How strange, I changed it to http as asked. For me it then asked for my social security number to login and then I needed to confirm some of my banking informat

How strange, I changed it to http as asked. For me it then asked for my social security number to login and then I needed to confirm some of my banking information for the IRS. I'd expect that to be information you'd want to protect!! I actually double checked to make sure I wasn't on a phising site but I was safe: "senate.gov" why did they need my banking information? Oh well. The above is fiction, but an easy scenario under HTTP. Any AP (wifi access point, like at a cafe) can do it...