Question: I work for a company from home online, using my own laptop. To work, I have to login to their network through a web browser, Google Chrome. The URL begins with: https:// . I use a User ID and password. I log off whenever I go on break or when I finish a shift. Since it's my own personal laptop, not company-issued, do they have the technical means to monitor other websites I may be on when working or even when not working? Do they also have the ability to turn on the laptop camera and audio without my knowing, and possibly even record?

Answer: 
The non-SSL download incurs the theoretical (and also practical) risk of being intercepted by an active attacker, who will make "something else" with it.

Javascript, by itself, cannot do downloads from outside of its own domain; that is the point of the [Same-Origin Policy](http://en.wikipedia.org/wiki/Same-origin_policy). Since the Javascript is loaded from the bank domain (`foo.com`) but the download is from `l.longtailvideo.com`, then one must assume that the Javascript instructed the *browser* to do the download, most probably by inserting an `<img>` tag in the page HTML.

Browsers are, generally speaking, quite well protected against malicious pictures; otherwise, you would get hacked when you do Google searches or access various forums, because in many forums one can embed links to external pictures.

In your case, the picture is the logo for a video player in Javascript/Flash (depending on what the browser can do); I think it is [this one](http://www.jwplayer.com/), although maybe an older version because their logo appears to have changed. [This blog post](http://www.bashbang.com/geek/progressive-download-mp4-with-jw-player/) indirectly tells us that the player with the logo you observe was the "latest version" more than two years ago.

**What is the worst that could happen ?** I suppose that the logo is displayed somewhere on the page. An industrious attacker could replace the logo contents with a picture of his own, possibly a bigger picture which would disrupt the page layout.

There are worse things, though. The attacker could return a HTTP "redirect" to make your browser send a GET request to any arbitrary other URL. You will probably find [this past question](https://security.stackexchange.com/questions/36447/img-tag-vulnerability) interesting: it discusses what could happen with an `<img>` tag pointing to an attacker-controlled server. That applies to your case.

**Anyway**, the mere fact that your browser warns you is a bad thing: either the warning is important, and that's a security alert which should be treated as such; or the warning is spurious, and it trains the user into ignoring security warnings, which is not good at all in the long term.
Yes it is dangerous. HTTPS provides end-to-end encryption, e.g. protects against a man-in-the-middle sniffing or worse manipulating the data. Consider the case where a javascript resource gets loaded over HTTP-only and the attacker can replace it with something else: thus the attacker might circumvent any security protections the website has by simply reading and writing the existing content.

To protect the user against this case most modern browsers work around these broken sites by rejecting HTTP-only resources on HTTPS sites, but older do not. 

Apart from that, you better ask yourself if you still trust a bank to maintain the necessary security for online banking if they do not get this basic stuff right.