Security researchers are warning that a flaw leftover from the 1990s in OpenSSL and Apples SecureTransport is putting users at risk, enabling attacked to decrypt login cookies and other sensitive information.

The Freak bug (which stands for Factoring Attack on RSA-EXPORT Keys) affects older Android browsers and Safari for all versions of iOS and OS, endangering any information transmitted over the internet, including credit card details, passwords, private messages and medical information.

Around 10 per cent of websites are also affected, placing visitors at risk regardless of the browser used to access the site. However, the good news is that attacks that exploit the flaw are impractical to carry out on a wide scale, so most consumers are unlikely to be targeted.

The vulnerability was reported by website Freak Attack, which also enables people to test their browser for the flaw, and lists the websites currently vulnerable, which includes americanexpress.com, tinyurl.com, topshop.com and, rather amusingly, nsa.gov.

The flaw is a carry-over from the earliest days of internet architecture, when the US government had laws in place that forbid developers from selling software with strong encryption tools to foreign users, out of fear that it would make foreign systems harder to surveil.

The laws were fazed out after criticism and protests, including one hacker magazine 2600 printing t-shirts featuring the mathematical equations for strong encryptions and sending them to fans around the world. However, many software makers had already made software that used weaker encryption a central part of their platform, leading to todays situation.

Apple has said that it has developed fixes aimed at mitigating the flaw, and a software update to remedy the vulnerability will be pushed out next week, while a Google spokesperson said the company has also developed a patch which has been rolled out to partners to distribute, which is standard protocol for Android updates.

“No matter how bad you think the internet is, it can always surprise you,” said Matthew Green, a cryptographer and research professor at Johns Hopkins University in a blog post exploring the flaw. “The surprise in this case is that export-grade RSA is by no means as extinct as we thought it was.

“The export-grade RSA ciphers are the remains of a 1980s-vintage effort to weaken cryptography so that intelligence agencies would be able to monitor foreign traffic. This was done badly. So badly, that while the policies were ultimately scrapped, theyre still hurting us today.”