Just noticed as well that it doesn't force you to use HTTPS for the login, so if just go to mtgox.com without explicitly using https://mtgox.com you may be submitting your username/password oven an unencrypted channel.