'Heartbleed' threatens online passwords, data