9 ms·

"I’ve been speaking with the owner about SSL before I invest in becoming a member, but she’s been told by the dev of the platform (it’s a franchise system calle

"I’ve been speaking with the owner about SSL before I invest in becoming a member, but she’s been told by the dev of the platform (it’s a franchise system called ShopCity.com) that SSL is more about Google’s monopolizing visibility of content, and less to do with security" This is an interesting observation of how Google's technical crusades often align with its profit interests. The main threat that HTTPS everywhere secures against is preventing your ISP from analyzing your traffic in order to build and sell an advertising profile on you. Now, obviously that is something I don't want, so I am all for HTTPS everywhere, but Google already has that profile, so for them HTTPS everywhere is eliminating the competition.

nerdponx 9y ago
Perhaps, but it's fairly easy to un-Google your life nowadays.
- kgbme 9y ago
  Except, it shouldn't take work!.. Like - with cell phones. Until recently, I had no idea that manufacturers actually PAY Google to have the services on Android... Talk about idiocy.
  - annabellish 9y ago
    It doesn't seem like idiocy to gain access to the largest application ecosystem available for their product. I mean, you _could_ go the amazon route, but how's that working out for them? Their mobile platform is not exactly flourishing. An Android device without Google Apps simply isn't going to sell in the millions.
jakub_g 9y ago
I don't want my ISP to inject JavaScript to random pages or analyze my traffic. That should be downright illegal. They should be like water supply company: provide me damn clean water and get out of my way. Somehow the sewage company doesn't analyze my urine (I hope) to figure out if I prefer spicy or sour food and get an extra buck from third parties, and somehow they're still in the business.
- josteink 9y ago
  > I don't want my ISP to inject JavaScript to random pages or analyze my traffic. I haven't seen a single reputable ISP do this anywhere. It would illegal. Is the US really such a third world nation that not even basic regulation like this exist?
  - pritambaral 9y ago
    US Cable companies in the past have injected alerts into unsecured sites users browsed, to tell them they're running out of data. If they could do that, they could inject ads too. US Mobile companies inject identification headers in unsecured HTTP calls, for advertiser tracking; and in other cases allow servers to ping the user's IP back to the ISP to get full details of the user (including addresses). The regulatory agents responsible for regulating the cable and mobile companies in the US are right now hellbent on removing net neutrality and are fighting against the consumer. Fat chance of those "basic regulation"s existing or surviving.
  - FRex 9y ago
    Apparently it's a thing: https://www.infoworld.com/article/2925839/net-neutrality/code-injection-new-low-isps.html https://www.infoworld.com/article/2925839/net-neutrality/cod... https://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-altering-your-web-traffic/ https://blog.ryankearney.com/2013/01/comcast-caught-intercep... https://www.fastcompany.com/3023305/att-offers-discounted-gigabit-internet-in-exchange-for-spying-on-you https://www.fastcompany.com/3023305/att-offers-discounted-gi... https://arstechnica.com/information-technology/2016/09/att-to-end-targeted-ads-program-give-all-users-lowest-available-price/ https://arstechnica.com/information-technology/2016/09/att-t...
  - rwbcxrz 9y ago
    I used to have internet from Cox Communications. One day when I was working from home, I was surprised to see a page in my local dev environment load with an overlay telling me my ISP thinks I have a Windows virus (I didn't own any Windows machines at the time). Turns out our dev environment didn't force CDN assets to load over HTTPS, so my ISP injected some JS into a library we were loading. I tweeted at them, and they not only verified that it came from them, but also that they consider hijacking and modifying my traffic to be a service.
josteink 9y ago
> The main threat that HTTPS everywhere secures against is preventing your ISP from analyzing your traffic in order to build and sell an advertising profile on you. As someone living in Europe, this literally happens nowhere. Because it's illegal. SSL in browser has nothing to do with our ISPs. Stop being US-centric.
- throwaway6845 9y ago
  Yeah, no way that would happen in Europe. Oh wait. http://www.telegraph.co.uk/technology/news/8438461/BT-and-Phorm-how-an-online-privacy-scandal-unfolded.html http://www.telegraph.co.uk/technology/news/8438461/BT-and-Ph...
throwaway2016a 9y ago
> The main threat that HTTPS everywhere secures against is preventing your ISP from analyzing your traffic in order to build and sell an advertising profile on you. That is not true. The main threat it protects against is MitM (man in the middle attacks) that allow someone to redirect all traffic to a website through their machine and thus see all the data including your password. HTTPS when combined with root certificate trust is very effective at preventing these kind of attacks. Without it, using any shared internet at all (such as a company, school, or coffee shop) to log into any website or enter your credit card would be trivially easy to hack. Seriously, I can boot up Wireshark, go to my coffee shop and easily see every non-HTTPS communication going over the network. IM messages, emails, and in cases like this post suggests... passwords too. Edit: As a side note... I do this all the time to reverse engineer the wireless protocol for IOT devices since most of them do not use HTTPS yet. I use it for personal use but it could be used for harm as well. For instance, if the security cameras are IP cameras over HTTP I could probably intercept the password and use it to remotely turn off the cameras.
- oldmandutch 9y ago
  Or MitM and swap out G ads for someone else’s ads?
- revmoo 9y ago
  I'm not sure you understood his point..
- peterwwillis 9y ago
  MitM is blown out of proportion. Afaik, only dns poisoning attacks will result in MitM as effective as phishing or botnets, and poisoning can be mostly-solved with better resolvers. No criminal anywhere cares about your password going over the wire in a coffee shop.
  - zAy0LfpBZLC8mAC 9y ago
    Which is true exactly up to the point where some criminal decides it's an attack worth automating, as with every other attack. The one thing that reduces the likelihood of that happening is to minimize the amount of credentials you could get your hands on using that attack.

nerdponx 9y ago

Perhaps, but it's fairly easy to un-Google your life nowadays.

kgbme 9y ago
Except, it shouldn't take work!.. Like - with cell phones. Until recently, I had no idea that manufacturers actually PAY Google to have the services on Android... Talk about idiocy.
- annabellish 9y ago
  It doesn't seem like idiocy to gain access to the largest application ecosystem available for their product. I mean, you _could_ go the amazon route, but how's that working out for them? Their mobile platform is not exactly flourishing. An Android device without Google Apps simply isn't going to sell in the millions.

jakub_g 9y ago

I don't want my ISP to inject JavaScript to random pages or analyze my traffic. That should be downright illegal. They should be like water supply company: provide me damn clean water and get out of my way. Somehow the sewage company doesn't analyze my urine (I hope) to figure out if I prefer spicy or sour food and get an extra buck from third parties, and somehow they're still in the business.

josteink 9y ago
> I don't want my ISP to inject JavaScript to random pages or analyze my traffic. I haven't seen a single reputable ISP do this anywhere. It would illegal. Is the US really such a third world nation that not even basic regulation like this exist?
- pritambaral 9y ago
  US Cable companies in the past have injected alerts into unsecured sites users browsed, to tell them they're running out of data. If they could do that, they could inject ads too. US Mobile companies inject identification headers in unsecured HTTP calls, for advertiser tracking; and in other cases allow servers to ping the user's IP back to the ISP to get full details of the user (including addresses). The regulatory agents responsible for regulating the cable and mobile companies in the US are right now hellbent on removing net neutrality and are fighting against the consumer. Fat chance of those "basic regulation"s existing or surviving.
- FRex 9y ago
  Apparently it's a thing: https://www.infoworld.com/article/2925839/net-neutrality/code-injection-new-low-isps.html https://www.infoworld.com/article/2925839/net-neutrality/cod... https://blog.ryankearney.com/2013/01/comcast-caught-intercepting-and-altering-your-web-traffic/ https://blog.ryankearney.com/2013/01/comcast-caught-intercep... https://www.fastcompany.com/3023305/att-offers-discounted-gigabit-internet-in-exchange-for-spying-on-you https://www.fastcompany.com/3023305/att-offers-discounted-gi... https://arstechnica.com/information-technology/2016/09/att-to-end-targeted-ads-program-give-all-users-lowest-available-price/ https://arstechnica.com/information-technology/2016/09/att-t...
- rwbcxrz 9y ago
  I used to have internet from Cox Communications. One day when I was working from home, I was surprised to see a page in my local dev environment load with an overlay telling me my ISP thinks I have a Windows virus (I didn't own any Windows machines at the time). Turns out our dev environment didn't force CDN assets to load over HTTPS, so my ISP injected some JS into a library we were loading. I tweeted at them, and they not only verified that it came from them, but also that they consider hijacking and modifying my traffic to be a service.

josteink 9y ago

> The main threat that HTTPS everywhere secures against is preventing your ISP from analyzing your traffic in order to build and sell an advertising profile on you. As someone living in Europe, this literally happens nowhere. Because it's illegal. SSL in browser has nothing to do with our ISPs. Stop being US-centric.

throwaway6845 9y ago
Yeah, no way that would happen in Europe. Oh wait. http://www.telegraph.co.uk/technology/news/8438461/BT-and-Phorm-how-an-online-privacy-scandal-unfolded.html http://www.telegraph.co.uk/technology/news/8438461/BT-and-Ph...

throwaway2016a 9y ago

> The main threat that HTTPS everywhere secures against is preventing your ISP from analyzing your traffic in order to build and sell an advertising profile on you. That is not true. The main threat it protects against is MitM (man in the middle attacks) that allow someone to redirect all traffic to a website through their machine and thus see all the data including your password. HTTPS when combined with root certificate trust is very effective at preventing these kind of attacks. Without it, using any shared internet at all (such as a company, school, or coffee shop) to log into any website or enter your credit card would be trivially easy to hack. Seriously, I can boot up Wireshark, go to my coffee shop and easily see every non-HTTPS communication going over the network. IM messages, emails, and in cases like this post suggests... passwords too. Edit: As a side note... I do this all the time to reverse engineer the wireless protocol for IOT devices since most of them do not use HTTPS yet. I use it for personal use but it could be used for harm as well. For instance, if the security cameras are IP cameras over HTTP I could probably intercept the password and use it to remotely turn off the cameras.

oldmandutch 9y ago
Or MitM and swap out G ads for someone else’s ads?
revmoo 9y ago
I'm not sure you understood his point..
peterwwillis 9y ago
MitM is blown out of proportion. Afaik, only dns poisoning attacks will result in MitM as effective as phishing or botnets, and poisoning can be mostly-solved with better resolvers. No criminal anywhere cares about your password going over the wire in a coffee shop.
- zAy0LfpBZLC8mAC 9y ago
  Which is true exactly up to the point where some criminal decides it's an attack worth automating, as with every other attack. The one thing that reduces the likelihood of that happening is to minimize the amount of credentials you could get your hands on using that attack.