For those who have sites built on Drupal the combination of two modules can keep you relatively safe. First secure pages (http://drupal.org/project/securepages

For those who have sites built on Drupal the combination of two modules can keep you relatively safe. First secure pages (http://drupal.org/project/securepages http://drupal.org/project/securepages) and secure pages hijack prevention (http://drupal.org/project/securepages_prevent_hijack http://drupal.org/project/securepages_prevent_hijack). With the combination of the two, a user session can still be hijacked. However, it will only allow them to go to non-SSL pages. In the case where a user may login and visit a lot of pages that aren't sensitive, but some that are this is a good option and pretty easy to set up.