Original post:
If you entered your password with the broken lock in the URL bar, your password is already being sold to someone to be exploited. That password is compromised and it is GONE.

There is not enough emphasis on the fact that this forum is not on HTTPS. I hope this is a recent problem, but this thread is not enough warning.

I have witnessed when a website was misconfigured for just a day, its unencrypted traffic on the net was compromised and exploited. "Clear" traffic is automatically sniffed for things like passwords and credit cards. I'm not chicken little sky is falling, I have observed this on low traffic websites.

Seriously, the site should just be gone until it's fixed. Chrome and Firefox have plugins to generate strong and random passwords, so use those and just hope for the best.