It wasn't too long ago that Let's Encrypt didn't yet exist, and SSL certificates were expensive and troublesome to configure - things have changed since then, but there probably hasn't been an overwhelming desire to update the forums.
I wouldn't characterize it as a "major" security issue, since it's unlikely to be a problem unless you're connected to a public network. Also, the main website doesn't require any credentials at all - only DFFD and the Forums require a login to post, and those credentials probably aren't of extremely high value (and they should be useless everywhere else if you're using unique passwords on every website you visit).
There's also the fact that using SSL results in extra load on the server (since it has to encrypt all of the data it sends you), and it can also prevent the use of CDNs to reduce network traffic. Somebody recently remarked that the Dwarf Fortress Wiki also didn't use HTTPS, and it was explained that the advertisements used on it (which are necessary to fund its continued operation) didn't support it (and thus would have failed to work) - that's currently not an issue with Bay12, but it's still an example of something that could prevent the use of HTTPS.
Note that I'm not trying to suggest that these forums shouldn't use HTTPS, just that there are any number of reasons why they weren't set up that way - it's also possible that Toady wants to use it, but hasn't been able to spend the time necessary to configure it (being busy working on the game itself).
Author
Topic: Why is Dwarf Fortress still using HTTP? (Read 490 times)