On: Passwords in plain text

[IbJacked]

Not necessarily. The login page could be http, but as long as it posts to an https address, the password is never transmitted in plain text.

[fooyc → IbJacked]

If your login page is HTTP, your HTTPS receiver is useless. A MITM can just change the form's target URL in the HTTP login page. On inject any scripts.