Post-Heartbleed: When <i>Not</i> To Change Your Password

Even if you’ve been hiding under a rock or vacationing on Mars you’ve heard about the Heartbleed bug. It wasn’t only prominent in the tech journals and blogs, but was blared forth in the general media. Newspapers, radio, TV, magazines all had screaming headlines urging you to "Change all the passwords!" -- and do it now.

They were, of course, wrong.

Two years ago, when an unencrypted file of usernames and passwords was taken from Yahoo’s website, many of these same general-purpose media outlets were also screaming "Change all the passwords!"

A month before that, when more than 6.5 million hashed user passwords were taken from LinkedIn, the media headlines were (you guessed it): ”Change all the passwords!"

They were mostly wrong in all of these cases.

In the case of LinkedIn, the hashed value of passwords is useful only on that one site -- but without the associated username it’s virtually useless. Still, to correct the problem all that has to happen is for LinkedIn to change the hash factor.

In the case of the Yahoo breach, there were usernames associated with the passwords, and they were in clear text. Speculation was that the file was a backup file acquired by Yahoo along with the purchase of software company Associated Content. Rigorous experimentation showed that none of the username/password combos could be used to login to Yahoo.com. So, no need to change your Yahoo password. If you had the same username/password combo on another site, though, it would be good to change that one.

And that brings us to Heartbleed.
Heartbleed was so named because the vulnerability results from a missing bounds check in the handling of the Transport Layer Security (TLS) Heartbeat extension, within the open-source OpenSSL cryptography library, used by approximately 500,000 secure web servers (close to 20 percent) around the world. These servers were believed to be vulnerable to an attack, which would allow theft of the servers' private keys and users' session cookies and passwords.

Extensive research showed that no attacks had taken place up to the time the patched version of OpenSSL was released. That means no passwords were compromised up to that point. Still, those passwords remained vulnerable until the patch was applied.

But if you changed your password before the patch was applied, then the new password (along with all associated data necessary for the change) was now vulnerable. So, no, you shouldn’t "change all the passwords immediately." But what should you do?

It’s not really difficult, but it does require some discipline on your part. There are many lessons to be learned here, the most important of which is to marshal your information so that you can make an informed decision about security. And never, ever rush off to do something because the blonde newsreader on the local TV news tells you that you have to do it. Seek out information from qualified sources first. I know you do (you’re here at Dark Reading, aren’t you?) but make sure your friends, relatives and co-workers also know.

Conventional wisdom is wrong
The other thing Heartbleed should teach us is that the traditional advice to change passwords periodically is wrong. Consider this: Many conspiracy theorists believe that the NSA was aware of Heartbleed and exploited it for years. That would mean that every time you changed your password on a compromised server the spooks would have another entry for your file. If you were truly conscientious about changing passwords, then the surveillance crew could have 20 or more of your well chosen passwords, which, more than likely, were also used by you at some time or other on secure sites that didn’t use OpenSSL. Changing your password made the NSA’s job easier!

Now, before you get all paranoid, it’s been pointed out that Lavabit, Edward Snowden’s email provider, used the OpenSSL library. If NSA had exploited Heartbleed then they wouldn’t have needed to demand that Lavabit turn over it’s SSL keys. Negative evidence, true, but compelling.

There’s no telling what bugs or exploits will turn up in the future, so rather than urge you to slavishly change passwords every 30-60-90 days, the best advice I can give you is to use different passwords for every site you log into. That way, if anyone is compromised it’s only that one site -- and one account -- that’s vulnerable.