On: Tumblr sends passwords in the clear.

As always, it depends what your app is doing. I've got a realtime event hanling solution where the performance dips close to 50% when you turn SSL on simply because of the handshake times.