That opens you up to any active attacker simply stopping traffic. You&#x27;re usually safe against passive attacks if the network has no glitches, but completely vulnerable to active attacks.<p>Then again, if you don&#x27;t use https on the whole site, active attacks could already simply change the url of the iframe to be http and intercept that with sslstrip, and passive attacks could already steal cookies.