[humanpuff69]

Plaintext is extremely easy to see . With wireshark i can see the whole webpage and the request . Imagine the user entering a password , the attacker/sniffer can easily know the password

Https solve the problem . Because to acomplish the same thing you need the user to use the custom ceritifcate . If you ever use burp with https you know what i mean

And dns is also plaintext , i can snoop the port 53 tcpdump and get what the user is visiting . This is what your isp mostly see

And with the dns being encrpyted it solve that problem .