3 ms·
Without HTTPS, any MitM could inject ads, malware, or simply manipulate any content on your blog. TLS isn't just useful to encrypt private data, it also makes s
by pfg 11y ago
Without HTTPS, any MitM could inject ads, malware, or simply manipulate any content on your blog. TLS isn't just useful to encrypt private data, it also makes sure what you see is what the site owner wanted you to see. With http/2, the overhead is minimal and with TLS 1.3 it might soon be gone completely (since it's probably going to add a mode that avoids multiple round trips for the initial TLS handshake; encryption itself isn't really an issue nowadays with AES-NI, etc.)
- Someone1234 11y agoAnd this isn't a theoretical threat either, actual ISPs have been injecting adverts, trackers, and other content into third party websites. Even in the US. See: http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-for-hs-ok/ http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-f... http://www.infoworld.com/article/2925839/net-neutrality/code-injection-new-low-isps.html http://www.infoworld.com/article/2925839/net-neutrality/code... http://www.makeuseof.com/tag/two-ways-your-isp-is-spying-on-you-and-how-to-be-safe/ http://www.makeuseof.com/tag/two-ways-your-isp-is-spying-on-...
- pjbrunet 11y agoYes I'm aware of that. But guess what, ISPs no longer do that because they were sued and lost.
- Someone1234 11y agoThey still do that, they haven't be sued, and they haven't lost. One of those articles is from May this year. And as far as I know they're still injecting trackers into the HTTP headers of mobile traffic to this day. It is opt out.
- pjbrunet 11y agoYes they have been sued. I'm only responding because I'm getting more downvotes. This isn't the best example, just the first thing I found in Google http://www.zdnet.com/article/nebuad-isps-named-in-class-action-lawsuit/ http://www.zdnet.com/article/nebuad-isps-named-in-class-acti... they settled for 2.4 million. https://en.wikipedia.org/wiki/NebuAd#Class_action_lawsuit https://en.wikipedia.org/wiki/NebuAd#Class_action_lawsuit I'm not going to waste my Friday night looking up old lawsuits to save a few HN reputation points. But I can tell you, I remember first reading about this stuff ~1999 when ISPs wanted to get their content in front of the Internet, but I don't remember the exact details. I've been following Boardwatch, WIRED, Techdirt, Digg, Slashdot, TechMeme and TechCrunch since then and consider myself relatively informed. I thought we were beyond this by now, 15 years later, but apparently I was wrong!
- pjbrunet 11y agoOK Someone1234, I was not aware of that. So what ISPs should we avoid now?
- Someone1234 11y agoComcast for one. But to be honest any or all of them could turn "bad" and you wouldn't even know it. That's what HTTPS offers us, assurances.
- simoncion 11y agoPro tip: If the "reply" thingie on a comment is missing, click on the comment's timestamp to load the comment itself and a reply thingie will appear.
- pjbrunet 11y agoGood to know, thanks.
- deleted 11y ago[deleted]