Unencrypted HTTP protocol does not protect data from being modified or intercepted. Without a secure connection, the user could be tracked and monitored, deanonymizing them. However, the Tor browser does not enable by default HTTPS connections after installation. It's only advised to make sure that the user is using an HTTPS connection in the Tor Project manual. Some users may not realize this and this could potentially expose them. The HTTPS Everywhere addon already comes pre-intsalled and it contains an option to block unencrypted requests. So why isn't this enabled by default or why isn't the Tor browser blocking HTTP connections without using the addon?
It's not enabled by default because it would block a significant fraction of the Internet for users. Blocking HTTP-only traffic will likely come in the future once Tor Browser is using a version of Firefox with HTTPS-only mode, and once the developers feel they can do it while minimizing the usability impact (for example providing documentation to explain why it was blocked, allowing the user to bypass the block, etc).
Edit: The Tor Browser now uses HTTPS-only mode on desktop by default: https://blog.torproject.org/new-release-tor-browser-115/
Starting in Tor Browser 11.5, HTTPS-Only Mode is enabled by default for desktop, and HTTPS-Everywhere will no longer be bundled with Tor Browser.
Why now? Research by Mozilla indicates that the fraction of insecure pages visited by the average users is very low – limiting the disruption caused to the user experience. Additionally, this change will help protect our users from SSL stripping attacks by malicious exit relays, and strongly reduces the incentive to spin up exit relays for Man-in-the-Middle attacks in the first place.
10% out of 1 billion of web sites is not chicken feet's 100.000 millions users say "go **** (away) Tor for good". Never mind this is up to me to keep my data, passwords etc. protected and as bad it is Google making you jump every time its turn on music, now Internet Community have to deal with overzealous developers who are believing they have to help us to be protected as if we don't know how to do so if we needed. Yes our website uses HTTP and NO we don't have nothing to protect. No passwords, no pay system nothing that need even basic inscription in which case while Tor crowed thinks they doing us a favor, 100.000 millions of Internet users removing Tor from their devices.
The answer is - actually - inside the Tor network design. It is safe to use plaintext protocols, including HTTP, when you're using a hidden service, because the encryption part is already done by Tor. The only two reasons to use HTTPS via Tor are:
- Utilizing HTTP/2.0 multi-pipe architecture. By design HTTP/2.0 can not work inside a simple plaintext HTTP
- Using client certificates as an authentication token by exporting the environment variables via standard HTTP or email services. It's quite a handy tool, especially when properly integrated with PKI infrastructure
So it's totally not up to the tool - like Tor Browser - to think for/instead-of the user that is using it.