@crytonaut - close to either endpoint, the user or the intended server. You just need to present a forged certificate and you have instant MITM. Pretty much every hacker group, government and large corporation has the resources to accomplish this. The reason I suggested the benefits for this site are few is because really, who would be doing this, and why?
But an example of a really common attack, regardless of HTTPS is to send the victim back a fake response to their DNS query. The user's machine accepts whatever comes back first, so on an unsecured Wi-fi network in starbucks, even a script kiddie can do it without even understanding what they do. Having received the fake DNS data the victim happily goes off to a fake website and enters their password.
Having said that, you have it exactly right in saying it's better to send all data encrypted. Always. Email and IM too. In the near future all these forum posts will likely be encrypted in transit. Even if you guys don't implement it with HTTPS, we will soon be able to do it in an even safer way! thanks to projects like OK Turtles
So much more to say about this topic, so stay tuned y'all and don't change that channel.
