Is it safe to use passwords on Stack Exchange sites following the announcement of Heartbleed?
Currently, https://meta.stackexchange.com/a/214543/38765 does not list the sites being fixed.
Meta Stack Exchange is a question and answer site for meta-discussion of the Stack Exchange family of Q&A websites. It only takes a minute to sign up.
Sign up to join this communityIs it safe to use passwords on Stack Exchange sites following the announcement of Heartbleed?
Currently, https://meta.stackexchange.com/a/214543/38765 does not list the sites being fixed.
We will be upgrading our OpenSSL usage this morning to remove the Heartbleed vulnerability. I'll update this post when the live load balancers have been compiled and deployed against 1.0.1g.
We have to test just a bit and I'm just returning from a trip, so it'll be a few hours before this gets rolled out.
Update: We have rolled out a fix for the active vulnerability. Given the nature of the vulnerability, we are changing our private keys and reissuing all our certificates. I will update this post as we progress.
It is extremely unlikely that any of your information was compromised since it requires a number of overlapping factors simultaneously to get the data, and we employ forward secrecy for any modern browser that further narrows those windows.
If you want to change your password to be more proactive you're absolutely welcome to do so, however we suggest waiting until the new certificates are issued to do so - this post will be updated again when that process is complete.
Update 2: We are waiting on our CA to do a final update of all certificates used here - our multi-wildcard SAN cert is a special case which needs manual attention. We are waiting on that now and will flip to the new certificates as soon as we have it in place.
Update 3: We have now finished deploying new keys certificates across the entire network. No further changes are necessary.
According to this check, it is vulnerable: http://filippo.io/Heartbleed/#stackoverflow.com
Edit: Fixed now. It can still be seen in this list of top 10000 sites that, like many others, it was vulnerable.