This post follows one a few hours ago about the Heartbleed security failure, and for safety's sake it repeats information I have added to that post as an update.

Point 1: If you would like to test to see whether a site is exposed to the loophole created (over the past two years) by the OpenSSL bug, you can go here and enter the URL you are concerned about. (This tip via Bruce Schneier.) As explained in the FAQ, the test sometimes delivers "false positives" for vulnerability -- that is, it may report problems with a site that actually is OK, or that is in the middle of taking steps to protect itself. But the site's creator explains why "false negatives" -- OK signals when there actually is a problem -- should be very rare, and especially if you perform the test several times. Update Here is another good test site.

Point 2: If a site tests through as Safe, then it makes sense to change your password there. And all of my email and financial sites are now saying Safe, so the changes I am making there will stick.

But even if a site does not say Safe, the people I have asked say that it still makes sense to change -- even though you'll need to change again when the SSL for that site is fully repaired.