[ moving to fpc-other ]

Michael Van Canneyt wrote

I expect that all sensitive sites (banks, google, etc) have taken immediate action.

That was still too late. See e.g. http://foxitsecurity.files.wordpress.com/2014/04/heartbleed-example.png (from Yahoo mail). And as mentioned, private keys can also have been compromised. Given that pretty no one uses perfect forward security, it means that also all encrypted data captured in the past can now be decoded in that case.

That the login of my local tennis/pool/golf club was compromised is not really so scary, sorry.

What about information regarding persecuted human rights activists and the people they were in contact with? Journalists and their informants? Communications between lawyers and their clients? Sensitive information that can be used to blackmail people?

Jonas

Remember that totalitarian governments will consider use of Tor or encrypted mail as proof of guilt, and will then apply more direct means to get co-conspirators.

I'd also point out that in the UK people can be locked up if the police accuse them of using steganography, even if they weren't so can't supply decrypt keys.

[...] I'd also point out that in the UK people can be locked up if the police accuse them of using steganography, even if they weren't so can't supply decrypt keys.

Steganography, decrypt keys? What are you talking about?

Mattias

I'm talking about what a court demands that you supply before they'll let you out of prison. And I don't care whether it makes sense or not, because they think it does.

When hiding information in arbitrary data using steganography, you generally need a key to extract that information again from the data.

Jonas