And MITM is still possible for https, just a bit different with two points of interception, rather than one, see my other comment [1].

[1] https://news.ycombinator.com/item?id=24711111

EDIT: what are the downvotes for? If for disagreement, this only shows how poorly people misunderstand security of https.