How best to discuss the Heartbleed bug with users while keeping calm but getting action?

Question

There are technical questions everywhere you look about Heartbleed.

But none on not scaring the **** out of your users when discussing it, because lets be honest the news does a good job of scaring people stupid; and as I write the first actual use of Heartbleed is being uncovered.

What is the best way of discussing this with users, while keeping calm but getting action

---

There are three approaches I can see:

Take the hyper safe option of forcing, or very strongly recommending users update passwords. Possibly resulting in users becoming wary of how secure service x is

Make users aware there have been tests and the results are neither yes we had to update or no we're not affected. This may either make users worried and plant a seed in their mind that something else could be wrong, or why isn't it being secured by this "library that secures lots of the internet..." (or perhaps I am reading to much into that)

Do nothing but will this worry users of a lack of security?

---

Context: I have a online service that I am considering take on of the said approaches on

- My service is not affected by Heartbleed

- There is a good chance however people use the same passwords on other sites

Lastly, I know it maybe best for security to force password changes, but lets leave that discussion for elsewhere, purely the user experience of doing so.

Answer 1

In order to spur users to action, I would put the solution directly in their face. Tell them about heartbleed (in a calm manner) and offer them the option to change the password immediately. Why ask them to navigate all the way to wherever they can reset their password when you can bring the form to them.

Wait for them to log in, and give them a simple pop-up.

^{download bmml source – Wireframes created with Balsamiq Mockups}

Considering how many sites have been affected and how many users re-use passwords, it's worth doing this even if you weren't affected by heartbleed.

Answer 2

We took the transparent approach and posted a notification inside our application for all administrators - we told them we WERE running the affected version of OpenSSL, we told them what we did, when we did it and why.

We also told them there is no indication of anything untoward but due to the nature of Heartbleed this is expected though we did still spend time checking server and application logs.

We then recommended they change their password and all their users passwords - we built a quick script which expired all their users password so next time they login they have to enter a new password. We left this as an optional recommendation as we thought a brute force reset of everyone's password by us would create more fear than it would alleviate.

We also asked them to check their audit logs etc in the application for anything untoward and to let us know if they see anything suspicious or unexpected.

For us, not saying something was the worse possible option (especially as in your case you aren't impacted) - it was a difficult choice to tell customers that our systems were affected but, so far, we have had no negative feedback and no cancellations. Only time will tell if this was the right thing to do but we would do it again - customers appreciate transparency and no news is not always good news especially with the amount of media attention around this.

Answer 3

What level of security required is not a UX question. Rather it is a threat modelling exercise that will tell you how much you should demand the user changes their password.

Once you have determined the degree of risk then what do you want to drive? A rational decision based on the risks. Users can do that providing they are not confused. Examples below cover higher risk scenarios

If you have a password that is unique for this site you are not at risk from Heartbleed issue. No need to change your password.

If you used the same password on other sites, it is best that you change your password.

You can always hyper-link "Heartbleed issue" to further details for the curious. Note that there is no need for details upfront when making the decision.

But if handing out security advice why not enforce best practice:

It is good security practice to (a) change passwords frequently (b) not use the same passwords on different sites.

While we do not believe our service was vulnerable to the recent heartbleed issue we are requiring our users to change their passwords.