Ramblings of an old Doc

 

 

You’ve all heard about it and about the website that checks url vulnerability.

Just posting this for you Chrome users – now there’s an extension which works quietly in the background but will pop up a warning if you arrive at one of the smaller (or larger) websites which haven’t fixed the Heartbleed vulnerability.

Here: https://chrome.google.com/webstore/detail/chromebleed/eeoekjnjgppnaegdjbcafdggilajhpic

 

Update:


There are now  Foxbleed and Chromebleed extensions:

http://www.thewindowsclub.com/browser-extensions-protect-heartbleed

 

That being said, it's not at all certain that the "fixed" sites are really fixed after all, and that the 'no warning' or 'safe' sites are really safe at all.

http://www.cnet.com/news/akamai-heartbleed-patch-not-a-fix-after-all/

 

I'll try to keep you all updated regarding this issue.


Comments
on Apr 14, 2014

on Apr 15, 2014

Update:


There are now Foxbleed and Chromebleed extensions to reveal website vulnerability:

http://www.thewindowsclub.com/browser-extensions-protect-heartbleed

 

on Apr 15, 2014

I am using the  one for Chrome. In the 12 sites I visit daily, only one hasn't fixed it. And it is a small site, and I was a bit surprised.  I also read somewhere (could be cnet) that the *fix* really might not fix it all. 

 

on Apr 15, 2014

Not surprising about the small site. You should probably email the webmaster of that site (and then change your password and not logon again until it's fixed).

I think you meant this piece:

http://www.cnet.com/news/akamai-heartbleed-patch-not-a-fix-after-all/

"The crux of the issue, Pinckaers argues, is that while Akamai protects three critical values in an RSA key -- a long, algorithm-created string of numbers designed to create an encrypted connection -- three other values, known as intermediate extra values, are accessible because they weren't "stored in the secure memory area."

"As the...values were not stored in the secure memory area, the possibility exists that these critical values for the SSL keys could have been exposed to an adversary exploiting the Heartbleed vulnerability," Akamai's Ellis said. "Given any CRT value, it is possible to calculate all 6 critical values."

Akamai is now heading back to the drawing board. Ellis says that his company has already started rotating SSL certificates that are vulnerable to protect its customers. Ellis says that some certificates will rotate quickly, while others will take a bit longer."

 

All is not well in internet land.

on Apr 15, 2014

I also have the one for Chrome.