There's an endpoint that receives an e-mail and password and creates a user account in an external system. To access that endpoint, one must be logged in to our system as it's the only way for that user account to be created.
To me it looked really bad when I found out that the password was going to be sent without encryption, but I'm not an expert on the subject and I was assured that the communication was safe being sent via https.
Is it? If not, what would be a good solution to this problem?