If you simply go to that login, but s/http/https/, voila! ssl!
I was initially confused by your question, apparently HN is always using https for me.
I was initially confused by your question, apparently HN is always using https for me.
Maybe it's PGs way of teaching people to think about security by making it something they need to "opt-in" to, but that seems like a fairly strange line in the sand to draw.
Is HN a site with sensitive information? Not particularly, unless you put way too much faith in your karma. That doesn't make a default behavior of sending passwords over plaintext excusable. And despite most HN users knowing better, I guarantee there's plenty of password re-use here (hopefully re-use of the throw-away password that most people have, but that does't make the situation any more acceptable).