I am unable to ask questions or post when accessing https://stats.stackexchange.com/. When I attempted to access the meta site it was also not possible for me to log in.
Edit: Also it appears to be auto-logging me in without needing to enter a password sometimes but not others. Finally, shouldn't the log-in page always be https://? Seems insecure to me.
Also, visiting https://stats.meta.stackexchange.com/ gives invalid cert:
meta.stats.stackexchange.com uses an invalid security certificate. The certificate is only valid for the following names: *.stackexchange.com , stackexchange.com , meta.stackexchange.com , *.meta.stackexchange.com , *.stackoverflow.com , stackoverflow.com , serverfault.com , stackauth.com , sstatic.net , meta.serverfault.com , superuser.com , meta.superuser.com , stackapps.com , openid.stackauth.com (Error code: ssl_error_bad_cert_domain)
Part of the issue seems to be that getting logged into the https:// version does not mean you are logged into the normal version of the site.
Unless the user is using add-on like https everywhere it appears their password is being sent in plain text by default every time they log in. If my understanding is correct, anyone who is not using "https everywhere" can have their pass stolen over wifi. I think it is not such a big deal for CV but this can be a major problem for those who reuse passwords. The cookies are also not being deleted upon log-out. It is not possible to log in to the meta site using https at all without making an exception for an invalid cert, which is why I don't wish to post there any longer.
(Copied from a comment on our main site.)