Heartbleed: A Data Security Bug of Titanic Proportions that Affects Most of the Internet and that Will Have Enormous Implications

Like  Comment  Share  Tweet  Google+  LinkedIn   YouTube  Press   Stumble    Disqus

It sounds like a late April Fool's joke, but it isn't. Heartbleed, a data security bug in Open SSL, allows hackers to access personal data and encryption keys. This vulnerability has existed for 2+ years, and there is no way to know if your data has been compromised. And the majority of websites that encrypt use OpenSSL, such as the most popular banking and retail sites. This is a security flaw of titanic proportions. According to CNN: "Researchers discovered the issue last week and published their findings on Monday, but said the problem has been present for more than two years, since March 2012. Any communications that took place over SSL in the past two years could have been subject to malicious eavesdropping."

You May Also Read This

The implications of Heartbleed are enormous. It is hard to predict all the reverberations, but they will be huge. That we could wake up one day and discover that a majority of our most sensitive Internet activity has not been secure for the past two years and that we might never know what data has been compromised is quite a sobering reality.

There are, of course, good, bad, and ugly practices when it comes to data security. Being good on data security is still a good thing to be. But what today's news drives home is that even good data security can still be quite tenuous. It is akin to sailing the seas during treacherous times, with pirates and icebergs, where even the most unsinkable ships can go the way of the Titanic. And this sobering news should make everyone think hard before collecting and storing highly sensitive data. We need to do it, of course, but as we start storing things like fingerprints and biometric identifiers and genetic data, we should be aware that keeping these very secure will be quite difficult. When sensitive immutable data is compromised, the stakes can be raised to another level.

Heartbleed should be taken as a heavy dose of humility and a realization that we have a long way to go until we can sail the online seas without significant peril and risk.

Here Your Thoughts Interact!!!

Like  Comment  Share  Tweet  Google+  LinkedIn   YouTube  Press   Stumble    Disqus

Daniel J. Solove is the John Marshall Harlan Research Professor of Law at George Washington University Law School, the founder of TeachPrivacy, a privacy/data security training company, and a Senior Policy Advisor at Hogan Lovells. He is the author of 9 books (including Understanding Privacy and Nothing to Hide: The False Tradeoff Between Privacy and Security) and more than 50 articles. Follow Professor Solove on Twitter @DanielSolove.