As I understand it, if not everything is HTTPS, the attacker could just inject JavaScript that changes the page to the login page when the user clicks &quot;Log in&quot;. That way, they can still record the password.