I recently visited a website which used to have an HTTPS connection. Now it has just a plain HTTP connection, and the authentication method has changed from user+password to "authenticate with Google account".

I contacted them and asked them why they dropped the HTTPS, and they told me "because now the authentication is secure with Google, so it is not necessary anymore".

Well, I am not an expert in security, but before replying to them, I would like to know: what could go wrong?

So, with my little knowledge, I would say (correct me if I am wrong):


Privacy loss in the communications between client and server (the attacker can read any information exchanged, and that includes personal information that the client may be posting to the server).
An attacker could modify the client's requests, maybe with malicious intentions.
An attacker could read the cookie and use it to get access to the service as if they were the client that originally authenticated using Google's services.


Am I right? What else could go wrong?

You are right, the regression to HTTP is pointless.

Note that all your points apply to one particular kind of attack, where the adversary is able to access the data transport between client and server. That could be the owner of a WiFi hotspot or your ISP acting as a man-in-the-middle, who sits in between you and the server. This can be hard to accomplish for a remote attacker, but is particularly easy on a public WiFi.

What HTTPS adds to HTTP is secure data transport. The web application itself can be completely fine - if you are communicating over an unencrypted channel, the attacker will be able to read, modify and inject arbitrary data into your requests and the server responses. With a captured session cookie, it will also be possible to impersonate you for as long as the cookie is valid.

What the attacker cannot do is take over your Google account or reauthenticate with Google at a later point. This is because the authentication with Google always happens over SSL and the granted token expires after a given time.

So the situation is somewhat better than capturing your credentials straight away. However, as you said, an attacker would still be able to take over the session and perform any action on your behalf.
