> Third and related, the corollary of "HTTPS=secure" is that "sites that only use HTTP = insecure". This is leading to a requirement that any guy who builds a website with login functionality needs to implement HTTPS, and that saddens me.

HTTPS may not be secure, but HTTP (over the public internet, at least) is definitely insecure. If you have login functionality that matters, rather than serving as a very basic deterrent to accidentally getting somewhere you shouldn't be, yes, you need to use HTTPS.