> HTTPS is for attacks. You are always under attack on the internet. This isn't really hyperbole. While I'm sure it's possible to find the occasional exceptio

> HTTPS is for attacks. You are always under attack on the internet. This isn't really hyperbole. While I'm sure it's possible to find the occasional exception, you really need to assume all internet traffic could be hostile. - Verison vandalizes most of the plaintext HTTP by adding their X-UIDH[1] tracking-id header. - I's common to see Javascript appended to HTML files when they are sent over HTTP on a cellular network. (it replaces images URLs with a very highly compressed version). - If the HTTP socket intersects Great Firewall, more injected Javascript might conscript your browser into the Great Cannon[2]. (also: the "QUANTUJM" suite of tools that use packet races for similar purposes) - One of the goals is the privacy of the readers. Google isn't the only attacker, and MitM is only one type of attack. If you aren't encrypting, your requests being analyzed - probably several times - with DPI[3]. If you aren't encryption, you are enabling passive surveillance. That's just some of the obvious stuff. [1] https://www.verizonwireless.com/support/unique-identifier-header-faqs/ https://www.verizonwireless.com/support/unique-identifier-he... [2] https://citizenlab.org/2015/04/chinas-great-cannon/ https://citizenlab.org/2015/04/chinas-great-cannon/ [3] https://en.wikipedia.org/wiki/Deep_packet_inspection https://en.wikipedia.org/wiki/Deep_packet_inspection