What are the risks of using TLS 1.0 for web applications?

If you don't use ECDSA certificate, and use RSA certificate AND you do not use DHE or ECDHE cipher, then anyone at the Starbucks you are at can view, review, or redirect your request. If you use a RSA certificate, but have DHE or ECDHE turned on, they cannot review your information while at that Starbucks. If none of these are configured correctly, the government (pick any one) can spy on your traffic.

If this stuff is not important to you:

1. you do not have a form on your website
2. you don't care if someone else can track where on your website your visitors click through to
3. you don't accept credit cards on your website
4. you don't care if the government tracks your users access to your site

Then don't even bother with TLS encryption. Just host HTTP stuff.

If this stuff is important to you:

1. You don't want 3rd party tracking your users traffic
2. You don't want a government to monitor and possible block (if content offends that government) your content
3. You care about your users privacy while surfing your site
4. You offer a form for them to fill out and submit
5. You accept credit cards on the site

Then turn on TLS on your website

This version of the SSL protocol, was officially release in late 1995 by Netscape after the discovery of serious vulnerabilities in the previous version (SSLv2). It is, therefore, obsolete, and it contains, as well, various flaws. For instance:

• No support for SHA256, SHA384 and AEAD (Authenticated Encryption with Associated Data) with GCM ciphers.
• No Elliptic Curve (EC) support and therefore no Forward Secrecy (FS).
• More recently, in October of 2014, it's vulnerable to a new attack named POODLE (Padding Oracle On Downgrade Legacy Encryption). Padding Oracle attacks surfaced in 2001 and explore the fact that [only] in CBC (Cipher Block Chaining) mode, the padding is not protected by the integrity validation mechanisms of TLS -- i.e. MAC (Message Authentication Code). A malicious person can, thus, perform a Man-In-The-Middle (MITM) attack and force the downgrade of the protocol version, which some browsers voluntarily accept. This type of protocol negotiation is needed to synchronize both parties.

If the user becomes the victim of a MITM attack, an attacker can simply use the trust that the user has in the server to create a phishing page, and possibly steal their credentials or some other sensitive information from the company.