Comment by hannob

It is actually worse than that. Given an active attacker one can easily steal passwords using SSL stripping attacks. Ebay is also affected. Cookie stealing also works.

Pretty much every mixed http/https setup ("encrypt only the login") is broken.