I've recently come to understand that StackExchange protects all main (and, by extension, meta and chat) site logins with HTTPS, even though the page itself is presented as HTTP. This supposedly happens with StackExchange's OpenID provider as well as most (if not all) supported third-party providers. (I feel mine in particular is doing a good job, but I can't speak for the rest for lack of experience.) While not an ideal solution, as expressed in several Meta threads, it's a little bit better than nothing.
However, I have now found that BlogOverflow (which just happens to have been recently compromised due to an unrelated vulnerability) does not have this protection. The login page is presented as HTTP, and login details are sent in a clear HTTP POST request.
From a security standpoint this is unacceptable on principle alone. Worse, it's misleading and confusing for the users. Effectively the message is on one hand, "Our HTTP login pages are safe because the form is actually being submitted in HTTPS" while on the other there's an unmentioned caveat of "...oh, except for BlogOverflow".
Please fix this as soon as possible. Thanks.