It seem to have https now, and Firefox reports a legitimate certificate. So at least there's that. :)

Legitimate (according to the rather dubious standards of SSL certificates), but it's not the same certificate they used to use, issued to Tibanne Co.

At least it is the same CA, DigiCert (AFAIK). DigiCert has fairly high standards so they probably examined closely when a different org requested an EV cert for that domain. For what that's worth.

Yes, you're probably right, I just recall very clearly that they had emphasized in all of their security warnings to check for the certificate from Tibanne Co, and the current certificate is not.

If they don't have a zero day browser exploit, is there any reason I need to be worried? (Assuming I use different passwords for everything)

I don't know how their infrastructure works, but if they use your password to unlock your wallet this could be a phishing attack. Either way, the money is probably as good as gone anyway.

This was what I was thinking, there were the folks who hacked the place and dumped out the data and scribbled on Carpeles log, what better way to get the passwords to peoples wallets then to put up a phish on MtGox's own servers and have anxious users provide it. People log in, give their password, check their wallet and then poof all the coin gets moved out somewhere else. Seems pretty doable if you already have control of their infrastructure.

Yes, this could be true.i was able to login using bogus account details earlier https://news.ycombinator.com/item?id=7419657