TL;DR: HTTPS is kind of stupid, as implemented by the current internet.
Let me start by describing for the uninitiated what HTTPS is. HTTPS is just HTTP (HyperText Transfer Protocol), but modified slightly to encrypt as much of the communication as possible (the extra "S" is for "Secure"). HTTPS achieves its encryption using TLS (Transport Layer Security), a system which requires multiple network passes and involves a third party, the Certificate Authority.
Needless to say, this incurs a considerable amount of complexity and is considerably slower (due to the extra network passes). What exactly do we buy for this price?
Well if we're doing something that involves sending sensitive information, for example credit card details to some kind of online shop, we get quite a lot! We get reasonable certainty that our sensitive credit card info is not accessible to any theoretical listeners-in. Obviously, in cases like this, the complexity and latency are worth it.
Now let's consider another kind of case: reading someone's tech blog. Mine, for example! What does HTTPS get us here?
We get... basically nothing. The only detail that actually gets hidden by HTTPS is which pages we're asking for. The data we get back is already public, so encrypting it achieves nothing. We have to run more code and need more network passes, for only that tiny benefit. So then why do modern web browsers treat HTTPS how they do?
According to browsers like Firefox or Google Chrome, HTTP is dangerous and untrustworthy. Think of the "attackers"!! But as you can see above, this is nonsensical in many (most?) situations. The assumptions underlying these browsers' stance here seem to be:
The assumptions that underly the design of a system tend to be self-fulfilling. So both of these assumptions are deeply problematic. Literacy Crisis <3 I feel comfortable throwing their way of doing things squarely in the trash.
Here's what I think: For "read-type" or "public" use cases, HTTP should be used. TLS is simply unnecessary for these cases, while introducing Noticeable latency. For "write-type" use cases, HTTPS is necessary. The additional delays and complexity are worth it when the user is actually doing things that would be dangerous to do over plaintext.
This way of doing things discourages other evils of the modern internet, like requiring accounts for everything or using cookies to stalk users wherever they go.
Let's try to make something different, together :)