OpenSSL Heartbleed bug, steam, and you.

OpenSSL has recently announced a severe bug that could lead to compromised information being obtained through https connections. 2/3 of the web is currently effected.

Steam has patched the bug early this AM. It is recommended to reset your steam password and deauthorize all computers under steamguard as a precaution. Better safe then sorry.

https://www.openssl.org/news/secadv_20140407.txt

This obviously has further reaching implications then just steam. Any site using the vunerable openssl package (banks, e-tailers etc) can be exploited.

How the hell do you deauthorize PCs in Steam?

go to settings, click manage steamguard, tick the deauthorize all computers box, click next.

I'll pass. I really can't be bothered doing this to a dozen sites.

#noconsequences

Man I have so many passwords across many sites. How do I know which ones have been compromised and which ones are now safe to change? I do not have LastPass.

Shouldn't the owners of each site send out emails to all users telling them...

@nutcrackr: There is a list here that has some sites on there that may or may not have been compromised.

you can test sites that you use with the following.

http://filippo.io/Heartbleed/

Its not recommended to run out and change *ALL* your passwords. Some sites are simply not effected (ie, any running on IIS).

My servers werent affected as I was running OpenBSD 5.2 on the production machine, 5.3 and 5.4 were affected however.

Which is why I only said steam as I know it was affected and was patched rather quickly. Its not a case of they probably have anyones details, its a case of they possibly could have. In the time period before the patch, after the vunerability was made public. - Thats the concern. And they will be targeting any non patched site in hope of catching some information.

If you do receive a link to reset, make sure the link doesnt contain login information. If it does, visit the site manually and reset it via your account profile options.

Also you may need to update your router firmware if you have someone on your network who isn't too trustworthy.

OpenWRT and pfsense just patched it.

For openwrt you can just upgrade your libssl from the repo

You can't tell if you've been affected from the bug. There's no logs or anything if it's exploited.