Clear Text HTTP password
It’s strange but it’s true some import web sites take your username and password over plain HTTP even if you do see the little SSL lock on your browser.
SecurityMonkey has compiled a short list of these site, giving the proofs of the truth of his thesis
