Coming to WordPress development from more "hardcore" (slow) development, I find it extremely odd that the WordPress login process provides absolutely no defense from sniffing credentials data.
It all goes in plain text, which makes it extremely easy to fish anyone's login credentials under a public WiFi, including admins, if the website doesn't have any SSL installed.
Even searching for plugins that might encrypt the data before sending it to the server went to no avail.
So what's up WordPress? Is it a considered a good practice to install SSL in all websites? Is it considered OK to just sign in with your admin account on public WiFi, regardless if your website has SSL installed? And what about other user's login/registration process? It puts most WordPress websites and its users at a major security risk it seems, if not using SSL encryption.