There are technical questions everywhere you look about Heartbleed.
But none on not scaring the **** out of your users when discussing it, because lets be honest the news does a good job of scaring people stupid; and as I write the first actual use of Heartbleed is being uncovered.
What is the best way of discussing this with users, while keeping calm but getting action
There are three approaches I can see:
Take the hyper safe option of forcing, or very strongly recommending users update passwords. Possibly resulting in users becoming wary of how secure service x is
Make users aware there have been tests and the results are neither yes we had to update or no we're not affected. This may either make users worried and plant a seed in their mind that something else could be wrong, or why isn't it being secured by this "library that secures lots of the internet..." (or perhaps I am reading to much into that)
Do nothing but will this worry users of a lack of security?
Context: I have a online service that I am considering take on of the said approaches on
- My service is not affected by Heartbleed
- There is a good chance however people use the same passwords on other sites
Lastly, I know it maybe best for security to force password changes, but lets leave that discussion for elsewhere, purely the user experience of doing so.