If you read the entire article, he actually covers this point. In short, without SSL on the login page, you're susceptible to DNS poisoning attacks (think logg

If you read the entire article, he actually covers this point. In short, without SSL on the login page, you're susceptible to DNS poisoning attacks (think logging in to your airline's frequent flier program from an airport's free wifi). Secondly, he shows that most of the sites don't even submit to an SSL URL.