Heartbleed

UPDATE via Steveeboy: Paypal not affected. Check this list of sites or try this. If you use Chrome, you can add this extension to warn you of any unsafe website.

I am so tired of changing my passwords. One of my friends told me I should use a password service that generates a random stream of characters — but who’s to say that can’t be hacked? I’m at the point where I think I just want to pay cash and buy things in person:

The cryptography expert Bruce Schneier, who has been writing about computer security for more than fifteen years, is not given to panic or hyperbole. So when he writes, of the “catastrophic bug” known as Heartbleed, “On the scale of 1 to 10, this is an 11,” it’s safe to conclude that the Internet has a serious problem. The bug, which was announced on Tuesday—complete with an explanatory Web site and a bleeding-heart logo—is a vulnerability in a widely used piece of encryption software called OpenSSL.

Heartbleed is as bad as it is possible for a security flaw to be. It can be easily exploited by anyone on the Internet without leaving a trace, and it can be used to obtain login names, passwords, credit-card information, and even the keys that keep our encrypted communications safe from eavesdroppers. The bug first appeared in OpenSSL code that was released in March, 2012—so the vulnerability has been open to exploitation for more than two years. The Internet-security firm Netcraft reported that up to five hundred thousand sites thought to be secure were, in fact, vulnerable—including Twitter, Yahoo, Tumblr, and Dropbox.