5 ms·
HTTPS does prevent this. This can only be injected on non-secure connections.
by singlow 9y ago
HTTPS does prevent this. This can only be injected on non-secure connections.
- shrimp_emoji 9y agoUse HTTPSEverywhere on your browsers, and then enjoy the "You're close to your monthly limit!" pop-up on the Steam Store!
- yjftsjthsd-h 9y agoWhat?
- charleslmunger 9y agoI think the intent was to comment that extensions don't protect programs with embedded web views, like the steam store. I'd hope the steam store is using https though...
- GranPC 9y agoOnly on checkout pages. For the rest of the storefront they actually redirect you from HTTPS to HTTP.
- charleslmunger 9y agoThat's especially bad, because you can't actually see the origin or whether TLS is in use from the store's interface...
- markbnj 9y agoUm, I assume the code for that pop-up is rendered into the page on the web server that produced the page, before being returned to the browser.
- Crespyl 9y agoThat is precisely the problem. If the notification were rendered as part of the page by the web server, no one would have issue with it (though it would likely be blocked by adblockers anyway). It's the fact that the ISP is modifying traffic in-route, to inject something that was never intended to be part of the page, that is the problem. I expect my ISP to be a neutral carrier of messages, not meddling and altering my mail to add whatever they happen to feel like adding today.