Everything on the web transferred in cleartext, which is pretty crazy from today’s perspective.

Man, I still remember the days before firesheep when you could get up to all kinds of fuckery if you knew what you were doing.

Also, completely baffled me that someone thought it was a good idea to only use HTTPS for auth and leave the secure cookie traveling in the clear.