actually, it is.
HTTP is perfectly fine. [1]
> Anyone can ready / modify what is being sent
Anyone can break a window and enter my house.
But I haven't aired a private army to patroll the windows.
NSA can break HTTPS, TGF exists and China Trusted SSL Certificates are a thing.
False sense of security is often more dangerous than a real sense of insecurity.
Edit: [1] how many of you don't terminate SSL at load balancer?
that's a very bald assumption, my dear friend.
But in practice, yes, it is safe do not care of the possibility that someone is going to inject a script in your blog header, because I am no police officer, I do not work overtime, fighting crime. [1]
Same way I'm not worried that someone is going to steal my car and use it to rob a bank or worse.
> Do you use online banking?
Banks also have guards at the doors.
They handle other people's money, of course they care about it and about the safety of their employees.
Are you a bank?
> Do you care if you transmit your password to your bank account in plaintext?
Not really.
99% of my passwords are passw0rd on websites I really don't care about.
It is much harder, if not impossible, to guess my username.
I bet I am not the only one.
Besides, my bank ask me to confirm any operation in a MFA way.
If they notice something strange, they call me, on my phone, a human calls me.
It's their job.
> Would you really trust a phone number delivered over HTTP?
I've trusted for the majority of my life phone numbers sent unencrypted through wires that everybody could wiretap to and then by email...
Nothing bad ever happened.
Besides, what can happen if you call the wrong number?
I do not believe that the Grudge is a real story.
The point is: no, I am not paranoid.
Common sense is enough 99% of the times.
so has been HTTPS
> HTTPS on your site protects the rest of us from it being used by things like China’s Great Cannon.
I'm not scared by China, I'm scared by the fact that NSA already controls some of the certs in the so called "trusted" authorities, because, you know, "matter of national security" or "patriot act".
Oof, this just reminds me of the whole PRISM thing [0] where NSA was tapping inter-DC fiber links and Google wasn't encrypting (some of) the traffic between DCs
[0] https://slate.com/technology/2013/10/nsa-smiley-face-muscula...
But there's only a few Google around.
Besides, NSA can (and probably already is) collect encrypted streams and then try to break them offline.
Real time is not an hard requirement for them.
if what you are doing doesn't require secrecy, HTTP could suffice.
Imagine you built an app for weather reporting, the app downloads static json from a server using the hardcoded ip address.
HTTPS would add no benefit, worst that can happen is that someone hijacks the ip address (for some of the users, it's not possible to do it worldwide) and point the app to the wrong jsons, that might or might no be valid for the app.
Which is a lot of effort to break a weather app...