I am running a Seafile Open Source Cloud server (v 4.0.6) on my Raspberry Pi 2. Currently it is set up to simply run without HTTPS or even a domain name on [myIP]:8000. I am also running an Apache web server on the RPI2 with HTTPS. I wanted to know what are the security risks of running and allowing users to access and sign up for this Seafile cloud server without the safety of HTTPS.
Basically, a man-in-the-middle attack could occur.
If someone were to listen in on your users when they submit their username and password, that person would be able to retrieve their login credentials.
Any decent network password sniffer could easily pull this off.