Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sites need to be remediated for the Heartbleed exploit before a password is updated. Some sites will be remediated immediately but others may not be updated for months. Lots of us have many dozens to several hundred sites in a password manager that may need to be updated.

Is there already a tool / utility / procedure / site that will identify and track which sites are ready to have their passwords reset for all sites in a password manager (e.g., KeePass, LastPass, or Dashlane).

If not, what features would such a tool need?

I can envision three approaches at the moment.

  1. Some other password manager includes this feature and both has a trial version and also will import the data from the current password manager.

  2. A tool that will accept export data from current password manager (e.g., to .CCV), submit each site to a Heartbleed test site, and

  3. A Heartbleed test site that will accept a list of sites (file or pasted). Again, the list would be derived by exporting the data from the current password manager with perhaps a little judicious editing.

The Heartbleed test sites that I know about will only accept one site at a time for testing.

UPDATE - LastPast Security Challenge now includes a Heartbleed section. I don't know how accurate the test is -- or can even be without site administrator participation.

share|improve this question

1 Answer 1

Well, you change the password on affected sites anyway, especially if you have used the same password multiple times before. Keepass will help you generate and track unique passwords for each site.

There are checker tools for sites:

Here is a Chrome Extension:

(I have not tested this yet)

share|improve this answer
    
"The Heartbleed test sites that I know about will only accept one site at a time for testing" like the Qualys, Filippo Valsorda, LastPass, and other Heartbleed test sites I've found. Chromebleed may prove useful but doesn't specifically address the need. –  BillR Apr 10 at 2:29
    
Also LastPass, even if you don't use the service: lastpass.com/heartbleed/?h= –  Kip Apr 10 at 14:58
    
FWIW, ssllabs is telling me all my banking sites are not vulnerable, but LastPass is saying "may be vunlerable" for all of them –  Kip Apr 10 at 15:03
    
Do any of those tests check that a new certificate has been issued? –  user148324 Apr 10 at 15:06
    
Anti-weakpasswords provided the most complete list of Heartbleed vulnerability checkers for sites (see below) that I've seen so far in response to: HeartBleed - How to detect compromised websites It doesn't mention (at least not yet): LastPass also has a site vulnerability checker (page) and just added it to its Security Challenge: lastpass.com/heartbleed ChromeBleed is a chrome extension to identify vulnerable sites: chrome.google.com/webstore/detail/chromebleed/… –  BillR Apr 10 at 16:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.