101

Is it safe to use passwords on Stack Exchange sites following the announcement of Heartbleed?

Currently, https://meta.stackexchange.com/a/214543/38765 does not list the sites being fixed.

Improve this question
6
  • 12
    I notified the proper authorities, but SE isn't a network of banking sites, and hopefully you aren't storing your SSN and tax returns here. Also, everyone is asleep right now, so it might take a few hours for someone from SE corporate to respond.
    – user102937
    Apr 8, 2014 at 5:27
  • 18
    Sound the alarms! Cook the waffles! Alert the unicorns! There's a a security problem! (Ok, not very exciting, next question)
    – bjb568
    Apr 8, 2014 at 6:02
  • 14
    @bjb568 Can I cook the unicorns and alert the waffles instead?
    – Andrew Grimm
    Apr 8, 2014 at 12:53
  • 3
    @AndrewGrimm Blasphemy!
    – michaelb958--GoFundMonica
    Apr 8, 2014 at 14:23
  • 4
    @AndrewGrimm don't mess with the unicorns.
    – Largato
    Apr 8, 2014 at 16:47
  • @AndrewGrimm *Say this in Homer Simpson voice* Ah... Unicorn meat.
    – Ben
    Apr 12, 2014 at 23:31

2 Answers 2

Reset to default
104
+400

We will be upgrading our OpenSSL usage this morning to remove the Heartbleed vulnerability. I'll update this post when the live load balancers have been compiled and deployed against 1.0.1g.

We have to test just a bit and I'm just returning from a trip, so it'll be a few hours before this gets rolled out.

Update: We have rolled out a fix for the active vulnerability. Given the nature of the vulnerability, we are changing our private keys and reissuing all our certificates. I will update this post as we progress.

It is extremely unlikely that any of your information was compromised since it requires a number of overlapping factors simultaneously to get the data, and we employ forward secrecy for any modern browser that further narrows those windows.

If you want to change your password to be more proactive you're absolutely welcome to do so, however we suggest waiting until the new certificates are issued to do so - this post will be updated again when that process is complete.

Update 2: We are waiting on our CA to do a final update of all certificates used here - our multi-wildcard SAN cert is a special case which needs manual attention. We are waiting on that now and will flip to the new certificates as soon as we have it in place.

Update 3: We have now finished deploying new keys certificates across the entire network. No further changes are necessary.

Improve this answer
13
  • 13
    Is it possible to check if the exploit was used to hack your servers? Should users change passwords?
    – Shadow Wizard Is Sad And Angry
    Apr 8, 2014 at 10:33
  • 6
    @ShadowWizard it is not something we track as this happens at the transport layer. It is extremely unlikely that your passwords were open to anyone but I will post more details. As always, if you want to be 100% secure, then change your password - please wait a bit before doing this though as we're re-issuing certs. We do employ forward secrecy so that limits exposure windows even more. I'll update this post as we progress with re-securing our properties.
    – Nick Craver
    Apr 8, 2014 at 11:36
  • 5
    Thanks @Nick. Another one, since Yahoo isn't safe yet and might take years to be bothered to fix it on their side, are those using Yahoo as OpenID provider exposed to attacks?
    – Shadow Wizard Is Sad And Angry
    Apr 8, 2014 at 14:14
  • @ShadowWizard My reading of things is that could definitely be a concern, especially with such a prominent target and the complexities of their network. I'd be careful about it for the time being, and perhaps consider periodic password changes there until more information re: Yahoo comes out.
    – Andrew Barber
    Apr 8, 2014 at 14:23
  • 3
    @Andrew yep, was thinking more like adding a big red warning for those using Yahoo provider.
    – Shadow Wizard Is Sad And Angry
    Apr 8, 2014 at 14:30
  • 10
    @ShadowWizard With hand-drawn, red circles. Because red circles.
    – Andrew Barber
    Apr 8, 2014 at 14:31
  • 2
    @NickCraver: What about sessions? From what I have seen in my tests, session cookies were exposed on every single request against a vulnerable server. So it might be a good idea to invalidate all existing sessions.
    – Wladimir Palant
    Apr 8, 2014 at 16:07
  • 1
    @WladimirPalant Our OpenId provider only keeps a single session valid anyway.
    – balpha StaffMod
    Apr 8, 2014 at 16:18
  • @WladimirPalant none of our sessions are SSL secured at this time except for OpenId which as Ben notes has a single session active and also has very limited exposure via forward secrecy.
    – Nick Craver
    Apr 8, 2014 at 16:29
  • 1
    @NickCraver: Exposing sessions to somebody who can listen in on the connection is one thing. However, Heartbleed exposes session cookies of random users to anybody who who wants to make a request to the server.
    – Wladimir Palant
    Apr 8, 2014 at 16:46
  • 8
    @WladimirPalant our session cookies rotate very frequently, any cookies exposed via that method have long since been invalidated - it's not worth the support tradeoff for a very narrow, very unlikely scenario we have right now. As it stands, I see no user sessions in the past 2 weeks that have changed IPs on the same cookie session and token in our logs.
    – Nick Craver
    Apr 8, 2014 at 16:50
  • What if you use your google account to login to stack exchange? Shall I change my google password just to be safe?
    – Eddy
    Apr 9, 2014 at 18:56
  • 11
    @Eddy your Google password never went to our servers, it went directly to Google - OpenID works without you passing your credentials to every site, that's one of the positives of it.
    – Nick Craver
    Apr 9, 2014 at 19:50
33

According to this check, it is vulnerable: http://filippo.io/Heartbleed/#stackoverflow.com

Edit: Fixed now. It can still be seen in this list of top 10000 sites that, like many others, it was vulnerable.

Improve this answer
7
  • 16
    May I be the thirteen thousandth to say: that is horrifying.
    – user206222
    Apr 8, 2014 at 6:53
  • 6
    Google is safe, Facebook is safe, no surprise but Yahoo! is not safe.
    – Shadow Wizard Is Sad And Angry
    Apr 8, 2014 at 7:37
  • 2
    Here is another Heartbleed check service: possible.lv
    – Igor Kustov
    Apr 8, 2014 at 8:40
  • 4
    Both checkers now seem to suggest we are safe (cc @IgorKustov)
    – Richard Tingle
    Apr 8, 2014 at 11:30
  • I don't think that entering someone else's domain into some website that you don't own yourself, helps anyone: websites like that have been collecting a nice list of vulnerable domains. (cc. @Igor)
    – Arjan
    Apr 8, 2014 at 17:55
  • 3
    @Arjan: a security issue of site, when I am their user, is my problem too, therefore I want to be sure that everything is OK. Also the best way to collect such list, is to write vulnerability scanner for domain list, rather than to write online-checker and wait.
    – Igor Kustov
    Apr 8, 2014 at 18:21
  • Indeed, @Igor, it is (well, was) my problem too. That's why I'd let sleeping dogs lie... Heck, I wouldn't even enter my own domains into such service before being quite sure I fixed things, and being ready to investigate more if such test proved me wrong. (As an aside: one does not need online services to test this.)
    – Arjan
    Apr 8, 2014 at 18:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .