Estimates vary on the number of web sites that are affected by the security bug Heartbleed and those numbers are changing all the time as sites scramble to patch the security flaw.
The Canada Revenue Agency has already gone public with its Heartbleed concerns, shutting down part of its website and putting a temporary end to Netfiling for taxes and other services while it fixes the vulnerability. Not all Canadian companies and organizations have been as quick to alert customers.
While some security advisors are telling people to change their passwords, you could be changing a password on a site that hasn’t been fixed and while you go on with your life, figuring you’ve solved this Heartbleed problem, hackers could be picking up your new password and sign in credentials.
A number of sites, from Google to Yahoo ones have fixed the problem. Others, such as some Canadian credit unions and Canadian banks say they are not affected by Heartbleed. Check my earlier post for some of those updates and advice to consumers.
1. If you want to check a web site to see if it’s safe, you can check this open-source Heartbleed test. It’s not an exact test since a number of sites return an error message that means the test can’t determine whether or not the site is vulnerable.
2. The password management company LastPass has a Heartbleed website checker that you can find here.
3. Mashable is maintaining a list of websites that are vulnerable to Heartbleed or have been fixed.
4. If you use Chrome for your browser, you can install Chromebleed Checker that promises to warn you if the site you’re browsing is affected by the Heartbleed bug.
5. You can check this list of vulnerable web sites created by Mustafa Al-Bassam but note that the scan that produced these results is now outdated – it was carried out on April 8 – and many of the 627 sites that show up as vulnerable have since been fixed.
