Quite frankly, http vs https isn't really much of a difference. I've only ever seen one true 'man in the middle' attack, _ever_, and that's since 1990.

Here is, to me, the best way for you to secure your accounts.

1) Pick three passwords. If you can avoid it, don't bother trying to create a mish-mash password like G5%78rq3#. You'll never remember it unless you write it down. Also, don't use _common_ information about yourself or your family. 'bobtomjim10221976' (your three children and your wedding date). Beyond that, have fun. 'horsepicklebatterycheck' is a better password than the G5%78rq3# I typed previously. It has to do with degrees of entropy. Despite having no capitals, no number, and no funky characters, it's still 23 characters long. If you made everything past tense, you'd end up longer than the entire alphabet. Anyway, those three passwords should be for your casual sites, your important sites, and your financial sites. The reason for three is that if you forget which one you used for a site, you won't run out of attempts before you get it. (Also, some banks are stupid about passwords, and won't let you use a long basic one, but require a short scrambled one)

2) Make a spreadsheet of the web sites you visit, and your logins for each. Most people are signed up for more mailing lists, forums, and sites than they realise. Print this spreadsheet out every time you sign up for a new site, and put it somewhere where you can get to it. Notice that you don't have any passwords on this. This is your personal reference, but should also be associated with your estate/will planning, so that people can close things out if/when you pass on, or are incapacitated. (Look at what happened with Bob Arnold's stuff, and he was mostly prepared) (put a basic password on the spreadsheet if you're really paranoid, but don't get fancy. That's a password you can write on a post-it note on the back of your desk. Just don't say what it's for) (Also, you can use this for servers you log into that aren't web sites)

3) Write down the passwords, and put them in a safe deposit box, or your household safe, or even just in an envelope with your legal documents in a filing cabinet.

4) Come up with a new set of passwords no less than once per year, but no more than once every three months (Unless you can prove your account was hacked by password guessing). With the spreadsheet, you should be able to change all of your passwords within a couple of hours. (Put the new passwords in with the old, in case you miss one - and put the new ones in _before_ you start to change them)

What does this mean? Well, you'll have about two days of scrambling to put it all together, but once you are done, you'll know what you're signed up for in case you end up in legal trouble, hacked, or otherwise need it. You'll be able to change all of your passwords safely and regularly, and in case of the worst, people can be notified and logins deleted/changed/shut down. The spreadsheet, even if you include what email addresses you used to sign up for each, is mostly worthless without the passwords. The passwords are worthless without the spreadsheet(s), and you've just made the major step of being prepared for the worst.

BW