Man in the middle is just someone on the wire
Hostile WiFi, certificate warnings, and why clicking through a padlock alert is volunteering.
Man in the middle is a boring attack with a dramatic name. Someone sits between you and the server and reads or changes the traffic. In the modem days it was a tap. On a café WiFi it is a fake hotspot or a hostile access point. On a company network it might be a proxy you agreed to.
What they can see without HTTPS
Anything in the clear: passwords on old forms, mail on old POP, telnet, “http://” pages. The contents are readable. The fix the industry settled on is TLS, the thing behind the padlock. The café sees a connection. It should not see the password.
A padlock on a phishing domain still encrypts. You are in a private tunnel to the wrong building. Look at the name, not only the icon.
What a warning is for
Browsers scream when the certificate does not match or is expired or is signed by nobody they trust. Clicking through that warning on a bank site is how you volunteer for a middle. There are boring reasons a cert breaks: clock wrong, captive portal, hotel gateway. There is also a hostile reason. If you did not expect a warning, do not continue.
Public WiFi plus a VPN is the old travel kit: the tunnel starts before the hostile network can read much. HTTPS alone is a lot. The VPN is for DNS, for older apps, and for hiding the IP the sites see.
Corporate middleboxes
Some workplaces install their own certificate on your laptop so they can inspect HTTPS. That is a middle on purpose. It is a policy choice, not a bug. A personal laptop used for work mail should not also be the family shopping machine if you do not like that inspection. Separate profiles or separate devices. Old advice. Still clean.
You will not outsmart a determined tap on a network you do not control. You pick networks more carefully, you keep TLS, you do not bypass warnings, and you assume a stranger can see that a connection happened even when they cannot see the body.