4 ms·

The problem is also that as long as a vulnerable site is not fixed, users should not attempt to login or interact with such site while logged in. Such interacti

• patio11 13y ago
  That's a bit unworkable, particularly as you can get many sites to load a user into memory by putting a post-auth URL into an IMG tag anywhere on the Internet. Your browser will obediently GET that URL, passing along the session cookie to the legitimate server, where it will then be exfiltrated via heartbleed. Basically: this vulnerability must be patched, or the server must be taken offline, and that needs to happen everywhere.
  • shock-value 13y ago
    > Basically: this vulnerability must be patched, or the server must be taken offline, and that needs to happen everywhere. No one is arguing against that. The point is that from the user's point of view, they shouldn't interact with a server at all if it is still vulnerable to this attack.