If you're not using https, you have no idea if your ISP, or someone e.g. sitting in your cafe, is attacking you.