This reminds me of how Linkedin and many others used to upload entire phonebooks to unecrypted endpoints, making it simple for US agencies to analyze social networks of foreigners with impunity.
Ha, good question. Generally, everyone switched to HTTPS. But that doesn't protect against situations like with Yahoo, where the agencies were tapped-in after the SSL termination. I guess it's not a stretch to assume it's still going on.