Don't go changing your passwords right now at all, that's the worst thing one could do. The passwords ON a site are not currently at risk. It's the passwords and information currently IN TRANSIT that is the issue. If you go and change your password on a site that is currently not secure, you're creating the risk in that scenario. A lot of this has been updated already for several months by most critical sites. I would hope that many would continue to finish the updates soon now.