Contrary to popular belief, it doesn’t make much sense to protect the password without protecting the whole session (that is, without serving most of the site o

Contrary to popular belief, it doesn’t make much sense to protect the password without protecting the whole session (that is, without serving most of the site over HTTPS). If just the login page is encrypted, any attacker who is now prevented from stealing your password can still obtain your session cookie that travels over plain HTTP. A compromise of a single session is bad enough for many services. Set up a filter to forward your email to the attacker’s address? Access private information? Post messages on your behalf? Change your user profile, including your email and shipping address? Usually such actions do not require password authentication when the client already has a valid session cookie. A man-in-the-middle attacker could also intercept your attempt to log out and keep using your session for as long as possible.