If a service leaks your credentials, your options are limited, but changing all your passwords to something harder to guess/break is never a bad idea.

SSL isn’t hopelessly broken, but the widespread use of TLS 1.0 means that SSL cannot be regarded as fully “secure”

Hard on the heels of the translated blog by Sebastián Bortnik that I posted at the weekend comes news from the Register (http://www.theregister.co.uk/2009/10/05/fraudulent_paypay_certificate_published/) of a bogus Paypal SSL certificate released yesterday exploiting a bug in Microsoft’s crypto API that has remained unpatched for more than two months, when Moxie Marlinspike (can I have a handle