What to Do About Heartbleed

So, what should you be doing about Heartbleed?

1. Know what it is: Heartbleed is the name of a major security vulnerability that may affect nearly two-thirds of websites online. It’s a severe situation potentially exposing your login information—your username and password—and other sensitive information about you.

2. Try to find out if the online service you are concerned about has updated their servers in order to compensate for the Heartbleed vulnerability. Do not change your passwords until you’ve done this. A lot of outlets are reporting that you need to do this as soon as possible, but the problem is that Heartbleed primarily affects the server end of communications, meaning if the server hasn’t been updated with Heartbleed in mind, then changing your password will not have the desired outcome. Mashable has a list of popular websites affected by the Heartbleed vulnerability. View that list, but keep in mind that this list is not comprehensive, but it is an excellent place to start.

3. Don’t be taken in by a phishing attack trying to get you to change one password on various services. Don’t go to a site where you want to or need to change your password from a link in an email sent about your password. Instead, manually head to the website yourself, log in, and then, change your password.

4. Keep an ear out about Heartbleed and other related security flaws, do some research on them, and then make the appropriate changes.

5. Think about getting a Password Manager program like 1Password to help you keep track of your passwords, let you change them easily and efficiently, and keep you from being tempted to use the same password for more than one site.

6. Understand that Heartbleed may just be the tip of the iceberg. Heartbleed "underscores the possibility that there are potentially so many vulnerabilities out there right now, right under our noses, that we don't quite realize. One of these days someone will -- and I hope the good guys find it first," Verizon's Bryan Sartin says.

Password Mindreader

We all have troubles with remembering and creating our passwords – even kids, who are some of the worst culprits for using the same password over and over again. Too many of us use familiar words or names, so the truth is, that so many of the passwords we create are not the most secure. Microsoft has come to the rescue with a new digital tool called Telepathwords. It’s online for anyone to use making it a great resource for teaching about safe passwords. Telepathwords works by having the user start to put in a password and then it guesses what you’ll add next. A real eye opener for adults and kids who think they have the technology all figured out!

Another Solution to Playing Password

Can’t remember all those passwords so you use the same one over and over again and live with the guilt? Now, there is an update to one solution – and it’s free and easy to use. Dashlane 2.0 works in Safari, Chrome, Internet Explorer, and Firefox. It can import existing password “vaults” from rival programs. It is a password memorizer and it can also fill in other kinds of Web site forms: your name/address/phone number, and even your credit card information. As far as security goes, Dashlane never sees your passwords – they are stored on your computer using an AES-256 encryption method, an open-source standard approved by the National Security Agency. Your entire Dashlane universe is protected by a master password. It’s intended to prevent a laptop thief from heading online with your missing computer and going on a shopping spree. If you’re still worried, there is also two-step authentication offered, as well, where you have to enter your master password as well as a code that Dashlane texts to your phone. For more, see what David Pogue of the Times has to say about the newest version of Dashlane.

Services to Keep Your Passwords Safe

Ok – we all know that we should generate a different password for every site that requires them, make them long and strong, mix in odd characters, and avoid pet names, but let’s face it, they are hard to remember and trying to keep them straight is a nightmare.  I have previously recommended that you use password management software, but USA Today recently featured an article with four services that can help you end playing the “guess the password” game and make your life a whole lot simpler.

Password Protection – Yes Again

The writings on this site must sometimes sound like a broken record: “protect your passwords” being one of the cautions repeated like a mantra. But if you follow the press about what is going on out in the digital world it seems that some people haven’t gotten the message yet. Recently a hacker revealed millions of user names and passwords being used on a site called Rockyou.com and when those passwords were analyzed it seems that nearly 50% of them or 16 million people used names, slang words, dictionary words, or "trivial" passwords such as consecutive digits -- 123456, for example -- and adjacent keyboard keys such as "QWERTY." In fact the most common password on Rockyou.com was “123456.” It may be time to brush up on your “password-eze”. Take a look at Stop Playing Password on this site.

Death, Online Gaming. Passwords and More

OK, so what happens if a loved one dies and you are left with the job of telling their online friends the news or maybe you just want to shut down some of their online accounts or subscriptions but they haven’t left you a set of passwords? Those are questions that three different sites have taken up after just these kinds of situations occurred. One of those is Deathswitch, where people can set up e-mails that will be sent out automatically if they don't check in at intervals they specify, like once a week. For $20 per year, members can create up to 30 e-mails with attachments like video files. Slightly Morbid also sends e-mail when a member dies, but doesn't rely on them logging in periodically while they're alive. Instead, members have to give trusted friends or family the information needed to log in to the site and start the notification process if something should happen. And a new similar site, Legacy Locker, will debut in April and  charge $30 per year. It will require a copy of a death certificate before releasing information. Curious about the circumstances that brought these sites to life? Read Death leaves online lives in limbo on the USAToday online site. Certainly makes one stop and think.

New Site, Same Password Opens Door to Hackers

It's so easy to do in the whirl of everyday life - use the same password on every site you shop on, to open you Facebook page, for your email and who knows what else. But using the same password for multiple Web pages is the Internet-era equivalent of having the same key for your home, car and bank safe-deposit box. While people seem to understand this is a no-no - 88 percent of the 800 people interviewed in the U.S. and the UK for a survey on the subject said personal irresponsibility is the key cause of identity theft and fraud - nearly half of these 800 interviewees still said that they use just one password for all their online accounts. Researchers say the findings suggest that many users underestimate the growing threat from organized cyber-criminals who reap big profits from selling stolen identities. The result costs consumers hundreds of millions of dollars a year in higher security costs.