Ugh, what a ginormous PITA. I've just spent 5 hours fixing accounts because of this stupid thing. For accounts such as google where you can use 2-step authentication, if you haven't set it up yet, I'd definitely recommend doing so. It's very easy. You can use it to establish trusted devices (such as your own computer and smartphone); if anyone tries to log in using your credentials from a non-trusted device, they have to input a separate code or they won't get in. That includes you, of course, but you'll get a text or a phone call giving you the code. You can also get a list of codes that you can print out or save on your device, which you can use whenever you can't receive a code by text/voice.
Here's a list showing vulnerability status of many of the most heavily trafficked websites, including several banks. You should take a look at it, and if you have accounts at any vulnerable or previously vulnerable sites, it would be a good idea to change your password, especially if you didn't have 2-step authentication set up on them.
Heartbleed bug: Check which sites have been patched - CNET
BTW, this mess is due to a bug in the OpenSSL implementation, not SSL per se.
OK, I've got to go take some Advil. It turns out that Heartbleed also causes headaches!
Bookmarks