If you want to generate a secret to use for communicating with a confidant, you have to generate something that an adversary cannot guess, i.e. something like the heads and tails of a coin flip.
This can be done by taking a source of randomness that is available to the computer, e.g. the interval in microseconds between keystrokes while typing, and then using that data as input to an algorithm that transforms the numbers into a string of bits that are the secret.
NSA caused the particular DRBG to generate bit strings that could be guessed in a number of tries that could be computed with the computers available to NSA. Therefore they would be able to guess the secret and undo the encryption between you and your confidant.
However, their efforts were for naught in this particular widely-used implementation of SSL, since a bug in the code caused the NSA-designed DRBG to never be used. Other, presumably secure, DRBGs would be used by the code instead.
PS - SSL is the Secure Sockets Layer, a communications protocol layer between the Transmission Control Protocol and the Hyper Text Transfer Protocol. Your browser should show a little lock icon or similar signal when SSL is being used. It is the "S" in "HTTPS".
= new reply since forum marked as read
