Can you explain how that matters? I mean, isn't every service you use on HTTPS these days?

Fun thing to do: block all http traffic (or even block all but https) and try to work for a day or two.

That's the best way to see how many services still relies on http at least partially.

... unfortunately

I hope it will get better and soon we all will be able to do that

Sites using HTTPS are still vulnerable on a public WiFi access point if you don't use a VPN. To give an example, an attacker can perform session hijacking:

https://scotthelme.co.uk/advanced-session-hijacking/

That’s sites not using HSTS and where the user is not paying attention

I’d argue people who are thinking of using a VPN wouldn’t fall for this kind of attack.

> "where the user is not paying attention"

What signs should the user be paying attention to?

The https lock logo. If it is there the interception mentioned in the link is impossible.

How so? Effectively with a MITM attack the attacker becomes a router. Users don't connect to sites directly, the attack can be made transparent at the user level.

The only way one can MITM an https connection is by terminating the https connection at the level of the attacker and presenting an http connection to the user, hoping he won't notice the absence of the green https lock.

The attacker cannot serve to the victim a valid certificate for facebook.com unless the facebook.com private key or a CA has been compromised.

Alternatively the attacker could try a close enough domain (facebooks.com, or something) that it controls and for which it can get valid certificates, and redirect the victim hoping the user won't notice the slight difference in domain name.