Active discussions

Please or to access all these features

Talk
Site stuff

Join our Innovation Panel to try new features early and help make Mumsnet better.

See all MNHQ comments on this thread

Original poster

Possible MN Heartbleed vulnerability

41 replies

cozietoesie · 10/04/2014 10:17

Without wanting to start a scare where the reality of the problem might be limited, are MNHQ recommending a change of password to users given that Mumsnet looks at the moment to be one of the sites classified as vulnerable?

OP posts:
slightlyglitterstained · 11/04/2014 21:05

And sitting here on my phone, I notice my connection is http anyway!

slightlyglitterstained · 11/04/2014 21:02

This is a nice explanation
xkcd.com/1354/

Agree with Keepithidden.

Keepithidden · 11/04/2014 20:15

Shamtech, you said this "Secondly, due to the fact that user passwords on Mumsnet are not revealed, not even to the user of the account, there is no way for anyone who may have been able to masquerade as you using the Heartbleed bug, to find out what your password is. And because they need to know your password to change your password, they would also not have been able to lock you out of your own account."

This is completely untrue.

This shows you don't actually know how the heartbleed bug works. There could have been some real damage done here, but instead an obvious joke thread was posted which alerted the community that security has been compromised.

The way heartbleed works is by dumping random bits of the server's RAM. The site is patched now, but the way that Justine's password was got could be applied to any other user logging in at the same time.

Signed.

Someone in the know ;)

Original poster
cozietoesie · 11/04/2014 19:00

Put it this way - I've changed my password.

OP posts:
Original poster
cozietoesie · 11/04/2014 18:50

I did wonder a little.

OP posts:
meditrina · 11/04/2014 18:28

A bump, given what's just happened and some posters wondering if it could be Heartbleed.

meditrina · 10/04/2014 21:14

(somewhat later on) - Thanks Tech! Wine

Original poster
cozietoesie · 10/04/2014 11:06

Fast action, Tech. Well done.

OP posts:
MNHQ
ShamTech · 10/04/2014 10:47

Hi all. Thanks for your concerns.

Firstly, we already applied the fix to our servers shortly after the news broke. You can check for yourselves at filippo.io/Heartbleed - just type mumsnet.com into the field and hit the button.

Secondly, due to the fact that user passwords on Mumsnet are not revealed, not even to the user of the account, there is no way for anyone who may have been able to masquerade as you using the Heartbleed bug, to find out what your password is. And because they need to know your password to change your password, they would also not have been able to lock you out of your own account.

We have no evidence whatsoever of anyone's account having been compromised at Mumsnet. From Tech's point of view, you should not need to change your password.

Original poster
cozietoesie · 10/04/2014 10:34

Thanks Rowan.

OP posts:
MNHQ
RowanMumsnet · 10/04/2014 10:32

Hello - we do understand people's concerns about Heartbleed; we've asked Tech for their viewpoint and will post it up when we have it.

Original poster
cozietoesie · 10/04/2014 10:31

Sorry. Maybe give it a few hours for someone to play around with it.

OP posts:
meditrina · 10/04/2014 10:30

Curses! I was looking at the GitHub list earlier, and had hoped you might have found something easier to read!

Original poster
cozietoesie · 10/04/2014 10:26

Yes - it looks to have an SSL.

\link{https://uk.news.yahoo.com/heartbleed-causes-massive-online-scare-don-t-change-071235068.html#UTTK6tI\Here's} an article on it. There's a list linked in towards the bottom of the article although you'll likely go goggle eyed trying to use it.

OP posts:
meditrina · 10/04/2014 10:21

OP: have you got a good list of sites found to be vulnerable?

Does MN even have a SSL?

saintsalive · 10/04/2014 10:19

I would like to know this too please.