Estimates place SSL/TLS use in web traffic at over 60%, and with public sentiment regarding snooping and intercept by both hackers and governments, we should expect that to continue to rise. While it is difficult in practice, it is indeed well worth an attacker's time if the data gleaned is of sufficient value. OWASP's Top 10 list has had Sensitive Data Exposure as a top threat for several cycles, with both the 2013 and 2017 (https://github.com/OWASP/Top10/blob/master/2017/OWASP%20Top%2010%20-%202017%20RC1-English.pdf?platform=hootsuite) iterations ranking it number 6: the most concerning threat to web applications.
In the summary of their Sensitive Data Exposure section (as shown in the following screenshot), it would be much harder if web developers properly configured it and used current technologies and module versions to provide protection...
