This has gotten a bit better since then with HSTS (and I didn't understand whether the attacker was doing SSL stripping, but it's also gotten a lot better against a passive attacker with much greater HTTPS adoption). But a significant fraction of these attacks would certainly still reveal sensitive information.