Skip to main content

Changing your passwords isn’t enough to protect yourself from Heartbleed

Heartbleed LastPass
Image used with permission by copyright holder

There’s no denying that the Heartbleed bug is scary. In fact, it’s arguably the widest and deepest security hole ever discovered on the Web, reportedly leaving roughly two-thirds of the world’s websites at risk.

So if you haven’t done so yet, you should check every site that you have an account with to see if it is or was using the version of OpenSSL that is vulnerable to the bug. Also, check whether those vulnerable sites have fixed their Heartbleed wounds yet, by updating their security certificates.

Recommended Videos

With LastPass, you can make sure you’re using a different password for each site.

There’s no point in updating all your passwords yet, because many sites are still vulnerable to the bug, and all indications are that it will take at least several weeks before all the affected websites have patched the Heartbleed hole.

So what should you do in the meantime? A great first step would be to upgrade your Web security measures so that a hacker will need more than just your password to access your most important accounts (like, say, Google, PayPal, and Dropbox). You should also start using a password manager, like LastPass, so that when the next big security issue hits, you’ll know exactly which passwords you’ll need to change. With LastPass, you can make sure you’re using a different password for each site, and (if you opt for the $12-a-year premium account) you can use an app on your smartphone to autofill all your passwords, which makes changing them a whole lot easier.

But first, let’s talk about two-factor authentication.

Two-factor authentication is a great defense against leaked passwords

When news of Heartbleed first hit, I was surprised, but not that worried. Why? Because I set up two-factor authentication on many of my most important accounts ages ago.

Two-factor authentication is sometimes also called 2FA, or two-step verification. With this set up, when you log into an account on a device you haven’t used before, you have to provide both your password and something else—a second form of authentication.

Usually, that second form of verification comes in the form of a time-sensitive, one-time-use numerical code that gets sent to you in seconds via text message. So you’ll need to have your phone with you when logging into a computer or other device that you haven’t previously used that service with. It’s a minor inconvenience to have to enter an extra code, but chances are that you aren’t logging into Gmail or Facebook on unfamiliar devices all that often.

Besides, an occasional minor inconvenience is well worth the security of knowing that, even if someone somehow snags your Gmail or PayPal password, they can’t log in and start making purchases because they don’t also have access to your smartphone.

LastPass Evernote
Image used with permission by copyright holder

Each site that offers two-factor authentication has their own way of enabling it. But usually, it’s buried in the settings or account screens, and are not that hard to find. Of course, there are plenty of sites that don’t yet offer two-factor authentication (get on that, Amazon). However, you can see a definitive list of major sites that do and don’t offer it here, where you’ll also find links to instruction pages for sites that do offer the service. If an important site you use doesn’t yet offer two-factor authentication, there’s a good chance that they’re working on it now, especially after being forced to deal with the Heartbleed mess.

You may not want to set up two-factor authentication for every site that offers it. However, you should definitely do so for any site that has access to your finances (like banks), as well as Google (especially if you use Android or Gmail), and your social media accounts too. Cloud storage services, like Dropbox, should be on that list as well.

It’s time to use a password manager

Also, unless you specifically only use the Web for a few things, like email, Facebook, and casual Web browsing, you really should start using a password manager. There are quite a few out there, like RoboForm, Norton Identity Safe, and 1Password, but I’ve used LastPass for a couple years now, and have been quite happy with it. It’s also considered by many experts to be the best, because of its power and flexibility.

You should definitely set up two-factor authentication for any site that has access to your finances.

Why do you need a password manager? Because you really, really need to be using a different password for every site—especially in this age where it seems like some major website or company gets hacked or otherwise loses sensitive user data every other day. You really don’t want to give the world of nefarious Internet users access to your bank account or Gmail, just because some site you haven’t used in years has a data breach. 

Your passwords should also consist of a combination of numbers, special characters, upper- and lower-case characters, and be at least eight characters long. Can you remember a different password like that for each of the sites you have accounts with? Probably not, and even if you could, you should also change your passwords on a regular basis (once every few months is a good general rule, especially for critical accounts).

Without a password manager, you’ll have a very hard time doing all that. But with LastPass, you can automatically generate strong passwords, see how old the passwords you’re using are, and automatically log into sites on your PC or Mac. That way, you don’t have to suffer the frustration of a forgotten password anymore—all for free.

Now, when using a password manager that stores all your passwords, even if the data is encrypted, like it is with LastPass, you are in some sense putting all your passwords behind one single password, which is potentially very dangerous. So you’ll want to make absolutely sure your LastPass password is unique, and very strong.

Beyond that, especially if you regularly use a smartphone or tablet, it’s probably worth it to spring for LastPass Premium. The service costs a fairly modest $12 per year, and gives you access to a couple of very important features.

With LastPass Premium, you can add two-factor authentication to your LastPass account (which, remember, will now house all your other passwords). Plus, with the Premium service, you’ll also have access to LastPass’ mobile apps for iOS, Android, Windows Phone, and BlackBerry, which will either automatically log you into sites on your mobile device, or let you copy and paste in your passwords. Just remember not to stay logged into the service all the time, in case your phone gets lost or stolen.

If you think $12 a year is expensive for that service, imagine manually keying in every unique, lengthy password for every site that gets an eventual Heartbleed patch. When that nightmare thought-bubble bursts, $12 probably won’t sound so bad.

Conclusion

As with all security-oriented articles, it’s important to point out that there are no guarantees that taking these steps (or any steps) will keep you safe while you traverse through the minefield that is the Internet, especially in this post-Heartbleed world. Even if you abandon the Web and your apps altogether, there’s enough data being collected and passed around about you, from your purchases, travel, etc., that some form of identity theft is always a possibility, even if you move off the grid and into a shack in the woods.

The best line of defense in a world full of hackers, scammers, and corporations playing fast and loose with your personal data is to be a more difficult mark than the average consumer. Using two-factor authentication and a password manager are two big steps you can take in that direction. Those moves will make you safer, at least until we have better options, like ultrasonic fingerprint mapping, which uses our heartbeat rhythms for authentication.

Matt Safford
Former Digital Trends Contributor
Matt Safford began accumulating electronics experience as a child with his Mattel Aquarius and Tandy TRS-80 (Model 4)…
Apple’s Vision Pro is getting the M5 chip, but that’s not what it really needs
Two people talk while one wears an Apple Vision Pro headset. Their eyes are visible through the device using the EyeSight feature.

We’ve not yet seen the full rollout of Apple’s M4 chip family -- the M4 Ultra is still yet to make an appearance -- but already we’ve just learned that the M5 chip is now in production. That means it’ll probably arrive in Macs either late this year or early next year.

If you’ve been waiting to buy a new MacBook Pro, that could mean 2026 is the year to finally pull the trigger. After all, Apple is expected to fully redesign its flagship laptop for next year’s release, and if that coincides with a powerful new M5 chip, all the better.

Read more
This Acer Predator gaming PC with RTX 4070 Ti Super is $350 off
The side profile of the Acer Predator Orion 5000 gaming PC.

You should be careful if you're thinking about upgrading with gaming PC deals, as not all machines are worth your hard-earned money. Here's one that we highly recommend: the Acer Predator Orion 5000 at $350 off from Best Buy, which brings its price down to $1,750 from $2,100. It's still not what you'd call affordable after that discount, but this is the type of machine that you will never regret buying. You're going to want to complete your transaction for it as soon as possible though, as there's no telling when the offer expires.

Why you should buy the Acer Predator Orion 5000 gaming PC
The Acer Predator Orion 5000 challenges the best gaming PCs with specifications that will let you play the best PC games at their most demanding settings. It's powered by the 14th-generation Intel Core i7 processor and the Nvidia GeForce RTX 4070 Ti Super graphics card, along with 32GB of RAM that our guide on how much RAM do you need says is the sweet spot for high-end gamers. The gaming desktop also comes with Windows 11 Home pre-loaded in its 2TB SSD, which will provide enough storage space for multiple AAA titles with all their necessary updates and optional add-ons.

Read more
Grab this Lenovo Legion gaming PC while it’s under $1,000
The Lenovo Legion Tower 5i Gen 8 gaming PC on a white background.

You don't need to spend more than $1,000 in upgrading your gaming desktop, as there are gaming PC deals out there with huge discounts on powerful machines. You won't have to do the searching yourself though, as we've done that for you -- check out the Lenovo Legion Tower 5 Gen 8, which is available with a 30% discount from Lenovo that drops its price from $1,330 to only $930. There are only limited stocks for this computer though, so you have to hurry with your purchase if you want to secure the $400 in savings.

Why you should buy the Lenovo Legion Tower 5 Gen 8 gaming PC
The Lenovo Legion Tower 5 Gen 8 is an affordable gaming desktop that's built similar to the Lenovo Legion Tower 5i, which appears in our list of the best gaming PCs as our favorite option for below $1,000. The major difference is that the Lenovo Legion Tower 5 Gen 8 is powered by AMD -- the AMD Ryzen 5 7600 processor, to be exact, alongside the AMD Radeon RX 7600 graphics card and 16GB of RAM that's the best place to start for gaming, according to our guide on how much RAM do you need. With these specifications, you'll be able to play the best PC games on this gaming PC without any issues.

Read more