Plain HTTP is a postcard

Alice is at a café, logging in to shop.example over plain HTTP. Her request doesn’t fly straight to the shop. It hops through the café’s Wi-Fi, then her ISP, then more routers on the way.

Every one of those hops can read every byte. So can Eve at the next table, who is copying packets off the open Wi-Fi. Her panel shows exactly what she gets: the email and password, the session cookie, even the card digits and address on the account page.

Plain HTTP is a postcard. Anyone who handles it along the way can read it.