No SSL on the website means someone could easily MITM the connection and serve something else. That’s a very bad decision short of providing a different form of cryptographic authentication.
SSL isn’t just for encryption, friends.
For a site like this, I might version sniff and send modern browsers to a favicon served over HTTPS with HSTS headers; future accesses will get upgraded to HTTPS (unless the MITM drops these requests), and older browsers don't understand HSTS anyway. But I wouldn't put that favicon on generally, because it's not likely possible to get a certificate older browsers will like, and older browsers like to throw popups when they can't negotiate https on subresoures, which ruins everyone's day.
Older browsers are likely to require SHA1 certificates, and have a more limited selection of CAs. CA/Browser rules prohibit issuing new SHA-1 certificates, so you're pretty much out of luck there. Even if you can get a SHA-1 certificate that older browsers like, you have to also have a certificate that newer browsers like and get your server to distinguish between the two and serve the right certificate. Helpfully, Client Hello does not provide user-agent information, so you have to kind of guess at age of the browser / capability by what version, ciphers, and extensions they suggest. But really, all of that is moot unless you can get a trusted CA to issue a usable cert, which I'm pretty sure you can't.
They are so delusional they think some "sandbox" in the Browser that some dude ported back is fixing 20+ years of security holes in the OS, this is so funny.
I don't want to ban you because you've also posted some good things, but we've already warned you once, and you've unfortunately been continuing to break the rules quite badly—not just in this thread but in others. To mention a couple recent examples:
https://news.ycombinator.com/item?id=39467401
https://news.ycombinator.com/item?id=39458160
If this keeps up, we're going to have to ban you. If you'd please review https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd appreciate it.
Passwords? I couldn't care less if someone were to waylay 99% of my passwords.
For the remaining 1% HTTPS/SSL definitely serve a legitimate purpose, but as for the other 99% it's a fucking nuisance and I find websites that don't force the issue a breath of fresh air.