Heartbleed-buggen visar hur obeprövade Internetprotokollen faktiskt är. Heartbleed är en datorbugg i säkerhetsprotokollet OpenSSL, som används över stora delar av Internet för att garantera säkert utbyte av krypterad information mellan datorsystem.
Man undrar om FRA kände till den här buggen men höll tyst om den? NSA med sina väldiga resurser bör hur som helst ha känt till om de här buggen.
Brian X Chen skriver i New York Times: Q. and A. on Heartbleed: A Flaw Missed by the Masses
Q. What is Heartbleed?
A. Basically when you make a transaction online today, whether it’s a bank or credit card company, part of what ensures security is a protocol called SSL. It’s just a way to encrypt the data so that nobody can read it when it’s being transmitted from you to the bank or another company.What Heartbleed is is a way that an attacker can steal bits of information about that transaction — things you thought were being safeguarded. The attacker can start reading data about a transaction and learn things like your passwords and credit card numbers that you thought were kept confidential. Q. How did this happen?
A. What happened was, two years ago there was a programming flaw put into this thing called OpenSSL, an open-source implementation of the SSL protocol. A lot of websites use OpenSSL to achieve security. What happened in these cases is that these programs are very complicated, and when things are very complex, some flaws can be missed. It may have been there all along, but it was just hidden in plain sight from the perspective of everybody else.