OK. I've done a bit of reading about how Heartbleed works. I'm far from an expert, but for the curious, I'll put my teacher hat on (something I do from time to time).
One of the patterns by which a network server communicates is called a "heartbeat". A heartbeat is a request where some remote computer asks the server for a certain number of bytes of a certain type of information.
(A byte is an amount of information roughly equal to a single letter in a word. E.g. the word "Trans" requires about five bytes to store.)
The software on the server takes a free piece of computer memory (we call this allocating memory), writes the information in that memory, and then sends it back to you. There's no problem with that. The information is commonplace and not dangerous.
But suppose I ask for 100 bytes of information, but I tell the software it's 1,000 bytes long? The software allocates 1,000 bytes, writes the 100 bytes you're asking for, and the remaining 900 are left unchanged.
The problem comes because when the system allocates memory, it doesn't clear the memory. So those 900 bytes will contain whatever was in that memory when it was last used by the computer. Understand that computer memory is kind of like a scratch pad - it's used to store instructions or data, so this could be anything. It could even be a password that's been written somewhere in memory later to be encrypted and sent safely across the Internet.
But it's far more likely to have, basically, garbage, that is not helpful and not useful.
Could someone get a password from this?
I suppose if you sent out tons of heartbeats and accumulated trillions of bytes of data, there will probably be a few passwords in there. I shudder to think of the data mining effort necessary to find them. It MIGHT be possible. I suppose if you knew that a particular server program always stored a password in a context that looked a certain way, one could write software to search for that pattern and extract the password from all the random bits of information they received.
Of course the password wouldn't be enough. You would need software that could extract the user name, as well. I think that that capability requires substantial engineering skills and is probably beyond the abilities of most hackers.
Once you have that information, you have to do a lot of work to figure out if it's useful. It's far more likely to be some 12-year-old's twitter account than a billionaire's bank password.
I'll make a leap here, and say that this would not interest most hackers. Hackers want information they can turn into money quickly. Hard for me to imagine they're interested in information that requires a skilled software engineer to extract and once extracted, requires labor intensive human verification of its value.
I'm going out on a limb to say that the commotion about Heartbleed and the media frenzy about how "everything has been compromised, everything is insecure" is considerably overblown.
Disclaimer: Please do not interpret this as advice. It's just the musings of someone who is not an expert, just a pipsqueak random schoolteacher, so I can't be responsible for actions you take or don't take based on what I'm saying here.
