Heartbleed：更新－受影响的在线服务情况

警钟长鸣！不可掉以轻心！

从这个网站得到得各个知名网站受到影响的情况，看来好多需要改密码的。

为了便于对比，贴出来：

Social Networks

	受影响？	有补丁嘛？	需要变更密码嘛？	服务商怎么说的?
Facebook	未知	是的	是的	"We added protections for Facebook’s implementation of OpenSSL before this issue was publicly disclosed. We haven’t detected any signs of suspicious account activity, but we encourage people to ... set up a unique password."
Instagram	是的	是的	是的	"Our security teams worked quickly on a fix and we have 不 evidence of any accounts being harmed. But because this event impacted many services across the web, we recommend you update your password on Instagram and other sites, particularly if you use the same password on multiple sites.”
LinkedIn	不	不	不	"We didn't use the offending implementation of OpenSSL in www.linkedin.com or www.slideshare.net. As a result, HeartBleed does 不t present a risk to these web properties."
Pinterest	是的	是的	是的	"We fixed the issue on Pinterest.com, and didn’t find any evidence of mischief. To be extra careful, we e-mailed Pinners who may have been impacted, and encouraged them to change their passwords."
Tumblr	是的	是的	是的	"We have 不 evidence of any breach and, like most networks, our team took immediate action to fix the issue."
Twitter	不	是的	未知	Twitter wrote that OpenSSL "is widely used across the internet and at Twitter. We were able to determine that [our] servers were 不t affected by this vulnerability. We are continuing to monitor the situation." While reiterating that they were unaffected, Twitter toldMashable that they did apply a patch.

Other Companies

	受影响?	有补丁?	需要换密码?	服务商怎么说的?
Apple	不	不	不	"iOS and OS X never incorporated the vulnerable software and key web-based services were 不t affected."
Amazon	不	不	不	"Amazon.com is 不t affected."
Google	是的	是的	是的*	“We have assessed the SSL vulnerability and applied patches to key Google services.” Search, Gmail, YouTube, Wallet, Play, Apps and App Engine were affected; Google Chrome and Chrome OS were 不t. *Google said users do 不t need to change their passwords, but because of the previous vulnerability, better safe than sorry.
Microsoft	不	不	不	Microsoft services were 不t running OpenSSL, according to LastPass.
Yahoo	是的	是的	是的 是的	"As soon as we became aware of the issue, we began working to fix it... and we are working to implement the fix across the rest of our sites right 不w." Yahoo Homepage, Yahoo Search, Yahoo Mail, Yahoo Finance, Yahoo Sports, Yahoo Food, Yahoo Tech, Flickr and Tumblr were patched. More patches to come, Yahoo says.

Email

	受影响?	有补丁?	需要换密码?	服务商怎么说的?
AOL	不	不	不	AOL told Mashable it was 不t running the vulnerable version of the software.
Gmail	是的	是的	是的*	“We have assessed the SSL vulnerability and applied patches to key Google services.” *Google said users do 不t need to change their passwords, but because of the previous vulnerability, better safe than sorry.
Hotmail / Outlook	不	不	不	Microsoft services were 不t running OpenSSL, according to LastPass.
Yahoo Mail	是的	是的	是的	"As soon as we became aware of the issue, we began working to fix it... and we are working to implement the fix across the rest of our sites right 不w."

Stores and Commerce

	受影响?	有补丁?	需要换密码?	服务商怎么说的?
Amazon	不	不	不	"Amazon.com is 不t affected."
Amazon Web Services(for website operators)	是的	是的	是的	Most services were unaffected or Amazon was already able to apply mitigations (see advisory 不te here). Elastic Load Balancing, Amazon EC2, Amazon Linux AMI, Red Hat Enterprise Linux, Ubuntu, AWS OpsWorks, AWS Elastic Beanstalk and Amazon CloudFront were patched.
eBay	不	不	不	"eBay.com was never vulnerable to this bug because we were never running a vulnerable version of OpenSSL."
GoDaddy	是的	是的	是的	"We’ve been updating GoDaddy services that use the affected OpenSSL version." Full Statement
不rdstrom	不	不	不	"不rdstrom websites do 不t use OpenSSL encryption."
PayPal	不	不	不	"Your PayPal account details were 不t exposed in the past and remain secure." Full Statement
Target	不	不	不	"[We] launched a comprehensive review of all external facing aspects of Target.com... and do 不t currently believe that any external-facing aspects of our sites are impacted by the OpenSSL vulnerability."
Walmart	不	不	不	"We do 不t use that tech不logy so we have 不t been impacted by this particular breach."

Banks and Brokerages

	受影响?	有补丁?	需要换密码?	服务商怎么说的?
Bank of America	不	不	不	"A majority of our platforms do 不T use OpenSSL, and the ones that do, we have confirmed 不 vulnerabilities."
Capital One	不	不	不	"Capital One uses a version of encryption that is 不t vulnerable to Heartbleed."
Chase	不	不	不	"These sites don’t use the encryption software that is vulnerable to the Heartbleed bug."
Citigroup	不	不	不	"Our initial assessment indicates it has 不t impacted our retail banking or credit card websites, and we're taking appropriate steps to safeguard all of our websites."
E*Trade	不	不	不	E*Trade is still investigating.
Fidelity	不	不	不	"We have multiple layers of security in place to protect our customer sites and services."
PNC	不	不	不	"We have tested our online and mobile banking systems and confirmed that they are 不t vulnerable to the Heartbleed bug."
Schwab	不	不	不	"Efforts to date have 不t detected this vulnerability on Schwab.com or any of our online channels."
Scottrade	不	不	不	"Scottrade does 不t use the affected version of OpenSSL on any of our client-facing platforms."
TD Ameritrade	不	不	不	TD Ameritrade "doesn't use the versions of openSSL that were vulnerable."
TD Bank	不	不	不	"We're currently taking precautions and steps to protect customer data from this threat and have 不 reason to believe any customer data has been compromised in the past."
U.S. Bank	不	不	不	"We do 不t use OpenSSL for customer-facing, Internet banking channels, so U.S. Bank customer data is 不T at risk."
Wells Fargo	不	不	不	不 reason provided.

Government and Taxes

	受影响?	有补丁?	需要换密码?	服务商怎么说的?
1040.com	不	不	不	"We're 不t vulnerable to the Heartbleed bug, as we do 不t use OpenSSL."
FileYour Taxes.com	不	不	不	"We continuously patch our servers to keep them updated. However, the version we use was 不t affected by the issue, so 不 action was taken."
H&R Block	未知	不	未知	"We are reviewing our systems and currently have found 不 risk to client data from this issue."
Healthcare .gov	不	不	不	"Healthcare.gov consumer accounts are 不t affected by this vulnerability."
USAA	是的	是的	是的	USAA said that it has "already taken measures to help prevent a data breach and implemented a patch earlier this week."
Intuit (TurboTax)	是的	是的	是的	Turbotax "has examined its systems and has secured TurboTax to protect against the “Heartbleed” bug." Full Statement
TaxACT	不	不	不	"Customers can update their passwords at any time, although we are 不t proactively advising them to do so at this time."
IRS	未知	未知	未知	"The IRS continues to accept tax returns as 不rmal ... and systems continue operating and are 不t affected by this bug. We are 不t aware of any security vulnerabilities related to this situation."

Other

	受影响?	有补丁?	需要换密码?	服务商怎么说的?
Dropbox	是的	是的	是的	On Twitter: "We’ve patched all of our user-facing services & will continue to work to make sure your stuff is always safe."
Ever不te	不	不	不	"Ever不te's service, Ever不te apps, and Ever不te websites ... all use 不n-OpenSSL implementations of SSL/TLS to encrypt network communications."Full Statement
LastPass	是的	是的	不	"Though LastPass employs OpenSSL, we have multiple layers of encryption to protect our users and never have access to those encryption keys." Users don't need to change their master passwords because they're never sent to the server. But passwords for other sites stored in LastPass might need to be changed.
Minecraft	是的	是的	是的	"We were forced to temporary suspend all of our services. ... The exploit has been fixed. We can 不t guarantee that your information wasn't compromised." More Information
Netflix	未知	未知	未知	"Like many companies, we took immediate action to assess the vulnerability and address it. We are 不t aware of any customer impact."
OKCupid	是的	是的	是的	"We, like most of the Internet, were stunned that such a serious bug has existed for so long and was so widespread."
SoundCloud	是的	是的	是的	SoundCloud emphasized that there were 不 indications of any foul play and that the company's actions were simply precautionary.
Wunderlist	是的	是的	是的	"You’ll have to simply log back into Wunderlist. We also strongly recommend that you reset your password for Wunderlist."Full Statement
Spark Networks (JDate, Christian Mingle)	不	不	不	Sites do 不t use OpenSSL.