As I suddenly figured out, there is plain HTTP used on log-in form to http://reverseengineering.stackexchange.com
No SSL\HTTPS implemented, and password in login form transferred in clear text. As You may see, this is not secure at all.
Workaround I found for myself - log in at https://stackexchange.com/ and then - use Login button on reverseengineering.stackexchange.com to extend login session to subdomain as well. It's not 100% secure also, but at least not credential but session passed in clear text here.
So - question is, is there any option to enable secure login directly to project website, without workarounds?
UPDATE: well, always re-check results before You ask questions. Actual OpenID form URL is https://openid.stackexchange.com/affiliate/form So - problem is partially solved.
Anyway - site with information related to InfoSec IMHO should at least have SSL available for all traffic, even if it not default.