The Heartbleed Bug

The Heartbleed Bug

Postby Regulus » April 11th, 2014, 2:36 pm

Here's something a little recent that I've been reading up on. It's called the heartbleed bug. It's a bug on web servers that causes a major security weakness. Here's how it works:

Image

This might just be the biggest security flaw ever. Anyone could retrieve any information from a server with this bug, including usernames, passwords, cookies, encryption codes, and so on. It's affected email sites like google and yahoo, and, well... just about everything. What's worse? There's no way to determine if someone has exploited the bug.

Honestly, I'm not sure if I'm more scared or curious. This is interesting stuff.

http://mobile.reuters.com/article/comme ... 1#comment0

http://mashable.com/2014/04/09/heartble ... -affected/

http://www.usatoday.com/story/tech/2014 ... s/7501033/

Is MLK affected by this bug? Yeah, probably so.
Regulus
Is differentiable...

User avatar

Years of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membership

But convergence is not guaranteed.

Posts: 10994
Joined: September 29th, 2011, 1:19 am
Location: W⋅N²=(40.498°)³, W²⋅N=(57.345°)³
Nickname(s): Reg, Regs, Last Person to Post
Gender: Male
Pride Points: 206

Re: The Heartbleed Bug

Postby FlipMode » April 11th, 2014, 9:58 pm

Yeah man I was out for the day today and when I got back I had notifications from several Facebook groups I'm in like "Guys, change your passwords" "OMG dat heartbleed bug tho'". Leave the house for one day and the internet breaks.

Interesting as that is, I do agree that it's quite offsetting, people make jokes about it all the time but when it comes down to things like personal details and bank details being exposed and exploited, the internet can actually be serious business.

The internet as we know it started on the 6th August 1991 (I only remember this as it is my birth date. Yes, Flip_FTW was born on the same day the internet started... Doesn't get much more FTW than that).
Something that completely changed the way we live only started 22 years ago and has only really come into it's own even less than that. I mean that's not very long is it? And since this has been undetected for two years, it does make me wander about the security of the internet a bit.

As long as they don't get my Netflix account so I can still watch Power Rangers and they keep their paws off my pride points on here, I should be okay :)
FlipMode
User avatar

Years of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membership

Posts: 8979
Joined: March 30th, 2010, 9:35 pm
Gender: Male
Pride Points: 266

Re: The Heartbleed Bug

Postby Regulus » April 12th, 2014, 7:20 am

Honestly, changing your password may not be the best idea just yet. Unless the bug has been patched, changing your password will give any hacker the opportunity to snatch up that new password that you just created.

Also, while we're on the subject of passwords, this is pretty true:

Image

Now, with that said, I'm trying to find a way to streamline the creation of several unique but memorable passwords, sorta like this. I try not to use the same password for everything, but it's difficult to remember more than just a few. There are solutions like encryption apps that use master passwords, but I'm not so sure those services are any better or more secure.

So, here's one idea that I have. To create a password:

Step 1. Pick a number between 0 and 9.

Step 2. Now, use a code similar to this. It could be any code, but just make sure that it's one you can remember.

0 = A
1 = B
2 = C
3 = D
4 = E
5 = F
6 = G
7 = H
8 = I
9 = J

Step 3. Use the letter of the number you picked to determine a keyword, like an African animal. So, if your number was 6, your letter is G. What African animal starts with G? Giraffe. So, your system could be something like this:

0 = A = Antelope
1 = B = BlackRhino
2 = C = Cheetah
3 = D = Dugong
4 = E = Eland
5 = F = FinWhale
6 = G = Giraffe
7 = H = Hippo
8 = I = Impala
9 = J = Jackal

Step 4. Pick another word to use for every password. Like, since we're going with an African theme, let's just use "Busa" for an example.

Step 5. Combine each part with a number that you can remember, like the month of your birthday. So, your password could be something like [animal] + "Busa" + [number] + [month of birthday]. Since my birthday is in February, it would look something like this:

Giraffe + Busa + 6 + 02 = GiraffeBusa602

Or if your number is 3, it could be something like this: Cheetah + Busa + 3 + 02 = CheetahBusa302

If your number is 9, it could be something like this: JackalBusa902

The advantage of this system is that all you need to do is remember this process and the number you picked for each website. Then, you have 10 different passwords to use.

So, Gmail could be a 0. Yahoo could be a 1. MLK could be a 2. Tumblr could be a 3. Your bank account could be a 4, and so on. So, all you have to do is remember a number for each website, and guessing your password is still going to be pretty hard for anyone except you. Unless someone knows this process that you used, they won't be able to guess any other password of yours, even if they already have one of them.

Forgot your password? As long as you remember this process, you only need 10 trials to guess it. Every password will be [animal respective of number] + "Busa" + [number between 0 and 9] + "02".

If you need at least one symbol in your password, you could just add the symbol respective of the number of the key, like this:

AntelopeBusa102!

BlackRhinoBusa202@

CheetahBusa302#

...and so on.

There are an infinite number of ways to change this process, but as long as you remember it, that's all you need to know. You'll have 10 (mostly) unguessable passwords that you'll be able to remember and use easily.

Thoughts?

Don't worry guys, you'll never guess my future passwords. You'll need to be able to do triple integrals.
Regulus
Is differentiable...

User avatar

Years of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membership

But convergence is not guaranteed.

Posts: 10994
Joined: September 29th, 2011, 1:19 am
Location: W⋅N²=(40.498°)³, W²⋅N=(57.345°)³
Nickname(s): Reg, Regs, Last Person to Post
Gender: Male
Pride Points: 206

Re: The Heartbleed Bug

Postby DGFone » April 13th, 2014, 1:50 am

Here's the deal though: The bug has been around for a few years now, and so has the fix.

Heartbleed has been around for quite a while, and therefore many OSs and software have already patched to fix it. As MLK runs o Linux, and Linux patched the fix, MLK is safe. What is not safe is based on when you last changed your password. The time period for this is about 2012, so if you joined MLK or change your password after 2013, you should be fine.

So Regulus, before you freak everyone out, do a bit more research first. :P I don't know why there is a sudden explosion of attention to Heartbleed, but it's not anything new.
Image
DGFone
Got wings

User avatar

Years of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membership

Watch me soar

Posts: 11871
Joined: March 14th, 2011, 6:14 am
Location: Flying several thousand feet off the ground.
Nickname(s): Planes, DGF, DG
Gender: Male
Pride Points: 138

Re: The Heartbleed Bug

Postby Regulus » April 13th, 2014, 6:22 am

I don't see any sources for any of this information. It *is* new, from what I've found.
Regulus
Is differentiable...

User avatar

Years of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membership

But convergence is not guaranteed.

Posts: 10994
Joined: September 29th, 2011, 1:19 am
Location: W⋅N²=(40.498°)³, W²⋅N=(57.345°)³
Nickname(s): Reg, Regs, Last Person to Post
Gender: Male
Pride Points: 206

Re: The Heartbleed Bug

Postby FlipMode » April 13th, 2014, 12:09 pm

[quote="DGFone"]Here's the deal though: The bug has been around for a few years now, and so has the fix.
[/quote]

Every article I read, including links in OP and statements from major companies have said that although the bug itself has been around a couple of years, it was only really discovered recently and fixes put out as soon as it was discovered.
FlipMode
User avatar

Years of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membershipYears of membership

Posts: 8979
Joined: March 30th, 2010, 9:35 pm
Gender: Male
Pride Points: 266


Return to The Den

Who is online

Users browsing this forum: No registered users and 86 guests

cron