That is pretty sinister actually. Totally something you could do anywhere people get 'free' wifi. If you look at the second answer (https://security.stackexcha

That is pretty sinister actually. Totally something you could do anywhere people get 'free' wifi. If you look at the second answer (https://security.stackexchange.com/a/214877/12942 https://security.stackexchange.com/a/214877/12942) it looks like the GA code Goodreads is using specifically will use http:// http:// instead of https:// https:// if the current page is http-only. So that this would still work. There isn't a good reason to get third-party resources via http if https is available, even on non-https pages.