That little padlock in your browser's address bar? Most people think it means "this site is safe." It doesn't. A phishing site can have a valid certificate and a green padlock. A page designed to steal your credit card details can run over a perfectly legit HTTPS connection. The padlock means one thing: your connection to whoever owns that domain is encrypted. That's it. Nothing about whether the person on the other end is honest.
Developers ship HTTPS by default now. Most of us enabled it once, probably via a one-click option on our hosting provider, and never thought about what it actually guarantees. The assumptions we carry are often wrong, and wrong assumptions about security are worse than no assumptions at all.
HTTP is plaintext. Every header, every cookie, every form body you submit travels as readable text across every network hop between you and the server. The coffee shop router, your ISP, a compromised switch anywhere along the path. All of them can read everything.
But here's the part people forget: they can also modify it in flight. ISPs have literally injected advertisements into plain HTTP pages. Governments have replaced download links with malware. This isn't theoretical.
