CloudFlare's Heartbleed challenge cracked

badusername wrote: post #5

So this does mean that I need to change my passwords on every damn site on the list? Oh bollocks, those passwords were a work of art.

No. This means you need to change keys for every ssl service you run. Passwords were known to be leaked earlier.

Re: CloudFlare's Heartbleed challenge cracked

#9

Post by sitkack » Sat, Apr 12, 2014, 12:59 AM UTC

spindritf wrote: post #8

badusername wrote: post #5

So this does mean that I need to change my passwords on every damn site on the list? Oh bollocks, those passwords were a work of art.

No. This means you need to change keys for every ssl service you run. Passwords were known to be leaked earlier.

New PRIVATE KEY, then new certs with that key.

Re: CloudFlare's Heartbleed challenge cracked

#10

Post by girvo » Sat, Apr 12, 2014, 1:02 AM UTC

bigiain wrote: post #6

tectonic wrote: post #2

Ah crap.

On the other hand, if anyone asks me to justify all that "unproductive time" this week, I don't need to handwave and explanations any more.

I was lucky, my boss understood pretty quickly how big a deal it was. My project manager didn't, though, but he did pretty quick when I cracked our dev server and told him his password for a couple of services.

It was fun playing pen tester and getting paid for it this week :)