ok, so are you also saying that it is impossible for an attacker to intercept data from a standard HTTP request?

My next point being that if standard HTTP is also vulnerable to such attacks, why doesn't the browser display a warning on EVERY page, telling us that it can not verify the website identify? Thus, all things being equal, I would assume that unverified, but encrypted is still better for the user than unverified AND unencrypted.

...but I've probably misunderstood something fundamental here (as is often the case!)