Note, I'm not asking whether or not I should use an SSL certificate, as I will always use one when possible. Better safe than sorry, but now I'm working on a group chat using a PHP web socket and there doesn't seem to be any way (that I was able to find) to make the web socket work with my existing SSL on the same web app so for now I'm building it without SSL and hoping to find a way to encrypt it later, but this got me thinking...
I understand that this means the data being sent back and forth between the browser and the server is not encrypted, and a hacker could hijack the session which is authenticated for the rest of my web app which is protected by SSL, but I'm trying to get a better understanding as to the actual real life danger of this. For context, my group chat is part of a web app that dog groomers use to track clients, grooms and staff.
What are the odds that a hacker would target my group chat (for example) or any other website not using SSL? Do hackers look for preferred targets? Or will any old site do?
Assuming a hacker was able to intercept my group chat and hijack a session, what would be the purpose? What would a hacker do with such power?
How easy is this? What other hurdles does a hacker have to overcome in order to intercept and read the data being passed between the browser and the server? And is there anything other than SSL that we, as developers, can do to mitigate such attacks?