No point resetting anything until the server are patched on everything you use

And it could happen (if Lady Luck was having an off day) that logging in to change your password would also disclose your new password...

2 step verification seems most secure way atm. Although it has been possible to bypass it it makes it alot harder to

Along with other security phrases that password updates sometimes ask for......

A day is always well started by spreading a little alarm and despondency

Do wonder if this has been exploited yet. Been around for 2 years and apart ftom Yahoo accounts being compromised a fair bit, doesn't appear to be many reports of other sites suffering large scale account conpromises

In reply to a post by bobble_bob:

No point resetting anything until the server are patched on everything you use

Exactly. Could be counter-productive, in fact, exposing both old and new passwords.

Here's how it works.

Android 4.1.1 is vulnerable, so, reversing the attack, a malicious server could be used to extract passwords from your phone.

Scarily, we found our hosting and email providers' tech support to be totally clueless. Less scarily, though, it looks like their real tech people have already fixed most things and put measures in place to block the exploit whilst they fix the rest.

Right I've had a bit more time.

live.com does indeed not have SSL - it uses an HTTP 301 redirect. The redirect goes to another non-SSL site, which is a load balanced front end for mail.live.com which is itself an alias of www.live.com. That site finally pushes the client to login.live.com, another alias, which is HTTPS:

TLSv1 Record Layer: Handshake Protocol: Multiple Handshake Messages
Content Type: Handshake (22)
Version: TLS 1.0 (0x0301)

Probably the amount of redirects confused the tester, it was likely expecting no more than a single redirect via an HTTP 301 to a secure site.

How long realistically would it take all the major sites (email, banks etc) to update their servers?

No point changing passwords until they do

http://www.telegraph.co.uk/technology/internet-secur...

Is a nice clear and easy to follow list, not perfect for the average human keeps it simple.