It's kind of amazing that it wasn't like this from the start. Unsecured coffe shop wifi + http = everyone in the room can grab your password.
However, all the mail is in the clear. So if some crappy website sends your password via email, then someone can can grab it.