The websites that serve files over https, can it be considered overkill? or is it a best practice everyone has to follow?
The downside to serving files over HTTPS is that you will lose the caching as far as I've read. But apart from that, the attack scenario I have in mind is either someone accessing the server and manipulating the file which HTTPS doesn't help much to prevent, or someone replacing the file with a malicious one over the air in a MITM scenario which HTTPS can mitigate.
How probable is it to have a MITM scenario where the client goes about downloading a specific executable?
Are there other attacks which HTTPS can prevent?
One other solution some websites use is that they put the checksum of the executable on the website, but most users won't bother to check that or won't even know how to do it.
So to sum it up, is there much gain in serving files over HTTPS (whether a checksum is put on the website along with the file or not) and can serving files over HTTP be considered a huge security flaw?
(The exact scenario in my mind is that a bank is letting the customers download its mobile banking app via its website over http)