-
☆ A M B ☆
- 24,524 Posts
It has nothing at all to do with MODX, Evo or Revo. It is a vulnerability in the OpenSSL protocol, which is what is used when you use "https" for a secure connection. It's a server problem, and your hosting company has to fix it, if it's using a version of OpenSSL that has the bug.
-
☆ A M B ☆
- 24,524 Posts
Not everybody has the problem. For example, EBay/PayPal apparently never used the vulnerable version of OpenSSL, and Apple has used their own SSL implementation (with its own occasional problems) for some time now. My favorite hosting provider sent notification that they had patched their servers within a few hours of this vulnerability becoming known.
It's looking more like an obscure theoretical situation than one with any actual implementation. While there's a lot of hysterical "the sky is falling" screaming going on, primarily by security consultants who of course profit from making the most of these things, as well as conspiracy theories involving the NSA, there seems to be (so far anyway) a remarkable lack of any evidence that anybody has actually used the vulnerability.
-
☆ A M B ☆
- 1,780 Posts
Right. The chances that this was actually exploited by the unscrupulous prior to the announcement is small. Afterwards, not known. Those who would exploit likely heard about it Monday like the rest of us and got right on it if they wanted to.
According to LastPass, the following sites are vulnerable (partial list), and not all have updated their certificates yet (although most have). Interestingly enough, amongst the still not updated are some of the stock graphics sites, and Instagram.
Regardless of the possibility being slim that these sites are compromised, a changing of passwords is recommended at possibly affected sites. I'm using it as a good opportunity to evaluate all my passwords. TG for LastPass, which thankfully has been recently updated to work with android apps.
box.com
dropbox.com
github.com
quora.com
yahoo.com
crashplan.com
dreamhost.com
facebook.com
godaddy.com
google.com
gravatar.com
instagram.com
netflix.com
tumblr.com
yahoo.com
-
☆ A M B ☆
- 24,524 Posts
I use this for generating passwords
http://strongpasswordgenerator.com/, and keep them in an encrypted password locker (KeePassX) so I can easily enough copy/paste them as needed. And while it's something I can easily remember, I'll give $1,000 to anybody who can figure out my KeePassX password!
Really important passwords and software keys I also keep in hard-copy in a little book in a secured location, along with my will, my passports and other important papers. Plus I have a copy of the KeePassX database on a USB stick in there as well.
-
☆ A M B ☆
- 1,780 Posts
I decided to pay for LastPass about 6 months ago, and it's saved me on multiple devices ever since. It's super cheap, like $12/year or something like that, but now works on the Android apps (past couple weeks, new feature) and I am a much happier camper away from the main machine. I always have my login available, just remember a single password.
The changing of passwords also has been very slick, updating as I change them. I went through a lot of sites and passwords today with new secure and unique passwords instantly updated. I'm more than happy to pay their premium fee for this kind of security. No, I have no affiliation with LastPass.
Regardless of what you use, a secure password manager is a must. I honestly have no idea how I ever managed without one before...
-
☆ A M B ☆
- 24,524 Posts
I checked out a number of those password services, and just couldn't get comfortable with storing my passwords on a third-party server. What if they get a request or court order to give their lists to some government agency with major computing resources for hacking encryption schemes? Or they just go down, or out of business? I prefer to keep them on my own machine, where I at least have the illusion of control.
Wait...was that a knock at my door? Nah, nobody ever knocks on my door. Not even FedEx or UPS can find me
The local post office won't even deliver to my door, I have to get a PO box.
-
☆ A M B ☆
- 1,780 Posts
Right, so if Susan doesn't return today... we know she was grammknapped and we'll begin raising funds for her ransom.
Thanks for reminding me to take an export of my passwords from LastPass. Good idea to not rely entirely on online services.
We'll miss you Susan, enjoy your abduction :~}
-
☆ A M B ☆
- 24,524 Posts
I'll have to make sure to keep an app handy for secure-wiping my hard drive! Wouldn't want anybody to know about my suspect MODX and PHP documentation connections, not to mention all those knitting and quilting pattern images in my browser history.
