I recently visited a website which used to have an HTTPS connection. Now it has just a plain HTTP connection, and the authentication method has changed from user+password to "authenticate with Google account".
I contacted them and asked them why they dropped the HTTPS, and they told me "because now the authentication is secure with Google, so it is not necessary anymore".
Well, I am not an expert in security, but before replying to them, I would like to know: what could go wrong?
So, with my little knowledge, I would say (correct me if I am wrong):
- Privacy loss in the communications between client and server (the attacker can read any information exchanged, and that includes personal information that the client may be posting to the server).
- An attacker could modify the client's requests, maybe with malicious intentions.
- An attacker could read the cookie and use it to get access to the service as if they were the client that originally authenticated using Google's services.
Am I right? What else could go wrong?