The password anyone on the wifi can read
Your login page lives at an address starting with 'http://'. A learner sits in a coffee shop, opens a free tool that watches the shared wifi, and logs into your site. To their shock, they see their own username and password appear in the tool as plain readable text, right as it leaves their laptop. The data is correct and the login works — but every word of it travels across the network in the open, where anyone nearby can copy it.
You haven't read about this exact system. That's the point — walk the three questions a designer asks: what's really wrong, what fixes it, and what does the fix cost?
Diagnose
Read past the story. What's the REAL problem — not what the feature does, but what's actually going wrong?
Look past the story. What's the REAL problem here?