User data encryption in requests to endpoint

I hope i'm not the first one to encounter this, but i think its critical. When we for example create or login an user, are we sending this data in plain text to our drupal endpoint? In some countries this is even illegal.

I think that a https connection between the app and the endpoint would be the solution, but what happens when this is not an option? are we sending users passwords in plain format and readable by anyone?

Hope anyone can answer this

Regards,