The NSA is the reason that we can't have nice things on the Internet

It seems that encryption was deliberately broken by the NSA, and now everyone is getting hip to how to read all your data.

Tens of thousands of HTTPS-protected websites, mail servers, and other widely used Internet services are vulnerable to a new attack that lets eavesdroppers read and modify data passing through encrypted connections, a team of computer scientists has found.

The vulnerability affects an estimated 8.4 percent of the top one million websites and a slightly bigger percentage of mail servers populating the IPv4 address space, the researchers said. The threat stems from a flaw in the transport layer security protocol that websites and mail servers use to establish encrypted connections with end users. The new attack, which its creators have dubbed Logjam, can be exploited against a subset of servers that support the widely used Diffie-Hellman key exchange, which allows two parties that have never met before to negotiate a secret key even though they're communicating over an unsecured, public channel.

The weakness is the result of export restrictions the US government mandated in the 1990s on US developers who wanted their software to be used abroad. The regime was established by the Clinton administration so the FBI and other agencies could break the encryption used by foreign entities. Attackers with the ability to monitor the connection between an end user and a Diffie-Hellman-enabled server that supports the export cipher can inject a special payload into the traffic that downgrades encrypted connections to use extremely weak 512-bit key material. Using precomputed data prepared ahead of time, the attackers can then deduce the encryption key negotiated between the two parties.

NSA was involved in all the discussions on export grade encryption in the 1990s.  Their fingerprints are all over this.

This is still developing but looks like it is very bad indeed.  This would let a Bad Guy get your online banking password, among other things.  The idea that NSA could get a back door in important code and that the back door would remain secret was always pretty dumb.

Keep your eye out for a pop up from your browser saying there's an important security fix.  You absolutely will want this one.  As far as I can tell, Internet Explorer is the only one patched so far.