Thanks guys, that helps me to understand. This stuff is usually explained either as utterly vague blanket advice or in technical shorthand terms. I think it is really important for people who might barely even know what https is to understand how and why the security of it is limited.