Has GAE ever used OpenSSL for its frontend servers? It’s quite interesting in the context of the Heartbleed security hole. It would be nice to get a confirmation from Google that no risks are present.

  • 3
    If you want confirmation from google, then you might want to actually ask google... – MichelZ Apr 9 '14 at 15:26
  • It appears that they don't have a public announcement on this. Your only option is to ask them, but you should assume that they were for operating procedures. – Jacob Apr 9 '14 at 18:24
  • Correct. An update from Google: googleonlinesecurity.blogspot.ca/2014/04/… – user3515350 Apr 9 '14 at 21:57
  • The eight hours has passed; feel free to post a full answer. – Michael Hampton Apr 15 '14 at 0:21

As already mentioned in the comment according to the Google Online Security Blog App Engine was affected.

A patch has been written and I assume applied to the Google services on March 21st, long before the vulnerability became public.

Assuming nobody knew about this bug before March 21st no further steps are necessary. Since you can't be entirely sure the best way to ensure a secure service is to follow this checklist.

  • Re-issue new SSL certificates for your domains (find a guide here)
  • Change your passwords and revoke existing sessions
  • Revoke and recreate access tokens

There is more good news. App Engine supports Forward Secrecy. This feature mitigates attacks by making it impossible to use a stolen encryption key to read old encrypted communication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.