There are still ways around this, easiest being to issue a redirect back to HTTP versions of the site when a HTTPS is requested - together with other tweaks it

There are still ways around this, easiest being to issue a redirect back to HTTP versions of the site when a HTTPS is requested - together with other tweaks it can still be made to fool a regular user - see http://www.thoughtcrime.org/software/sslstrip/ http://www.thoughtcrime.org/software/sslstrip/ Another possible process would be to issue a self signed certificate when a session is being requested - obviously the user would be notified of the certificate issue, but depending on the level of knowledge of the end user, they may just accept the faked certificate. See http://crypto.stanford.edu/ssl-mitm/ http://crypto.stanford.edu/ssl-mitm/