I'm also no crypto expert, but I think the FS community needs to be more concerned with security these days, given what we now know.
I agree that using EC may not be the smartest thing to do, and I have also been following the ongoing discussion.
The problem is that we really don't know exactly which forms of EC present in latest openssl have been cooked, if any at all besides the one we already know about.
Right now there's just too much speculation and little fact. I've taken notice of Schneier's concerns, but he offers little more than a gut feeling at the moment to distrust EC in general. I can obviously understand distrusting some specific EC implementations where we now know some agency-which-we'll-not-name-here has cooked the constants (
Dual_EC_DRBG), but that's a far cry from disabling all EC completely.
Regardless of what we eventually discover, it seems to me that updating TLS to 1.2 in FS is smart security. At least then we have the option of disabling certain ciphers and EC implementations, but we're in control. Right now I don't know how to disable certain ciphers in FS and force the use of others to enforce PFS for example. Perhaps I'm just ignorant, but I can't find that documented anywhere
As it stands right now, FS is limited to TLS 1.0 and AES 128 bit (correct me if I'm wrong), which is known to be vulnerable to a few attacks, even if BEAST and the like are highly unlikely attack vectors in a FS session.
I do hope that FS developers take notice. It's great to have WebRTC and all the other cool and new protocols being rolled into FS, but for many people security is becoming of paramount importance. As a long time user and fan of FS, I do hope that security becomes just as much a priority.