> The login request is always sent via https, even when you are using the site over plain http. So your password should always be encrypted.

Though it doesn't stop someone (eg. malicious software on a wifi router) altering the login form itself to submit passwords to a different URL...