Questions about Heartbleed have been showing up in the popular questions list today since morning, from the security stack exchange to android
I have been reading many of them, most of them are technical and from a server administrators perspective so difficult to understand for the average user
These are a few simple ones that I have found
- How exactly does the OpenSSL TLS heartbeat (Heartbleed) exploit work?
- What should end-users do about Heartbleed?
- Does the heartbleed vulnerability affect clients as severely?
I do not understand the technical details, so as an average windows user, how paranoid should I be, and is there anything that I should (or can) do, if a service that I use is vulnerable?
For example, the accepted answer for item 4 above says this about vulnerable systems:
Information on common clients:
Windows (all versions): Probably unaffected (uses SChannel/SSPI), but attention should be paid to the TLS implementations in individual applications. For example, Cygwin users should update their OpenSSL packages.
OSX and iOS (all versions): Probably unaffected. SANS implies it may be vulnerable by saying "OS X Mavericks has NO PATCH available", but others note that OSX 10.9 ships with OpenSSL 0.9.8y, which is not affected. Apple says: "OpenSSL libraries in OS X are deprecated, and OpenSSL has never been provided as part of iOS"
Chrome (all platforms except Android): Probably unaffected (uses NSS)
Chrome on Android: 4.1.1 may be affected (uses OpenSSL). Source. 4.1.2 should be unaffected, as it is compiled with heartbeats disabled. Source. Mozilla products (e.g. Firefox, Thunderbird, SeaMonkey, Fennec): Probably unaffected, all use NSS
So if I am an average Windows user with chrome as default browser, I am not vulnerable? I don't think that's true so I am probably not getting something here. This page says that Yahoo is the biggest web service provider that is known to be vulnerable (also includes stackexchange). So if I have a Yahoo email or stackexchange account, does this mean my password is vulnerable from my computer's side when I type it in? In the answer that I quoted above, it says Windows and Chrome are probably unaffected as they don't use openssl. So how does this make me vulnerable when using Yahoo and stackexchange that apparently do use openssl? Is there anything I can do about it, and if so, what can I do? Change my password immediately, or wait for them to contact me, and change password after that?
I have another question. The accepted answer for item 1 has this to say:
Well, errant code in OpenSSL. Here is the commit that fixed the vulnerability. I won't speculate on whether this was truly a mistake or possibly a bit of code slipped in on behalf of a bad actor. The bug showed up in December of 2011 and was patched today, April 7th, 2014.
If the bug is that old, and it really is this serious, then why wasn't anything done till now?