Btw, HTTPS is meant to protect you from outside scripts that fish your data while you log in, not from the site owner.
No, HTTPS is meant to protect you from people on your local network running packet sniffers. It is relatively ineffective vs. phishing because phishing sites create a sufficiently convincing facsimile of the target to convince you to punch in your details, possibly including a pass-through to forward you to the actual site once they have your dox. However, "people running packetsniffers for malicious purposes" is a relatively uncommon thing on modern networks, which are generally switched. For this threat to be meaningful, you tend to have to be on a local segment populated by other unswitched users, such as a university dorm, computer lab, or wireless network. It isn't even effective at, say, public terminals, because public terminals can be infested with keyloggers which will trap the data from the keyboard itself, not the network, or even physical spy-cameras which can visually intercept and replay the entry. As such, HTTPS is not really that effective as a defense against hackers. It are a fact. I know because of my learnings. The procedures for attacking an HTTPS-encrypted link are basically exactly the same as a standard HTTP site, only with additional wrinkles that HTTPS produces which actually serve only to produce a false sense of user security and make users even easier to manipulate into behaving insecurely.
If you truly think decent applications (like this forum software, for instance) don't encrypt your password and that everyone using HTTP is trying to get your data, you should get off all forums and other websites with login NOW.
Forum softwares generally store passwords in a hashed form which is not recoverable, and authenticate a password entry by simply applying the hash function to your input and comparing with the existing hashed entry: A correct password will match when fed through the sausage grinder, an incorrect one will not. This is why if you lose your password, the software cannot mail it to you and you must reset it, as the forum does not actually know what your password is. Softwares that actually ALLOW you to recover your password store them in a retrievable format and are therefore insecure.
PMBD
Author