[Indebitus]

This site doesn't really have TLS support, which is annoying at best. Anyone can intercept requests and their contents sent to this site. To top it off, the site gets TLS for free, with no additional overhead, due to CloudFlare.

The only con is your CDN charging you more money to serve the stylesheet. The ideal way would be to force TLS throughout the entire site. If you did it just for the login screen, you can still steal the session token and compromise an account, but not to the extent of having the password. Doing that would also require it to be for any pages before that. If it only worked on the login screen I could very well just change the login URL to a different one and intercept it.

If the site needs a cert for the CDN just shoot me a PM.

[Aceman]

TLS and SSL aren't necessary to be used on HF as no private information is being passed along. Omni has already made it very clear in the past he's not going to implement SSL so I find it unlikely that he'd implement TLS either. He's smarter than you seem to be giving him credit for.

[Emylbus]

TLS and SSL aren't necessary to be used on HF as no private information is being passed along. Omni has already made it very clear in the past he's not going to implement SSL so I find it unlikely that he'd implement TLS either. He's smarter than you seem to be giving him credit for.

Yup.

OP, read through this and you'll get a better understanding of Omni's position on this type of thing: SSL Poodle Exploit by Omniscient