 2014 Gettin lots of air time up here... almost everybody talkin about it definitely serious Share this post Link to post Share on other sites
