I'd prefer the lot-more security that using https would provide. I cannot believe that Amazon is served almost entirely over plain-text http, with only the init

I'd prefer the lot-more security that using https would provide. I cannot believe that Amazon is served almost entirely over plain-text http, with only the initial log-in done over https. At least that's on the various European versions of the site, perhaps the US one is more secure (I doubt it). Fortunately you get prompted regularly to enter the password again - presumably renewing the cookie/session - if you want to access more private stuff. So a MITM would have to be listening all the time to view your purchases, etc. and there's no way to change an address without entering the password (I think). But still.. haven't they heard of firesheep?