There's this game at http://slither.io which I like to play. Only inputs that I give to it are space bar, and cursor location.
It's not https. Are there any risks?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Depends on how you connect to the server. If you are in your own home, then the likelihood is not very big. It's a risk still, don't get me wrong, but I don't want to cause unnecessary paranoia.
On the other hand, if you connect to a public access point (e.g. "free McDonald's Wifi"), then the chance of this happening is much much higher.
Since there is no sensitive data there, the "usual" things like credential stealing or session hijacking are not applicable. However, depending on how determined the attacker is, they might redirect you to other malicious domains, exploit browser vulnerabilities, get you to download stuff or even get you to disclose credentials for other services (e.g. "Log in with your Google, Twitter or Facebook account to play").
As Eilon has pointed out in the comments, another potentially unwanted side-effect is that your ISP can tamper with the website you use. Some ISPs do this for arguably benign purposes, such as stripping whitespace off the HTML document before sending it to you, while others do more "intrusive" changes, such as compressing images, or even injecting advertisements into the website. While this is not a security-risk per se, it is unwanted behavior that can most effectively be combatted by using HTTPS.
That depends completely on your risk appetite and whether or not the upsides outweigh the downsides for you personally.
One crude but effective approach for phishing is to wait for when the tab has become inactive, and then redirect to a spoofed phishing page saying something like 'Your e-mail/facebook/whatever session is expired, please log in again' - if the user has many stale tabs (and many do), then they can legitimately believe that they actually did have that service open there, and that it did just expire, and enter their credentials there.
It's worth noting that all these are things that can be done by any website you visit - so the usage of http does not create an additional risk compared to visiting a https page that's hosted by someone you don't trust. So if you feel comfortable opening random links on the internet containing fun stuff, then this is within your risk profile; but if you'd want to limit your browsing to specific well-known, somewhat trusted sites, then the usage of http means that perhaps you'll get not necessarily the site you intended but someone impersonating that.
https is used to encrypt data such as credit card information or other sensitive data, it is always possible that somebody could be a man in the middle and record your mouse movements but i don't think this should be a cause for concern, what can an attacker possibly do knowing you moved your mouse around in a partcular way? i doubt anybody would waste their time to do that. You certainly should not put personal information into it due to it being unsecure though. This game is also an app that gained some popularity some years ago if it makes you feel any better.