Is it safe to use passwords on Stack Exchange sites following the announcement of Heartbleed?

Currently, https://meta.stackexchange.com/a/214543/38765 does not list the sites being fixed.

  • 12
    I notified the proper authorities, but SE isn't a network of banking sites, and hopefully you aren't storing your SSN and tax returns here. Also, everyone is asleep right now, so it might take a few hours for someone from SE corporate to respond. – Robert Harvey Apr 8 '14 at 5:27
  • 18
    Sound the alarms! Cook the waffles! Alert the unicorns! There's a a security problem! (Ok, not very exciting, next question) – bjb568 Apr 8 '14 at 6:02
  • 14
    @bjb568 Can I cook the unicorns and alert the waffles instead? – Andrew Grimm Apr 8 '14 at 12:53
  • 3
    @AndrewGrimm Blasphemy! – michaelb958 Apr 8 '14 at 14:23
  • 4
    @AndrewGrimm don't mess with the unicorns. – Bacco Apr 8 '14 at 16:47
  • @AndrewGrimm *Say this in Homer Simpson voice* Ah... Unicorn meat. – Ben Apr 12 '14 at 23:31
up vote 104 down vote accepted
+400

We will be upgrading our OpenSSL usage this morning to remove the Heartbleed vulnerability. I'll update this post when the live load balancers have been compiled and deployed against 1.0.1g.

We have to test just a bit and I'm just returning from a trip, so it'll be a few hours before this gets rolled out.

Update: We have rolled out a fix for the active vulnerability. Given the nature of the vulnerability, we are changing our private keys and reissuing all our certificates. I will update this post as we progress.

It is extremely unlikely that any of your information was compromised since it requires a number of overlapping factors simultaneously to get the data, and we employ forward secrecy for any modern browser that further narrows those windows.

If you want to change your password to be more proactive you're absolutely welcome to do so, however we suggest waiting until the new certificates are issued to do so - this post will be updated again when that process is complete.

Update 2: We are waiting on our CA to do a final update of all certificates used here - our multi-wildcard SAN cert is a special case which needs manual attention. We are waiting on that now and will flip to the new certificates as soon as we have it in place.

Update 3: We have now finished deploying new keys certificates across the entire network. No further changes are necessary.

  • 13
    Is it possible to check if the exploit was used to hack your servers? Should users change passwords? – Shadow Wizard Apr 8 '14 at 10:33
  • 6
    @ShadowWizard it is not something we track as this happens at the transport layer. It is extremely unlikely that your passwords were open to anyone but I will post more details. As always, if you want to be 100% secure, then change your password - please wait a bit before doing this though as we're re-issuing certs. We do employ forward secrecy so that limits exposure windows even more. I'll update this post as we progress with re-securing our properties. – Nick Craver Apr 8 '14 at 11:36
  • 5
    Thanks @Nick. Another one, since Yahoo isn't safe yet and might take years to be bothered to fix it on their side, are those using Yahoo as OpenID provider exposed to attacks? – Shadow Wizard Apr 8 '14 at 14:14
  • @ShadowWizard My reading of things is that could definitely be a concern, especially with such a prominent target and the complexities of their network. I'd be careful about it for the time being, and perhaps consider periodic password changes there until more information re: Yahoo comes out. – Andrew Barber Apr 8 '14 at 14:23
  • 3
    @Andrew yep, was thinking more like adding a big red warning for those using Yahoo provider. – Shadow Wizard Apr 8 '14 at 14:30
  • 10
    @ShadowWizard With hand-drawn, red circles. Because red circles. – Andrew Barber Apr 8 '14 at 14:31
  • 2
    @NickCraver: What about sessions? From what I have seen in my tests, session cookies were exposed on every single request against a vulnerable server. So it might be a good idea to invalidate all existing sessions. – Wladimir Palant Apr 8 '14 at 16:07
  • 1
    @WladimirPalant Our OpenId provider only keeps a single session valid anyway. – balpha Apr 8 '14 at 16:18
  • @WladimirPalant none of our sessions are SSL secured at this time except for OpenId which as Ben notes has a single session active and also has very limited exposure via forward secrecy. – Nick Craver Apr 8 '14 at 16:29
  • 1
    @NickCraver: Exposing sessions to somebody who can listen in on the connection is one thing. However, Heartbleed exposes session cookies of random users to anybody who who wants to make a request to the server. – Wladimir Palant Apr 8 '14 at 16:46
  • 8
    @WladimirPalant our session cookies rotate very frequently, any cookies exposed via that method have long since been invalidated - it's not worth the support tradeoff for a very narrow, very unlikely scenario we have right now. As it stands, I see no user sessions in the past 2 weeks that have changed IPs on the same cookie session and token in our logs. – Nick Craver Apr 8 '14 at 16:50
  • What if you use your google account to login to stack exchange? Shall I change my google password just to be safe? – Eddy Apr 9 '14 at 18:56
  • 11
    @Eddy your Google password never went to our servers, it went directly to Google - OpenID works without you passing your credentials to every site, that's one of the positives of it. – Nick Craver Apr 9 '14 at 19:50

According to this check, it is vulnerable: http://filippo.io/Heartbleed/#stackoverflow.com

Edit: Fixed now. It can still be seen in this list of top 10000 sites that, like many others, it was vulnerable.

  • 16
    May I be the thirteen thousandth to say: that is horrifying. – Zyerah Apr 8 '14 at 6:53
  • 6
    Google is safe, Facebook is safe, no surprise but Yahoo! is not safe. – Shadow Wizard Apr 8 '14 at 7:37
  • 2
    Here is another Heartbleed check service: possible.lv – Igor Kustov Apr 8 '14 at 8:40
  • 4
    Both checkers now seem to suggest we are safe (cc @IgorKustov) – Richard Tingle Apr 8 '14 at 11:30
  • I don't think that entering someone else's domain into some website that you don't own yourself, helps anyone: websites like that have been collecting a nice list of vulnerable domains. (cc. @Igor) – Arjan Apr 8 '14 at 17:55
  • 3
    @Arjan: a security issue of site, when I am their user, is my problem too, therefore I want to be sure that everything is OK. Also the best way to collect such list, is to write vulnerability scanner for domain list, rather than to write online-checker and wait. – Igor Kustov Apr 8 '14 at 18:21
  • Indeed, @Igor, it is (well, was) my problem too. That's why I'd let sleeping dogs lie... Heck, I wouldn't even enter my own domains into such service before being quite sure I fixed things, and being ready to investigate more if such test proved me wrong. (As an aside: one does not need online services to test this.) – Arjan Apr 8 '14 at 18:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .