[sabellito]

How would that work? To my understanding https prevents mitm attacks.

[thrwaeasddsaf]

That assumes you're using https in the first place. Try enter openbsd.org in your browser and see whether you get the https site or not.

[crtasm]

I get the HTTPS site, thanks to the HTTPS Everywhere extension.

[batch12]

There are a few ways one could perform this attack. SSL stripping would be the most transparent. The attacker could also proxy SSL with a different cert. If the cert was invalid the victim would at least be warned. HSTS should mitigate this threat.

[wizzwizz4]

It does. But it doesn't protect against:

User → HTTP connection → [INTERCEPTION] → HTTPS connection → website.