Self-Proclaimed Experts are quick to say that for every time a password is being transmitted from a webserver to a user and vv, you need to use SSL. Because there will be people each time trying to get your password who are always in between you and the server you request data from. If you are in a crochet forum, there will be millions of euros being spent to get your password, even if you are a 90 years old granny with no money.
Same with sending passwords via email.
Given the fact that SSL certificates are costly, how should those two security issues be judged:
When is it necessary to have SSL?
Should you never send passwords using mail?