I strongly disagree. I currently live in Iran, and sometimes (just for fun, I guess - see here for an example: http://news.ycombinator.com/item?id=3575029 http:

I strongly disagree. I currently live in Iran, and sometimes (just for fun, I guess - see here for an example: http://news.ycombinator.com/item?id=3575029 http://news.ycombinator.com/item?id=3575029), they disallow all encrypted connections (to/from outside the country) and every single website/service that uses SSL and is located outside of the country stops working. If HN login were HTTPS-only, I couldn't login at those times. Sure, now they can easily sniff my HN password (which I don't use anywhere else) and could abuse it, but I don't give the slightest damn about it. I'd create a new account (though it's not ideal as I'd lose my karma and can't downvote objectionable/trollish comments). My HN profile is probably the least valuable online account I have; I don't care if it gets removed or hacked. It's more annoying for me if I couldn't login at all. Of course, your use case most certainly differs from mine; which is why I think it's a good idea to show HTTPS login form by default. But please always allow a less-secure but probably more reliable option for logging in when you're creating a login form for non-commercial sites like HN.