Plain HTTP sends everything as readable text. Between you and the server sit dozens of machines — routers, Wi-Fi access points, ISPs. Any of them (call the attacker "Eve") can read every byte. Watch: your login flies across the wire and Eve sees your password in the clear.