Users have been advised to consult a list of sites affected by heartbleed and to change their passwords on those sites once they are no longer vulnerable. Facebook appears to have been unaffected; but many affected sites use Facebook logins.

What should users do about affected sites where they use Facebook to log in?


Sites that use Facebook logins should never have access to your username/password. The Facebook API connects the user directly to Facebook, authenticates the user, and then passes that authentication back to the website that you're on.

If something different is going on, that website is probably behaving maliciously (think, emulating the facebook login process like a phishing site, in which case your facebook login would already be compromised). In this case, there's a fairly narrow attack surface opened up by HeartBleed... if that site's private key is compromised, and the session where you sent your user/pass to them was previously captured by the attacker, then they would be able to decrypt your communication. I'm gonna put odds on this one as pretty low. Otherwise, if they are unpatched and you send your facebook user/pass to them again, then an attacker could grab it if they are attacking reasonably close to that moment.

I'm not gonna suggest that such a scenario doesn't exist anywhere on the web, but any site that you typically would want to access that uses a Facebook login never had access to your user/pass to begin with, because the API specifically protects against that scenario.

|improve this answer|||||
  • If the bug leaves no trace, how can it be determined which sites were affected? just curious – Flotsam Apr 9 '14 at 18:47
  • It can only be determined if the site is currently vulnerable. Additionally, you can tell if the current SSL certificate was issued on or after April 7th, which might mean that they patched and got a new certificate (or it might mean that they just happened to get a new certificate around this time). – Jason Apr 9 '14 at 19:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.