Pre Migration Most liked posts in thread: M/A and the Heartbleed Exploit

  1. Nathan

    Nathan Founder

    Mar 30, 2009
    25,144
    10,052
    113
    Writer
    Short North
    Ratings:
    +10,069 / 0 / -0
    #3 Nathan, Apr 9, 2014
    This exploit has been around for about 2 years. So in the event the password was grabbed from this site now that it has been patched changing the password would prevent it's possible use in the future due to the exploit.

    Also, if you use the same password on multiple sites, a bad idea) and if one of those sites has not been patched yet then the info can still be grabbed.

    Ideally you should never use the same password on two accounts that matter. Whoever is in charge of security at, say, HottestCheerleadersPlusCheapMedicineFromThailand.com (not an actual site I have visited) might not know how to protect against hacks, or might even dishonestly sell its user info to hackers. They could then blindly try the combos elsewhere.
     
  2. cct1

    cct1 Well-Known Member
    Lifetime Supporter

    May 5, 2009
    3,378
    3,368
    113
    Ratings:
    +3,369 / 0 / -0
    #6 cct1, Apr 9, 2014
    Hmmm...Interesting. Because I was on that site last night, and picture of your car was on it. Maybe Dustin owns it?
     
  3. Steve

    Steve Administrator
    Staff Member Articles Moderator

    Apr 23, 2009
    12,154
    3,164
    113
    Maryland, USA
    Ratings:
    +3,166 / 0 / -0
    #2 Steve, Apr 9, 2014
    I haven't read anything but headlines on this so pardon me if this question is naive.

    How would it help to change passwords now? Won't a new password be just as at risk as an old one or was this a one-time exploit that's already dead?
     
  4. DneprDave

    DneprDave Well-Known Member
    Supporting Member

    Oct 23, 2010
    2,959
    1,505
    113
    Engineer
    Pacific NW
    Ratings:
    +1,731 / 0 / -0
    #4 DneprDave, Apr 9, 2014
  5. Nathan

    Nathan Founder

    Mar 30, 2009
    25,144
    10,052
    113
    Writer
    Short North
    Ratings:
    +10,069 / 0 / -0
    #5 Nathan, Apr 9, 2014
    If you put M/A's URL into those tests they will fail to run properly due to the configuration used to thwart the DDOS attacks we had back in November and December.