5 ms·

Without HTTPS, whoever owns the LAN you use, its ISP, and various intermediary networks can easily track everything that appears in your web browser by reading

Without HTTPS, whoever owns the LAN you use, its ISP, and various intermediary networks can easily track everything that appears in your web browser by reading the same traffic your browser reads.

acdha 10y ago
This is more than a hypothetical concern, too: back in 2011 a number of ISPs came under fire for hijaacking certain search keywords[1], Comcast has injected ads into hotspot traffic[2], and Andreas Gal has alleged that smaller search engines were buying aggregate Google search result data from ISPs trying to improve their result quality[3]. All of that is impossible with HTTPS. 1. https://www.eff.org/deeplinks/2011/07/widespread-search-hijacking-in-the-us https://www.eff.org/deeplinks/2011/07/widespread-search-hija... 2. http://arstechnica.com/tech-policy/2014/09/why-comcasts-javascript-ad-injections-threaten-security-net-neutrality/ http://arstechnica.com/tech-policy/2014/09/why-comcasts-java... 3. https://andreasgal.com/2015/03/30/data-is-at-the-heart-of-search-but-who-has-access-to-it/ https://andreasgal.com/2015/03/30/data-is-at-the-heart-of-se...
- hackuser 10y ago
  Thanks. And even those issues underplay the magnitude of the problem. Look up Deep Packet Inspection, for example. It doesn't take much to read and record the content, and nothing stops them from doing it in the U.S. (AFAIK).
- chebucto 10y ago
  Your mention of how it was 'impossible with HTTPS' to inject ads into web traffic made me recall how, two years ago, Lenovo shipped laptops with software ('Superfish') that injected ads into encrypted webpages: http://www.theregister.co.uk/2015/02/19/superfish_lenovo_spyware/ http://www.theregister.co.uk/2015/02/19/superfish_lenovo_spy... Lenovo got approximately $250,000 for installing the malware: http://www.forbes.com/sites/thomasbrewster/2015/02/27/lenovo-got-very-little-from-superfish-deal/#c645206f5ce4 http://www.forbes.com/sites/thomasbrewster/2015/02/27/lenovo...

Without HTTPS, whoever owns the LAN you use, its ISP, and various intermediary networks can easily track everything that appears in your web browser by reading the same traffic your browser reads.

acdha 10y ago

This is more than a hypothetical concern, too: back in 2011 a number of ISPs came under fire for hijaacking certain search keywords[1], Comcast has injected ads into hotspot traffic[2], and Andreas Gal has alleged that smaller search engines were buying aggregate Google search result data from ISPs trying to improve their result quality[3]. All of that is impossible with HTTPS. 1. https://www.eff.org/deeplinks/2011/07/widespread-search-hijacking-in-the-us https://www.eff.org/deeplinks/2011/07/widespread-search-hija... 2. http://arstechnica.com/tech-policy/2014/09/why-comcasts-javascript-ad-injections-threaten-security-net-neutrality/ http://arstechnica.com/tech-policy/2014/09/why-comcasts-java... 3. https://andreasgal.com/2015/03/30/data-is-at-the-heart-of-search-but-who-has-access-to-it/ https://andreasgal.com/2015/03/30/data-is-at-the-heart-of-se...

hackuser 10y ago
Thanks. And even those issues underplay the magnitude of the problem. Look up Deep Packet Inspection, for example. It doesn't take much to read and record the content, and nothing stops them from doing it in the U.S. (AFAIK).
chebucto 10y ago
Your mention of how it was 'impossible with HTTPS' to inject ads into web traffic made me recall how, two years ago, Lenovo shipped laptops with software ('Superfish') that injected ads into encrypted webpages: http://www.theregister.co.uk/2015/02/19/superfish_lenovo_spyware/ http://www.theregister.co.uk/2015/02/19/superfish_lenovo_spy... Lenovo got approximately $250,000 for installing the malware: http://www.forbes.com/sites/thomasbrewster/2015/02/27/lenovo-got-very-little-from-superfish-deal/#c645206f5ce4 http://www.forbes.com/sites/thomasbrewster/2015/02/27/lenovo...