Want everyone on your software team to learn this? Get completion tracking and compliance reporting with Hacksplaining for Teams. Free 14-day trial.
Marlinspike noticed that many supposedly secure sites (including banking websites!) at the time presented content over insecure HTTP connections, upgrading to HTTPS only when the user logged in and provided the credentials.