Dealing with Heartbleed: What You Need to Know

| Analysis

A Little SSL/TLS Primer

Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the tools that let servers take what would otherwise transmit over the internet as plain text and easy to read data into an encrypted jumble that's meaningless without the keys used to make it secure. Those keys are comprised of two parts: a public key and a private key. Together, they complete a digital signature that includes the information needed to turn the encrypted jumble back into usable data.

Anyone with the private key part of a SSL/TLS connection can decrypt what's passing through a secure connection because they have the part that tells them exactly how to read the encrypted data.

This isn't so much a problem at the user side because they have the public part of the encryption key; instead, it's an issue on the server side because of the code flaw in OpenSSL that can ultimately hand over the private encryption key.

Mac users had a bit of a security scare recently over an OS X iOS flaw related to SSL/TLS that wasn't server-related. In that case, a coding error would let your Mac, iPhone or iPad skip over verifying the encrypted connection. That flaw gave hackers the ability to set up their own fake servers that your computer assumed were legit so they could steal user data without ever involving the actual server or private encryption keys.

Apple patched that flaw in an operating system update, but it doesn't do anything to protect users from the threat that heartbleed poses because it's a server-side issue and not something your computer, tablet, or smartphone can detect regardless of which operating system it runs. In other words, it doesn't matter if you use a Mac, Windows PC, Linux, iPhone, or an Android smartphone.


Bosco (Brad Hutchings)




Lee Dronick


John Dingler, artist

Hi Jeff,
Safari user. Thanks.

John Dingler, artist


Paul Goodwin







Knowledge is a powerful antidote to fear.

Bart B


Log-in to comment