TOR is insecure at exit nodes. Really no way around it. Passwords can be harvested. I think it is in one of those Wired kind of articles.