"Insecure Discussion Forums “Login” link"

[#1]

Are members aware that the Discussion Forums “Login” link is insecure if using the Plusnet Login link?
Plusnet Home page = https://www.plus.net/ = Secure
Member Centre = https://portal.plus.net/index_nlp.html = Secure
Discussion Forums = http://community.plus.net/forum/ = OK for viewing only.
Clicking on the Discussion Forums link “Login” takes me to: - http://community.plus.net/forum/index.php?action=login = Not secure.
I have created a favourite/bookmark (I should not have had to do this) to take me to https://community.plus.net/forum/index.php?action=login
How many people are logging in to the Plusnet Community Site forums using the Plusnet provided “Login” link taking them to the insecure login page and then entering their username and password?
I have only been with Plusnet since February so how long has this breach been happening for and are Plusnet aware of it and sorting it?
Not good.

[#2]

Why should it use https - checking on the multiple forums I use and I only found one using it

[#3]

https works fine on the forum..

[#4]

but you have to change it yourself as linking from the main site doesn't use it

[#5]

Dunno, Jim - I logged into the forums so long ago I can't remember which link I used, but my header definitely reads 'https://'

[#6]

No http ot https shown in FF here but clicking on the little 'i' to the left of the address bar and I get a message that 'Connection is not secure'.

[#7]

Are you sure that's not just telling you certain items on the page are insecure Mav? Things like externally hosted images in signatures blocks/avatars probably won't be.
The login link should force SSL IMO and I believe it will when the community gets upgraded in the not too distant future.

[#8]

Not sure so I've attached a screenshot:

[#9]

As a publicly viewable site I guess having HTTP access makes some sense but I can't help thinking the login page, at least, should be HTTPS only.
What are the real risks of entering a username and password on a plain HTTP page?  (I ask because I genuinely don't really know)
In case anyone wants to state the obvious that unique usernames and passwords should be used for every different sites, we all probably know someone who doesn't do this so shouldn't all login pages be secure by default?

[#10]

New community's going live next week so this will become a non-issue (from a login perspective). @Mav, you're browsing over HTTP by the looks of things. You can force HTTPS by manually prefixing the URL with 'https://'.

[#11]

A bit moot now, really, but I have just added https:// before the URL.
I get a padlock with a red line through it and right-clicking still gives me a message 'Connection is not secure.'.
Not worth investigating but thought I'd post my results.

[#12]

There are some unsecured scripts

[#13]

Will the new site login page be https by default?

[#14]

The entire site should be https by default. Otherwise, your login cookie would be exposed the same way as the username and password would be if the login page isn't https.