MD5 message authentication for the site. No PFS (ephemeral key exchange). Mixed content. I couldn't find a statement where the servers are hosted. Not exactly encouraging.