Timeline for How to explain Heartbleed without technical terms?
Current License: CC BY-SA 3.0
28 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 7, 2021 at 8:14 | history | edited | CommunityBot |
replaced https://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc
|
|
| Mar 17, 2017 at 13:21 | history | edited | CommunityBot |
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
|
|
| Apr 14, 2014 at 15:34 | comment | added | ehime | This should be the accepted answer, very ondepth and informative... Hell my 11yr old daughter read it and understood what he was saying... | |
| Apr 14, 2014 at 6:55 | comment | added | LAFK says Reinstate Monica | @MichaelBorgwardt I wouldn't say so. It really quite depends on people you explain this to. Surprisingly often I met people without tech background following such explanations with little or no difficulty. I also would say that verifying commit times and making it known who reported the failure and who coded it are really nice bits of information. | |
| Apr 13, 2014 at 19:19 | comment | added | Lightness Races in Orbit | Yeah, this is a great explanation of Heartbleed, but not for a layperson. | |
| Apr 12, 2014 at 10:08 | comment | added | SPRBRN | @drjimbob - your answer worked for me, and it helped me to write my answer. | |
| Apr 12, 2014 at 9:17 | comment | added | Voo | Arguably technical terms in this answer, that are not explained before being used: encryption, library, SSL, network traffic, server load, payload size,.. and that's about a quarter of the explanation in before I got bored. I think people here forget that a large part of the population doesn't know what a "browser" is. | |
| Apr 11, 2014 at 16:38 | comment | added | dr jimbob | @MichaelBorgwardt - I tried giving a thorough answer without resorting to just technical jargon or giving silly analogies. I believe some found it helpful. It's not obviously not an "Explain it like I'm a five" or explain it in under a minute, but take the time to explain and related concepts like you are an intelligent adult, even if you aren't a computer/security expert. | |
| Apr 11, 2014 at 12:57 | comment | added | Richard Tingle | @MichaelBorgwardt Probably true, but for someone who is technical but has no idea about web technology it is excellent | |
| Apr 11, 2014 at 10:57 | comment | added | Michael Borgwardt | -1: this is a horrible answer to the question as stated. There is no chance that a non-tech-savy user would listen to, let alone understand even 10% of this. | |
| Apr 11, 2014 at 10:54 | comment | added | Celeritas | It's almost humerus how Lastpass's heart bleed checker tool detects lastpass as possibly compromised. Does that mean anyone who used lastpass should change all passwords? | |
| Apr 11, 2014 at 2:55 | comment | added | Wossname | What's the purpose of the payload? | |
| Apr 11, 2014 at 0:59 | comment | added | dr jimbob | @Celeritas - Those of the sort of things I expect, (though a sane password manager would only load passwords into memory as necessary and free them quickly). Again, if you patched your OpenSSL on your system to 1.0.1g or used a version before 1.0.1, you are safe from this attack. If you use linux and are familiar with python and have root access, you can explore the contents of memory. Simply find the PID of your web browser (e.g., with top) and then use the python2 script given here, and remember the client attack will only get random chunks. | |
| Apr 10, 2014 at 23:20 | comment | added | Celeritas | "This would cause the web browser to leak up to 64KB of information to the webserver." what information could this be? For example would it be cached information about websites? Could it be data stored by add-ons, for example pass word managers like lastpass? | |
| S Apr 10, 2014 at 15:30 | history | edited | dr jimbob | CC BY-SA 3.0 |
unpacked ssh
|
| S Apr 10, 2014 at 15:30 | history | suggested | Elliptical view | CC BY-SA 3.0 |
unpacked ssh
|
| Apr 10, 2014 at 15:19 | review | Suggested edits | |||
| Apr 10, 2014 at 15:30 | |||||
| Apr 10, 2014 at 15:18 | vote | accept | user36976 | ||
| Apr 10, 2014 at 15:18 | |||||
| Apr 10, 2014 at 11:02 | vote | accept | user36976 | ||
| Apr 10, 2014 at 15:18 | |||||
| Apr 10, 2014 at 10:42 | comment | added | SPRBRN | Thanks for the excellent explanation, plus making clear that SSH is not affected. The conspiracy twist at the end - the icing on the cake! | |
| S Apr 10, 2014 at 10:42 | history | suggested | SPRBRN | CC BY-SA 3.0 |
Reorderd one sentence
|
| Apr 10, 2014 at 10:23 | review | Suggested edits | |||
| S Apr 10, 2014 at 10:42 | |||||
| Apr 10, 2014 at 9:59 | history | edited | dr jimbob | CC BY-SA 3.0 |
added 1257 characters in body
|
| Apr 10, 2014 at 9:54 | history | edited | dr jimbob | CC BY-SA 3.0 |
added 1257 characters in body
|
| Apr 10, 2014 at 9:42 | history | edited | dr jimbob | CC BY-SA 3.0 |
added 1257 characters in body
|
| Apr 10, 2014 at 9:26 | history | edited | dr jimbob | CC BY-SA 3.0 |
added 1257 characters in body
|
| Apr 10, 2014 at 9:02 | history | edited | dr jimbob | CC BY-SA 3.0 |
added 1257 characters in body
|
| Apr 10, 2014 at 7:30 | history | answered | dr jimbob | CC BY-SA 3.0 |