Hacker News Reader

No. Attackers will just modify the (insecure) login form so that it posts somewhere insecure, and then relay the creds to the secure handler without you noticing. You can't safely serve a secure login form from an insecure page.

If you start considering active man-in-the-middle attacks, someone can modify the HTTP page that hosts the login form to, for example, also send the password somewhere else.

For defending against passive MITM, you're right (as far as I know) that HTTP-to-HTTPS is okay.

Good Overview: http://paulmakowski.wordpress.com/2009/07/20/http-post-https...