One thing I've always found mind-boggling: "HTTPS" When I see HTTPS on a bank's backend/login page, i have the full expectation that what i am entering into th

One thing I've always found mind-boggling: "HTTPS" When I see HTTPS on a bank's backend/login page, i have the full expectation that what i am entering into the page cannot be seen, screen-scraped or intercepted by any third party. i want full encryption ONLY between me and the domain i see in the address bar. The truth of the matter is, 100 third party scripts (cdns, analytics) can be [and usually are] injected from completely unrelated HTTPS domains, and the average user has absolutely no idea because there is never an indication of this from browser UIs. It is such a blatant violation of trust, and it's the norm! I have no explanation except that advertisers insist on having direct access to the user-agent for tracking/click-through accountability.