Now that Google, Twitter, and some other sites require a TLS connection to access their sites, when you go to http://www.twitter.com it redirects to https://www.twitter.com/. If an attacker had access to your Internet line, could he or she have the connection running over HTTP with a fake version of Twitter?
If a user nearly never checks for a secure connection on sites, and they type "twitter.com" which first checks "http://www.twitter.com/" and not "https://www.twitter.com/", could an attacker modify the HTTP connection to create a fake Twitter website without the user noticing? I'm assuming browsers try the HTTP version first rather than the HTTPS version first, but if I'm wrong please let me know.