I'm struggling to know what the right decision is for our users. My gut says we should reset everyone's password and put them through the password reset flow.
Most of the emails I've received have been suggestions to do so with the exception of an email from Optimizely.
Is there a sound argument to not reset passwords? I realize it's a pain for users and we've been trained to avoid adding friction at all costs. When is there an exception to that rule? And is it heartbleed?
Instead, I sent out a security alert email to everyone with links to ArsTechnica article http://arstechnica.com/security/2014/04/critical-crypto-bug-... and Heartbleed bug http://heartbleed.com/ for more information and a link to our password reset page.
We also have a security alert on user dashboard that they see after logging into our system.