Dane - OpenSSL Heartbleed Bug?

[darrylo]

http://mashable.com/2014/04/09/heartble ... -affected/

http://twofactorauth.org/

[kgc]

It is too bad more financial services don't support two factor auth, especially given how easy it is now to implement on top of services like Google auth or even just using SMS.

[Guest]

Please correct me if I'm wrong. Each service needs to do several things to become secure:

• update the SSL code to remove the bug.
• generate new public/private key pair
• get updated certificate with the new public key
• does the browser need to refresh cache or something to get the new cert?

Isn't information going to the browser encrypted with the private key and, hence, vulnerable to anyone snooping who has the (obviously widely available) public key? So Heartbleed was never needed to spy on stuff coming over ssl from servers to consumer anyway. It's just now that someone could impersonate you with your decrypted password? Decrypted from the ill gotten private server key.

As far as ssh goes, it uses my private key on my box and doesn't use a server on my box. So my private key should not be vulnerable and, hence, neither should data sent to me. If ssh data is double encrypted (uphill by my private key and downhill by your private key) then there should really not be much of any problem. Correct?