= 27d567bc2d48d9f40e9ccc20ea370b15)
Lumifer comments on Open Thread April 8 - April 14 2014 - Less Wrong Discussion
You are viewing a comment permalink. View the original post to see all comments and the full post content.
= 783df68a0f980790206b9ea87794c5b6)
Loading…= b715d02e85f7b3b4ae65ca3d3e450868)
Subscribe to RSS Feed
Powered by Reddit
= f037147d6e6c911a85753b9abdedda8d)
You are viewing a comment permalink. View the original post to see all comments and the full post content.
Comments (242)
Let me ask an important question: how does Google know? A successful Heartbleed attack leaves no traces unless you're logging all the packets you received in pretty ridiculous detail.
Bruce Schneier says: "At this point, the probability is close to one that every target has had its private keys extracted by multiple intelligence agencies." I consider his opinions to be credible.
Update: Bloomberg says: "The U.S. National Security Agency knew for at least two years about a flaw in the way that many websites send sensitive information, now dubbed the Heartbleed bug, and regularly used it to gather critical intelligence, two people familiar with the matter said."
Yes. The NSA isn't a threat I worry about, since I figure they could get my stuff via a demand to Google, if they wanted it. I am primarily worried about non-government-aided criminals. See Steve Bellovin's analysis for why this isn't so suitable an attack for that class of adversary.
And look what your own link says:
"There's one password you should change nevertheless: your email password."
Besides, Bellovin is talking about what he calls the most serious case -- leakage of crypto keys. If the attackers snarfed your password, they don't need to sniff, mitm, or redirect your traffic.