OpenSSL heartbleed bug / Shibboleth implications

[Leif Johansson]

On 2014-04-08 16:13, Ian Young wrote:
> 
> On 8 Apr 2014, at 15:00, Leif Johansson <leifj at sunet.se> wrote:
> 
>> Running the common sslscan.py against stuff actually gets you sessions
>> on most HTTPS servers I've tried but nothing that looks like private key
>> material.
> 
> What you get back will depend on so many things that I don't think you can draw comfort from that result. You really have to assume that ANY part of the server's state MAY leak, depending on CPU architecture, OS, compiler, ASLR, connection history, POTM, etc., and therefore in a security sense that over time ALL of it HAS leaked unless you can prove otherwise.
Yeah I know