Heartbleed and Two-Factor Authentication - Does it help

Along with all the hype about the heartbleed bug, I've been reading a lot of posts and articles that recommend (amongst other things) to enable Two-Factor Authentication (2FA) to all services that support it.

In general, having 2FA greatly increases your security, since you credentials are not bound to just a username/password pair (something you know), but also rely on something you have (a phone to receive text messages or a device/application that generates one-time tokens).

Is this the panacea and the solution to the heartbleed problem?

Heartbleed - Should I change my passwords?

Ok, so most of you should have read by now the headlines about the Heartbleed bug and it's consequences. For those of you who haven't, there is an abundance of resources out there that explain the issue (just google it). The gist of it is that an attacker could leverage the bug and access memory on the server that could contain the SSL certificates private key. Using this, they could create fraudulent certificates, mount a man-in-the-middle attack to get your credentials or, if they have been monitoring traffic between the clients and the server, decrypt the (under TLS) encrypted traffic. Additionally, the issue only exists in OpenSSL implementations that implement the SSL heartbeat feature (which is more or less 17 percent of the worlds web servers).

Ok, so, I've been getting a lot of emails from services informing me they have patched the issue and that I should change my credentials. Is this something you should do for all your online accounts?

SSL Blacklist - Useful tool for recent MD5 risk

Marton Anka (www.CodeFromThe70s.org) has a pretty nifty tool for detecting pages that use certificate chains with signatures based on the MD5 algorithm which was recently attacked.

The tool is a Firefox extention, that pops-up a window informing the user that the certificate used by the page is potentially compromised and that access to that url may be not be secure. Here is a screenshot:

Following the recent compromise of SSL certificates and the fact that a lot of DNS servers still remain unpatched against the Kamnisky attack, this is a tool that I am using and would recommend to anyone. Keep in mind that this only informs you about a potential risk. It does not know if the certificate is indeed insecure (as there is no way to know this).

Also, after listening to my favorite podcast (Security Now!), certificates can be reissued for free so they are signed using SHA1 instead of MD5. So, when you come accross a site that has an MD5 signed certificate, drop a message to the webmaster to inform them about this.