Several security firms and independent developers have published online tests
To help the public discover if the services are still exposed, Several security firms and independent developers have published online tests.
However, there is no simple way to find out if they were vulnerable before.
Organisations that used Microsoft's Internet Information Services (IIS) web server software would not have been affected.
But Codenomicon has noted that more than 66% of the net's active sites rely on the open source alternatives Apache and Nginx, which do use OpenSSL.
Even so, some of these sites would have also employed a feature called "perfect forward secrecy" that would have limited the number of their communications that could have been hacked.
'No rush'
A researcher at the University of Cambridge Computer Laboratory said it would be an overreaction to say everyone should drop what they are doing to reset all their passwords, but that those concerned should still act.
Security companies have developed tests that can reveal if a service remains vulnerable to the flaw
"I think there is a low to medium risk that any given password has been compromised," said Dr Steven Murdoch.
"It's not the same as previous breaches where there's been confirmed password lists posted to the internet. It's not as urgent as that.
"But changing your password is very easy. So it's not a bad idea but it's not something people have to rush out to do unless the service recommends you do so."
Comments