Tag Archives: heartbleed

What the Tech?! Two-step Verification

twostepver
  • Yapp explains two-step verification in a simple way as part of its tech explainer series.
  • The post helps readers understand a basic security concept that matters in everyday digital life.
  • Readers who want approachable guidance on online security topics will benefit most from this article.

Two-step Verification, n;

A process that adds an extra layer of security to your private accounts by asking for secondary authentification of your identity. This process is used by most cloud services, including Gmail, Apple, and Dropbox. By enabling two-step verification, it is marginally more difficult for hackers to access your accounts.

Most two-step processes involve you connecting a phone number to your account email. When you log in from a new device, computer, or incognito browser, you’ll be prompted to enter the code that was sent to your phone. Basically, you’re required to know something as the account holder, and possess something that the account owner possesses. The ATM is one of the most common multi-factor machines — it requires you to possess your bank card and know your PIN number. The likelihood that someone who is not you will know both of these things is slim, so you are granted access to your account. On the web, we use passwords to access our accounts. While some people are excellent at creating “unhackable” passwords, most people are still using their cats name backwards with their birth date. Secure your passwords with the extra deadbolt that is multi-factor authentication, using a service like 1Password, LastPass, and/or two-step verification services offered by individual apps.

After scares like Heartbleed, the Apple iCloud photo leak and Dropbox‘s recent account info leak, adding two-step verification to your accounts is especially important. In short, it means that even if your account emails and passwords are accessed illegally, your email, cloud storage, credit cards, and personal information are safe.

What the Tech?! OpenSSL

Quick Summary

  • Yapp explains OpenSSL and why it matters in the broader internet security landscape.
  • The post helps readers understand an important technical term in a simpler, more accessible way.
  • Readers interested in online security and major tech infrastructure topics will benefit most from this explainer.

heartbleedOpenSSL, noun;
The most popular open-source library used to implement secure encryptions for websites, e-mail servers and applications. SSL stands for ‘Secure Sockets Layer’, and OpenSSL simply means that anyone with the means can contribute to

You’ve likely heard a lot about OpenSSL lately because of Heartbleed, the security issue that was reported last week. And you’ve probably been told to change your password on every site you care about (if you haven’t, you should). An error was added into the OpenSSL code that allowed anyone who knew how to read chunks of memory and retrieve extensive security information (like passwords and cookies) that are usually protected by encryption. The vulnerability affected about 500,000 secure sites running OpenSSL, which is about 66% of the Internet.

The bug (called Heartbleed because it occurred in the heartbeat extension within the code base) was present for two years before being discovered and patched last week. If you’re running Android on your mobile phone, you can use the Heartbleed Detector app to tell if your information has been compromised. Apple doesn’t use OpenSSL on any of it’s operating systems.

Now that you’ve got a grip on the news story, go change your passwords.

 

A Note About “Heartbleed”

  • Yapp addresses Heartbleed and helps readers understand why the security issue mattered.
  • The post offers a simple explanation of a major internet vulnerability and its broader implications.
  • Readers concerned about online security and privacy will benefit most from this update.

Yesterday, it was reported that a large security bug was found and is being repaired. You can read more about it from the BBC here.

We are aware of the OpenSSL “Heartbleed” vulnerability and have worked with our hosting vendor to upgrade OpenSSL to an unaffected version. We have rekeyed, reissued, and updated our certificates, as well as updated relevant passwords.

In layman’s terms, we think we’re in the clear. But, while we have no reason to believe that any private information was accessed via this vulnerability, we would recommend that Yapp users update their password as a precaution.

-The Yapp Team