Changing your passwords isn’t enough to protect yourself from Heartbleed

Heartbleed LastPass

There’s no denying that the Heartbleed bug is scary. In fact, it’s arguably the widest and deepest security hole ever discovered on the Web, reportedly leaving roughly two-thirds of the world’s websites at risk.

So if you haven’t done so yet, you should check every site that you have an account with to see if it is or was using the version of OpenSSL that is vulnerable to the bug. Also, check whether those vulnerable sites have fixed their Heartbleed wounds yet, by updating their security certificates.

With LastPass, you can make sure you’re using a different password for each site.

There’s no point in updating all your passwords yet, because many sites are still vulnerable to the bug, and all indications are that it will take at least several weeks before all the affected websites have patched the Heartbleed hole.

So what should you do in the meantime? A great first step would be to upgrade your Web security measures so that a hacker will need more than just your password to access your most important accounts (like, say, Google, PayPal, and Dropbox). You should also start using a password manager, like LastPass, so that when the next big security issue hits, you’ll know exactly which passwords you’ll need to change. With LastPass, you can make sure you’re using a different password for each site, and (if you opt for the $12-a-year premium account) you can use an app on your smartphone to autofill all your passwords, which makes changing them a whole lot easier.

But first, let’s talk about two-factor authentication.

Two-factor authentication is a great defense against leaked passwords

When news of Heartbleed first hit, I was surprised, but not that worried. Why? Because I set up two-factor authentication on many of my most important accounts ages ago.

Two-factor authentication is sometimes also called 2FA, or two-step verification. With this set up, when you log into an account on a device you haven’t used before, you have to provide both your password and something else—a second form of authentication.

Usually, that second form of verification comes in the form of a time-sensitive, one-time-use numerical code that gets sent to you in seconds via text message. So you’ll need to have your phone with you when logging into a computer or other device that you haven’t previously used that service with. It’s a minor inconvenience to have to enter an extra code, but chances are that you aren’t logging into Gmail or Facebook on unfamiliar devices all that often.

Besides, an occasional minor inconvenience is well worth the security of knowing that, even if someone somehow snags your Gmail or PayPal password, they can’t log in and start making purchases because they don’t also have access to your smartphone.

LastPass Evernote

Each site that offers two-factor authentication has their own way of enabling it. But usually, it’s buried in the settings or account screens, and are not that hard to find. Of course, there are plenty of sites that don’t yet offer two-factor authentication (get on that, Amazon). However, you can see a definitive list of major sites that do and don’t offer it here, where you’ll also find links to instruction pages for sites that do offer the service. If an important site you use doesn’t yet offer two-factor authentication, there’s a good chance that they’re working on it now, especially after being forced to deal with the Heartbleed mess.

You may not want to set up two-factor authentication for every site that offers it. However, you should definitely do so for any site that has access to your finances (like banks), as well as Google (especially if you use Android or Gmail), and your social media accounts too. Cloud storage services, like Dropbox, should be on that list as well.

It’s time to use a password manager

Also, unless you specifically only use the Web for a few things, like email, Facebook, and casual Web browsing, you really should start using a password manager. There are quite a few out there, like RoboForm, Norton Identity Safe, and 1Password, but I’ve used LastPass for a couple years now, and have been quite happy with it. It’s also considered by many experts to be the best, because of its power and flexibility.

You should definitely set up two-factor authentication for any site that has access to your finances.

Why do you need a password manager? Because you really, really need to be using a different password for every site—especially in this age where it seems like some major website or company gets hacked or otherwise loses sensitive user data every other day. You really don’t want to give the world of nefarious Internet users access to your bank account or Gmail, just because some site you haven’t used in years has a data breach. 

Your passwords should also consist of a combination of numbers, special characters, upper- and lower-case characters, and be at least eight characters long. Can you remember a different password like that for each of the sites you have accounts with? Probably not, and even if you could, you should also change your passwords on a regular basis (once every few months is a good general rule, especially for critical accounts).

Without a password manager, you’ll have a very hard time doing all that. But with LastPass, you can automatically generate strong passwords, see how old the passwords you’re using are, and automatically log into sites on your PC or Mac. That way, you don’t have to suffer the frustration of a forgotten password anymore—all for free.

Now, when using a password manager that stores all your passwords, even if the data is encrypted, like it is with LastPass, you are in some sense putting all your passwords behind one single password, which is potentially very dangerous. So you’ll want to make absolutely sure your LastPass password is unique, and very strong.

Beyond that, especially if you regularly use a smartphone or tablet, it’s probably worth it to spring for LastPass Premium. The service costs a fairly modest $12 per year, and gives you access to a couple of very important features.

With LastPass Premium, you can add two-factor authentication to your LastPass account (which, remember, will now house all your other passwords). Plus, with the Premium service, you’ll also have access to LastPass’ mobile apps for iOS, Android, Windows Phone, and BlackBerry, which will either automatically log you into sites on your mobile device, or let you copy and paste in your passwords. Just remember not to stay logged into the service all the time, in case your phone gets lost or stolen.

If you think $12 a year is expensive for that service, imagine manually keying in every unique, lengthy password for every site that gets an eventual Heartbleed patch. When that nightmare thought-bubble bursts, $12 probably won’t sound so bad.

Conclusion

As with all security-oriented articles, it’s important to point out that there are no guarantees that taking these steps (or any steps) will keep you safe while you traverse through the minefield that is the Internet, especially in this post-Heartbleed world. Even if you abandon the Web and your apps altogether, there’s enough data being collected and passed around about you, from your purchases, travel, etc., that some form of identity theft is always a possibility, even if you move off the grid and into a shack in the woods.

The best line of defense in a world full of hackers, scammers, and corporations playing fast and loose with your personal data is to be a more difficult mark than the average consumer. Using two-factor authentication and a password manager are two big steps you can take in that direction. Those moves will make you safer, at least until we have better options, like ultrasonic fingerprint mapping, which uses our heartbeat rhythms for authentication.

Computing

Data breach compromises 773 million records, 21 million passwords

A security researcher was alerted to a collection of breached data that included more than 773 million compromised records. After digging deeper, the breach was revealed to contain more than 21 million passwords.
Mobile

Android vs. iOS: Which smartphone platform is the best?

If you’re trying to choose a new phone and you’re not sure about the merits and pitfalls of the leading smartphone operating systems, then come on in for a detailed breakdown as we pit Android vs. iOS in various categories.
Mobile

Having trouble logging in? Here's how to reset your Apple ID password

To use any of Apple's services, you need to have an Apple ID and know your password. Thankfully, there are ways to deal with forgotten passwords and regain access to your account. Here's how to reset your Apple ID password.
Computing

Lost your router? Here's how to find its IP address to help track it down

Changing the login information for your router isn't always easy, that's why so many have that little card on the back. But in order to use it, you need to know where to go. Here's how to find the IP address of your router.
Computing

Faster new PCIe 5.0 standard leapfrogs the best feature of AMD’s Ryzen 3

PCIe 5.0 will bring even faster data transfers, but it may only be found on HPCs and servers initially. The standard is four times faster than your current PC at transferring data, and new devices could appear later this year.
Deals

From Chromebooks to MacBooks, here are the best laptop deals for January 2019

Whether you need a new laptop for school or work or you're just doing some post-holiday shopping, we've got you covered: These are the best laptop deals going right now, from discounted MacBooks to on-the-go gaming PCs.
Product Review

LG Gram 14 proves 2-in-1 laptops don’t need to sacrifice battery for light weight

The LG Gram 14 2-in-1 aims to be very light for a laptop that converts to a tablet. And it is. But it doesn’t skimp on the battery, and so it lasts a very long time on a charge.
Computing

Keep your laptop battery in tip-top condition with these handy tips

Learn how to care for your laptop's battery, how it works, and what you can do to make sure yours last for years and retains its charge. Check out our handy guide for valuable tips, no matter what type of laptop you have.
Computing

Protect your expensive new laptop with the best Macbook cases

If you recently picked up a new MacBook, you’ll want something to protect its gorgeous exterior. Here, we've gathered the best MacBook cases and covers, whether you're looking for style or protection.
Computing

Watch out for these top-10 mistakes people make when buying a laptop

Buying a new laptop is exciting, but you need to watch your footing. There are a number of pitfalls you need to avoid and we're here to help. Check out these top-10 laptop buying mistakes and how to avoid them.
Computing

Don't spend a fortune on a PC. These are the best laptops under $300

Buying a laptop needn't mean spending a fortune. If you're just looking to browse the internet, answer emails, and watch Netflix, you can pick up a great laptop at a great price. These are the best laptops under $300.
Computing

Dell XPS 13 vs. Asus Zenbook 13: In battle of champions, who will be the victor?

The ZenBook 13 UX333 continues Asus's tradition of offering great budget-oriented 13-inch laptop offerings. Does this affordable machine offer enough value to compete with the excellent Dell XPS 13?
Gaming

Take a trip to a new virtual world with one of these awesome HTC Vive games

So you’re considering an HTC Vive, but don't know which games to get? Our list of 25 of the best HTC Vive games will help you out, whether you're into rhythm-based gaming, interstellar dogfights, or something else entirely.
Computing

The Asus ZenBook 13 offers more value and performance than Apple's MacBook Air

The Asus ZenBook 13 UX333 is the latest in that company's excellent "budget" laptop line, and it looks and feels better than ever. How does it compare to Apple's latest MacBook Air?