Is there a way to determine as an end-user which HTTPS sites use OpenSSL? Due to heartbleed it is recommended that clients change their passwords that were sent over TLS recently as private keys may have been compromised so eavesdropping and MitM attacks were possible.
However, I haven't seen any notices from any HTTPS sites saying, yes we used OpenSSL, please change your password. Is there anyone compiling a list of big sites?
Preferably including ones that are already patched, but use OpenSSL and quite possibly were vulnerable?
Yes, I've seen that there are HeartBleed checker tools, except these tools seem incomplete -- they only can tell if the site is currently vulnerable. If a site is currently vulnerable, its quite possible that someone could MitM your traffic to said site with a copy of their private key (but on the MitM not be vulnerable to Heartbleed).