Untrusted TLS does not mean that nobody else in the coffee shop is snooping on it. That Starbucks access point you've connected to might actually be the Pineap

Untrusted TLS does not mean that nobody else in the coffee shop is snooping on it. That Starbucks access point you've connected to might actually be the Pineapple belonging to the guy at the corner table, and he's injecting his own untrusted SSL certs into your HTTPS traffic and snooping/injecting into all your traffic. EDIT - and to clarify what others have said: HTTPS implies a trusted connection (unlike plain HTTP). And a self-signed certificate cannot be trusted under any circumstances.