Take these 4 steps right now to protect yourself from the Heartbleed bug

Earlier this week, we all learned about Heartbleed — the potentially catastrophic vulnerability in the encryption software that's used by two-thirds of all websites.

The bug puts millions of internet users at risk of having all sorts of sensitive data stolen. It's existed for the past two years, but became especially dangerous in the past few days, since news of the vulnerability was made public — giving attackers a chance to intercept data before websites fixed the problem.

Bottom line: there's a good chance any pieces of information you've sent over the web — your passwords, your social security numbers, or your credit card numbers — could have been stolen through no fault of your own.

But now that the information's out there, you do have the chance to do something about it. Here are the four things you need to do right now to protect your information on the web:

1. Reset all your passwords with a password manager

You'll definitely want to reset the password you use to protect any valuable data — things like your email account, your social media accounts, and any banking or online shopping accounts where you have credit card numbers stored.

experts recommend using a complex, different password for every site

True, if these websites haven't been updated yet to protect against the Heartbleed vulnerability, then your new password could be stolen too. But, by this point, most sites have since updated their encryption protocols (check here to test if a particular site is now safe, or look at the most current list of sites that are still vulnerable).

Since experts recommend that you use a different, complex password for every site, this is a great time to start using a password manager like LastPass or 1Password. "These services provide two values: they help you generate different passwords at different sites, and they provide cryptographically strong ones," says Michael Bailey, a University of Michigan researcher who works on internet security.

The long, meaningless passwords that are the toughest to crack are the hardest for a human to remember. By creating and storing all these passwords in one secure place, these managers are the best way to protect your data. Of course, doing this creates a new vulnerable target — your centralized collection of passwords — but both these services are well trusted and use robust encryption techniques.

1Password

1Password ranges from $17.99 for mobile-only versions to $49.99 for desktop versions. LastPass is free, and for $12 a year, you can upgrade to gain more mobile functionality and a few other features.

2. Turn on two-step verification

"I strongly recommend two-step to everyone," Bailey says, referring to the option, offered by Google and other sites, that requires two passwords for anyone entering an account from any unknown device. Typically, the first is your normal password, and the second is a single-use code sent to your phone — so if you lose your phone or change your number, this can be tricky.

Still, it's one of the strongest ways of protecting your account, as someone would need physical control of your phone to gain access.

3. Change all of your passwords regularly

The Heartbleed incident is also a good reminder that you should be changing all of your passwords frequently — the higher value you place on the data protected, the more often you should change it.

"It's just great hygiene to change your password frequently," Bailey says. "I change high value passwords every three months or so, and I do a spring cleaning every year where I change all my passwords." Experts vary in their advice — some say as often as monthly, while others say quarterly — but the important thing is not to leave your password stagnant for very long.

4. Make a list of every site you have a password for

Even if you use a password manager, you'll need to manually change your passwords, so it's a good idea to make a list. Separate the sites into high value and less important categories, and change the passwords accordingly.

If you do all this, it'll make it less likely that your data gets stolen in the long term — and if another vulnerability like Heartbleed comes around, you'll have less to lose, since someone stealing one of your passwords won't have access to any of your other accounts.

Will you support Vox’s explanatory journalism?

Most news outlets make their money through advertising or subscriptions. But when it comes to what we’re trying to do at Vox, there are a couple reasons that we can't rely only on ads and subscriptions to keep the lights on.

First, advertising dollars go up and down with the economy. We often only know a few months out what our advertising revenue will be, which makes it hard to plan ahead.

Second, we’re not in the subscriptions business. Vox is here to help everyone understand the complex issues shaping the world — not just the people who can afford to pay for a subscription. We believe that’s an important part of building a more equal society. We can’t do that if we have a paywall.

That’s why we also turn to you, our readers, to help us keep Vox free. If you also believe that everyone deserves access to trusted high-quality information, will you make a gift to Vox today?

One-Time Monthly Annual

$5/month

$10/month

$25/month

$50/month

Other

$

Yes, I'll give $5/month

Yes, I'll give $5/month

We accept credit card, Apple Pay, and Google Pay. You can also contribute via