This has been bothering me for a while, but I have noticed that some websites (the first one that comes to mind is XKCD) use HTTPS for no apparent reason. I mean, XKCD is free and accessible to anyone. Why on earth would they encrypt your session when all you're doing is looking at comics? It seems like the cryptography would just consume resources unnecessarily. I'm not asking about XKCD specifically, but have noticed a few websites that do this and am wondering why they would.
One answer is that SSL also prevents/deters MITM (Man-In-The-Middle) attacks. In theory, SSL ensures that the message originated from XKCD and arrived to you without being tampered. A bad actor who can intercept traffic between you and XKCD cannot inject code to run on your machine.
Just based on the comments, being able to inject code to run client side is quite powerful. You can glean a lot of information from this. Furthermore, you can force a client browser to talk to pages/sites that it normally wouldn't.
I do want to note, however, that SSL is not 100% in this case and there attacks such as sslstrip that can work around the fact that SSL is being used.
As CtrlDot said, using TLS (SSL is the older term, no one uses SSL anymore but the name has stuck) is good not only to prevent snooping, but also to prevent MITM attacks which can inject malicious code. Now, some people might be saying that's difficult, but it's in fact not. You can buy off black markets "exploit kits" which are subscription payed self-updating toolkits which you can put in a compromised (or MITMed) or malicious website which will automatically scan a target that connects, assess if they are vulnerable and to what exploits they are vulnerable, then automatically roll out the most effective exploit to take over your computer (cheaper exploit kits just try running every exploit they have in hopes that one will work). The more expensive the exploit kit, the newer and higher quality the exploits they have. The most expensive ones can have 0days which your browser or anti-virus cannot defend against. So do not assume that someone would have to find some rare exploit, because it's already done regularly. To respond to comments from another post saying "So you might be able to get some unprotected files off of an inexperienced user. Everything else can be gathered without going to the trouble of an active attack", the answer is it's easy to get files off an inexperienced user, or even an experienced user (hint hint, experienced users are more likely to use TLS whenever they can). You don't need to be an expert and create your own 0days, you just have to have some money, and lots of people do. And, as has been said already as well, you don't always even need to fully exploit your victim's computer to get what you're looking for...
Also, although he says that sslstrip can bypass TLS, in reality this is not very easy to pull off, all it really does is redirect you to the non-https version (i.e. it's like a remote "HTTPS Nowhere" extension). If you are vigilant and the website uses TLS properly (doesn't use a self-signed certificate, etc.), it should not be an issue.