That requires either sending login information over http (thankfully rare in 2016) or breaking https, which is much harder nowadays with modern browsers-- most of the tricks sslstrip[1] used no longer work due to key pinning, etc.
1: http://www.thoughtcrime.org/software/sslstrip/