I need to purchase a few items (t-shirts, dvds, etc.) on an old e-commerce website that hasn't been updated in a while and doesn't use HTTPS to encrypt data in transit. The website does not have any authentication mechanism implemented, you can't create an account on the website. It only allows you to browse for products and add items to a shopping basket. The shopping basket section displays the total price of your items and also provides a way to calculate your shipping costs based on your country and zip/post code. All this information is not encrypted as the entire website uses plaintext HTTP.
I can't enter payment information on the website and complete my checkout process. The website has only one method of payment - 'Pay with Paypal'.
As soon as I click the 'Pay with Paypal' button I get redirected to the secure PayPal website where I can login and make a purchase. Note: I haven't actually tried to login into PayPal as I was worried that login/checkout information would be somehow returned to the main HTTP website unencrypted at a later stage. I also don't know if I make a purchase via PayPal, the checkout and the transaction stages will be completed on the PayPal website rather than on the main HTTP website.
The question I have is as follows:
Would it be safe for me to purchase items on that website given the fact that no sensitive information (apart from the total cost of items in the shopping basket and shipping costs) is stored on the website, and the entire checkout process seems to happen only on the secure PayPal website (not 100% sure though as I haven't actually made a purchase via PayPal yet)?
Would you purchase a product on such a website and pay with PayPal without worrying that your information could be compromised by a man-in-the-middle attacker?