Having fooling around with SSLStrip for few days, and felt its potential in stripping information from the network packets, I tested it on myself few times, and I success every time.
Well, for HTTPS (SSL) site, the URL will shown in HTTPS, but when the hacker is sniffing around the network and waiting to strip off the secure connection data, the “s” is gone from the URL , which left HTTP, so if someone is careful enough will not going to login, but who know, not everybody check the URL before login (not sure if there is way to keep the HTTPS in URL while stripping the data).
Well, there is a add-on for FireFox, the SSLPasswdWarning, it shows a warning popup when it sense that something is wrong with the page, here is the screenshot:
Note that in this example, the URL underlined with red color line, is HTTP, Gmail is using HTTPS, but not HTTP, so the SSLPasswdWarning sense something wrong with it, and warn the user. Hope to find other protection for other browser soon.
Stay safe!
update: Apparently it will show warning on every login that without HTTPS.