In order to be more secure in my external transmissions, I tried to use https://serverfault.com and found that I could not login.
Actually I get a 403/HTTP Authentication request, but its not like going to http://serverfault.com site.
Is there a reason https browsing is not enabled for ServerFault and the other Stack Exchange sites?
The biggest barrier standing in the way is that Gravatar doesn't support HTTPS, and Gravatars are a big part of StackExchange as a whole. There are a variety of other items that are included from 3rd party sites which would also prevent full SSL "green-bar" support. Until such items are fixed or engineered around (such as building an HTTPS-enabled Gravatar proxy-server), StackExchange will stay S-free.
The actual authentication process is secured over SSL/TLS.
(at least if your OpenID provider isn't made of suck)
Everything else you do on ServerFault is public*
Adding SSL to StackExchange sites is computationally expensive
(Good enterprise SSL accelerators range in cost from about as much as a pony to about as much as a house!)
* – Possible Exception: Associating email addresses with your account & subscribing/unsubscribing to site newsletters.
I agree that these things should probably be happening over SSL if they aren't already.
Maybe I'm not as paranoid as some but I just don't see the need for a secure connection to a site like SF. If you have a real concern about someone impersonating you then perhaps you need to address the underlying problem instead.
The funny thing is that now a proper SSL certificate is installed, the problem is that it only has names stackexchange.com and *.stackexchange.com. It should be simple to get serverfault.com, stackoverflow.com, etc added as alternative names.
Update: but most still redirect to http, except for stackexchange.com itself.
So, fast forward to 2014, Stackexchange can now be accessed via https (Yay! And rightly so: Wikipedia is "public" too, still I don't want my employer/wifi sponsor/isp/... to eavesdrop on the connection) - but only with mixed content (Imgur? Quantcast?) and with TLS 1.0 only. Are there any plans to fix this as well?