I messaged the admin on here a while ago as I was aware the browsers would start flagging it.
The response I received was there are no short term plans to change it.

Personally if I was joining as a new user, I would not bother signing up once I noticed HTTP in 2017 for login credentials.

Just login somewhere secure and then you won't need to relogin for now

How are you hosting without root access? How would you install any certificate without it?

For a small site I'd be hosting at home on an RPI or a VM, for anything bigger there is AWS or Google Cloud Engine... both have a free tier....

For both, letsencrypt works fine.

In AWS, they provide free SSL offloading if you set up a load balancer.

It sounds like your main "barrier" is a poor hosting provider.

No cheap hosting is going to provide root access unless you buy a VM/Virtual Private Server account. You can always pay the hosting business to install a certificate, that is not at issue. I imagine that soon enough most cheap hosting will offer some sort of Let's Encrypt support.

Yes an AWS solution would work but it is probably beyond the scope of people who just want a simple website. I would certainly never recommend running any internet accessible web server on your home network unless (or maybe especially if) you really think you know what you are doing.

That's a shame. It's very unacceptable for a tech-focused site to send passwords in the clear.

I recently had a look at an infography elaborating various announcements made by giant companies like, Google, Apple, etc. Have a look https://www.cheapsslshop.com/blog/encryption-everywh...