Is it safe to use HTTP if no sensitive information is being transmitted? [duplicate]

Question

In the interest of security, is it safe to use HTTP (and not HTTPS) on a website where no sensitive information is being transmitted?

On a website that is purely informational, for example, and doesn’t even have the option to make an account.

So the only data being transmitted is publicly available to any attacker waiting to MITM.

The only concern I can think of is data tampering, which could be an issue, but even then I am still not too sure.

May I also add, my question also entails whether this is a responsible choice for the website owner, too, in this circumstance?

Answer 1

No, this is not secure.

First off, which information counts as sensitive is highly subjective. For example, the news sites I'm visiting are entirely public, but that doesn't mean I'm fine with sharing the exact articles I'm reading, let alone allow somebody to observe my behavior on the site over a long period of time and create a profile of my interests. So even information which doesn't seem sensitive at all can at least lead to privacy issues.

Besides that, HTTP allows an attacker to inject arbitrary malicious or illegal content into the responses. There are lots of scenarios where this would cause serious harm:

• If users trust the site (even when they shouldn't), an attacker could try to perform phishing, e.g., set up a fake paywall to get payment data, or collect passwords through a fake registration feature.
• Attackers could spread malware by offering a download or even exploiting browser vulnerabilities that don't require any user interaction.
• If illegal content is injected, this will be a huge problem both for the website owner and its users. The owner may have a hard time proving that this wasn't actually their content, and the user will have to explain how they've ended up accessing the content and possibly storing it in the browser cache.

So HTTPS really is a must for the security of all parties.