Sort of. Twitter and Facebook still serve their home pages as HTTP and provide a login form that posts over HTTPS. The problem is that I can do a MITM attack o

Sort of. Twitter and Facebook still serve their home pages as HTTP and provide a login form that posts over HTTPS. The problem is that I can do a MITM attack on the unsecured home page and put my own script in there that siphons off the user's password when they click the submit button. So the HTTPS-posting form prevents the eavesdropping case, but not the man-in-the-middle case. That's how the Tunisian government was harvesting their citizen's facebook logins: http://www.thehackernews.com/2011/03/exposure-how-does-tunisian-government.html http://www.thehackernews.com/2011/03/exposure-how-does-tunis...