Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations //

Identity & Access Management

11:00 AM
Dave Kearns
Dave Kearns
Connect Directly
E-Mail vvv

Post-Heartbleed: When Not To Change Your Password

One takeaway from Heartbleed is that conventional wisdom about the need to periodically change passwords is wrong.

Even if you’ve been hiding under a rock or vacationing on Mars you’ve heard about the Heartbleed bug. It wasn’t only prominent in the tech journals and blogs, but was blared forth in the general media. Newspapers, radio, TV, magazines all had screaming headlines urging you to "Change all the passwords!" -- and do it now.

They were, of course, wrong.

Two years ago, when an unencrypted file of usernames and passwords was taken from Yahoo’s website, many of these same general-purpose media outlets were also screaming "Change all the passwords!"

A month before that, when more than 6.5 million hashed user passwords were taken from LinkedIn, the media headlines were (you guessed it): ”Change all the passwords!"

They were mostly wrong in all of these cases.

In the case of LinkedIn, the hashed value of passwords is useful only on that one site -- but without the associated username it’s virtually useless. Still, to correct the problem all that has to happen is for LinkedIn to change the hash factor.

In the case of the Yahoo breach, there were usernames associated with the passwords, and they were in clear text. Speculation was that the file was a backup file acquired by Yahoo along with the purchase of software company Associated Content. Rigorous experimentation showed that none of the username/password combos could be used to login to Yahoo.com. So, no need to change your Yahoo password. If you had the same username/password combo on another site, though, it would be good to change that one.

And that brings us to Heartbleed.
Heartbleed was so named because the vulnerability results from a missing bounds check in the handling of the Transport Layer Security (TLS) Heartbeat extension, within the open-source OpenSSL cryptography library, used by approximately 500,000 secure web servers (close to 20 percent) around the world. These servers were believed to be vulnerable to an attack, which would allow theft of the servers' private keys and users' session cookies and passwords.

Extensive research showed that no attacks had taken place up to the time the patched version of OpenSSL was released. That means no passwords were compromised up to that point. Still, those passwords remained vulnerable until the patch was applied.

But if you changed your password before the patch was applied, then the new password (along with all associated data necessary for the change) was now vulnerable. So, no, you shouldn’t "change all the passwords immediately." But what should you do?

  1. Download the extensions for Chrome and Firefox that check websites’ vulnerability to Heartbleed, which you can find out about in this recent article by Dark Reading’s Kelly Jackson Higgins.
  2. Whenever you use HTTPS to view a website, use the browser tool to see if the site is vulnerable or has been patched (or doesn’t need to be patched).
  3. If it’s vulnerable, Get Out of There -- right away.
  4. If it’s been patched, log in then immediately change your password.

It’s not really difficult, but it does require some discipline on your part. There are many lessons to be learned here, the most important of which is to marshal your information so that you can make an informed decision about security. And never, ever rush off to do something because the blonde newsreader on the local TV news tells you that you have to do it. Seek out information from qualified sources first. I know you do (you’re here at Dark Reading, aren’t you?) but make sure your friends, relatives and co-workers also know.

Conventional wisdom is wrong
The other thing Heartbleed should teach us is that the traditional advice to change passwords periodically is wrong. Consider this: Many conspiracy theorists believe that the NSA was aware of Heartbleed and exploited it for years. That would mean that every time you changed your password on a compromised server the spooks would have another entry for your file. If you were truly conscientious about changing passwords, then the surveillance crew could have 20 or more of your well chosen passwords, which, more than likely, were also used by you at some time or other on secure sites that didn’t use OpenSSL. Changing your password made the NSA’s job easier!

Now, before you get all paranoid, it’s been pointed out that Lavabit, Edward Snowden’s email provider, used the OpenSSL library. If NSA had exploited Heartbleed then they wouldn’t have needed to demand that Lavabit turn over it’s SSL keys. Negative evidence, true, but compelling.

There’s no telling what bugs or exploits will turn up in the future, so rather than urge you to slavishly change passwords every 30-60-90 days, the best advice I can give you is to use different passwords for every site you log into. That way, if anyone is compromised it’s only that one site -- and one account -- that’s vulnerable. 

Dave Kearns is a senior analyst for Kuppinger-Cole, Europe's leading analyst company for identity-focused information security and networking. His columns and books have provided a thorough grounding in the basic philosophies of directory technology, networking, and identity ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
David F. Carr
David F. Carr,
User Rank: Strategist
4/30/2014 | 12:20:47 PM
Change passwords between sites, not over time.
Given the limited capacity of our wetware, better to put the effort into remembering a different password for each site, rather than having to remember a new password every few months.
<<   <   Page 2 / 2
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-04-03
A Least Privilege Violation vulnerability in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 allows root users on any crowbar managed node to cause become root on any other node. This issue affects: SUS...
PUBLISHED: 2020-04-03
A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Public Cloud 15-SP1, SUSE Linux Enterprise Module for Server Applications 15, SUSE Linux E...
PUBLISHED: 2020-04-03
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
PUBLISHED: 2020-04-03
ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an otherwise trusted ViewVC instance that also has the `show_subdir_l...
PUBLISHED: 2020-04-02
Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of the root user via tun_darwin.go or tun_windows.go. A user can also use Nebula to execute arbitrary code in the user's own context, e.g., for user-level persistenc...