[sp332]

Right, but in this case your browser never sees the page over HTTPS. The attacker makes the secure connection, and feeds you data over an insecure connection that they can see.

  You <-(HTTP)-> Attacker <-(HTTPS)-> Facbook