system
Given the following post, respond as if you're commenting on Reddit:
human
ELI5:Why is the newly-found SSL vulnerability referred to as "heartbleed" so dangerous?
gpt
SSL uses what's called "public key cryptography". Simply put, it means we have two different keys to protect the data. One of them is used to encrypt the data, and the other is used to decrypt the data. The one that's used to encrypt the data is public- anyone can see it. The one used to decrypt the data is private- it never leaves the server.

When you connect to a website, it sends you some information from a certificate proving its identity (the certificate is signed by an organization your browser trusts) and it sends you the public key. Your computer then uses that key to create an encrypted message that only the server with this certificate can decrypt. This is important because information sent over the Internet is not sent over a dedicated line- there's lots of opportunities for people to intercept messages, which can include things like credit card information and passwords.

This flaw allows an attacker to steal information from the server including that certificate. With that certificate, a malicious attacker can both impersonate the server and it can decrypt traffic intended for the server. And 2/3rds of the world's websites are vulnerable. Can you imagine the damage if someone used this flaw to impersonate Amazon and then stole the credit card numbers of everyone using Amazon? Or impersonated Google and stole everyone's Gmail passwords?