4 ms·
Just a few reasons: * To overcome government censorship and surveillance. * To stop internet providers from injecting ads and tracking scripts.
by ash 9y ago
Just a few reasons:
* To overcome government censorship and surveillance.
* To stop internet providers from injecting ads and tracking scripts.
- MikkoFinell 9y ago>To overcome government censorship and surveillance. But the site isn't being censored? Also https won't stop the government from knowing that you connected to those servers. I agree that we want to avoid censorship and surveillance in general, but it really doesn't seem relevant here. >To stop internet providers from injecting ads and tracking scripts. Is your ISP actually doing that to you right now? Or is that just hypothetical?
- hobofan 9y ago> But the site isn't being censored? How do you know? Without https, a MITM-attack might already be in place, and you wouldn't even notice.
- MikkoFinell 9y agoI guess that's a fair point.
- artpar 9y ago> Is your ISP actually doing that to you right now? Or is that just hypothetical? Yes there are multiple instances where my isp was injecting stuff. More frequently at public wifi spots.
- eadmund 9y ago> Is your ISP actually doing that to you right now? Or is that just hypothetical? I was on a Southwest flight earlier this week which did exactly this, using HTTP injection to display an overlay on every HTTP page. It's certainly useful to provide flight information (or Amber alerts, weather information, billing alerts), but it's Just Wrong™ to violate the integrity of a communication to do so. Perhaps there should be some standard protocol for ISPs to send messages to clients, permitting the connected OS to determine how to display them?
- djsumdog 9y agoI can't remember which country it was, but it was either a Vodaphone or O2 sim which would inject their little banner at the top of websites that weren't HTTPS. It was super annoying, especially seeing it on my own site!
- mbrock 9y agoA café I go to sometimes for coffee injects ads to non-HTTPS websites. Full screen ads with a timer. It's a good reminder that HTTP sites can be and are being arbitrarily manipulated and surveilled by WiFi operators.
- hackmiester 9y agoMy ISP, WideOpenWest, uses HTTP injection as their primary method for notifying customers of maintenance, etc.
- mrob 9y agoIt wouldn't stop surveillance, because there are only a limited number of pages it can serve. It's possible for an attacker to download all of them and figure out what you're reading by traffic analysis.
- creatonez 9y agoA monumentally more difficult task than intercepting an unencrypted connection.