This is true. I can intercept your username/password during login by being in close proximity to you if you are logging into their website over plaintext HTTP.

This is true. I can intercept your username/password during login by being in close proximity to you if you are logging into their website over plaintext HTTP. Not possible if it is protected by TLS (HTTPS).