are users vulnerable to a SSLStrip MITM attack if they choose to login from that page?
Yes and no. Users are no more or less vulnerable than they are from clicking on a link in any unsecured page.
All Google logins are processed through
accounts.google.com, which not only has HSTS turned on, but also has its public key pinned in modern browsers. So a MITM on the login page is not practical.
That said, the attacker wouldn't use
accounts.google.com as their phishing domain, they'd use some hacked wordpress site somewhere if history is any indication. So the security of the login page itself can't save everyone.
And in fact the security of
news.google.com isn't particularly relevant either if the user isn't explicitly adding HTTPS to the front; as long as that domain doesn't have HSTS enabled, SSLStrip can work its dirty magic.
And that's kind-of an important distinction: the fact that your site is HTTPS doesn't protect your users against SSLStrip; the whole point of SSLStrip is to demonstrate that serving your site over HTTPS doesn't help users who get to that site from an unsecured link.
HSTS protects users who type your site name into their browser, but even that doesn't protect everyone. Take Facebook, for example, which is SSL and HSTS through-and-through. You might say Facebook's users are therefore protected, but a phishing site isn't going to use
facebook.com as its URL; it'll use the URL of whatever site the attacker hijacked in order to host his attack. Certainly the discrepancy is visible to anyone who checks the URL, but statistically very few people ever do.
So yes, users are vulnerable. Users will always be vulnerable. If you're going to dump money into a solution to protect your users, do this:
- Make the login page HSTS (as Google and Facebook both do) and
- Get visitors to use browser-integrated authentication.
That could be saved passwords, lastpass, Google's U2F device, or any authentication system which will refuse to attempt authentication if the browser has not verified the authenticity of the login page.
If you do those 2 things, users are absolutely protected.