Post reply

The message has the following error or errors that must be corrected before continuing:
Warning: this topic has not been posted in for at least 120 days.
Unless you're sure you want to reply, please consider starting a new topic.
Attachments: (Clear attachments)
Restrictions: 4 per post (4 remaining), maximum total size 192 KB, maximum individual size 64.00 MB
Uncheck the attachments you no longer want attached
Click or drag files here to attach them.
(Clear attachments)
Other options
Verification:
Please leave this box empty:
Type the letters shown in the picture
Listen to the letters / Request another image

Type the letters shown in the picture:
Shortcuts: ALT+S post or ALT+P preview

Topic summary

Posted by Administrator
 - Apr 12, 2014, 06:00 AM
The following measures have been taken to eliminate the Heartbleed vulnerability on AntiPolygraph.org:

1) Our web hosting provider, OrangeWebsite.com, upgraded OpenSSL on our server to a version that lacks the Heartbleed vulnerability;

2) Our web hosting provider installed a new SSL certificate based on a new private key;

3) After this was done the administrator password for AntiPolygraph.org was changed, a new private key was generated, and a new SSL certificate was issued.

As a precaution, it would be prudent for registered users of this message board to change their passwords.
Posted by Administrator
 - Apr 08, 2014, 04:57 AM
A web page has been set up to test websites for vulnerability to the heartbleed bug. As you'll note, AntiPolygraph.org is presently vulnerable:

http://filippo.io/Heartbleed/#antipolygraph.org:443
Posted by Administrator
 - Apr 08, 2014, 04:16 AM
A critical bug has been discovered in OpenSSL 1.0.1 through 1.0.1f (inclusive). AntiPolygraph.org is presently running OpenSSL 1.0.1e-fips. Thus, the vulnerability would allow an attacker to obtain our SSL private key and decrypt all intercepted traffic. You can read more about the so-called "heartbleed" bug here:

http://heartbleed.com/

We have requested that our Internet service provider upgade to OpenSSL 1.0.1g as soon as possible. Once this has been done, we will revoke our SSL certificate and create a new one based upon a newly-generated SSL key.

Until then, you should assume that your interactions with this website are no more secure than if we were not using SSL encryption.