Harrier said:
SSl is totally insecure- need to go TLS 2.
I wasn't aware there was a TLS 2 yet, did you mean 1.2, perhaps? Technically, TLS came out in the late 90's or early 2000's, but SSL 1/2/3 had been around so long and was so ubiquitous that the term "SSL" really became synonymous with HTTPS (even if not the correct technical name), but all certs and web security now use transport layer security (TLS).
That said, HTTPS is absolutely a MUST for a web site that passes any data, such as logins, as it's the mechanism for 3rd party verification of an encrypted channel between two endpoints over the internet. Like any other technology, it has had and will have vulnerabilities - and they get fixed, updated and patched as discovered. However, as it stands now, when you log in on a site that doesn't have HTTPS, your credentials, passwords, whatever - are essentially passed in plain-text for anyone to very easily capture.
These days, any site that doesn't completely run with HTTPS, screams webdev neophyte - and I try to stay away, as I'm sure any data they hold on my behalf is subject to being easily captured.