Heartbleed SSL vulnerability

[mario]

Gixen is not affected by the Heartbleed SSL vulnerability, as Gixen front-end servers are running OpenSSL versions that are not vulnerable, and are, in fact, older than the versions affected. I will upgrade them to the latest version in the near future regardless.

I am unsure as to if eBay itself is affected, as I do not know the nature of eBay front-end servers. I believe that they used to be Microsoft-based (IIS), but that may have changed, as they no longer identify themselves. I will wait for eBay itself to have a say on this.

[Cupid]

Thank you for this announcement Mario, and well done for investigating it and assuring the users before most would even have been aware of the possibility of a problem.

It goes to show that being on what we used to refer to as the 'bleeding edge' is not the place to be for well established services like Gixen... using what has been tried and tested over a long period and not upgrading as soon as is possible (unless the new features are essential) is always the better strategy IMHO.

This looks like a major mess up by the OpenSSL team... it having been left undetected for two years just makes it even more shocking.
_________________
Mark

[mario]

Mark,

To be completely honest, I never put much trust in SSL anyway. If you look historically (see link below), it seems that only as of fairly recently one can assume that SSL/TLS is secure, with proper combination of version and cipher.

https://en.wikipedia.org/wiki/Transport_Layer_Security#Cipher

I wouldn't be surprised that security organizations that have know-how and resources can read through it effortlessly.

I feel much more confident about eBay security measures than ssl. In other words, what actions can an intruder do if they already have my ebay credentials that would harm me? Thanks to eBay security measures, not much, or at least not much without me noticing and being notified.