We like to talk about, say, the compromise of integrity and/or authenticity, information leak and so on, but they are not only things TLS/HTTPS was prepared for

We like to talk about, say, the compromise of integrity and/or authenticity, information leak and so on, but they are not only things TLS/HTTPS was prepared for. Indeed, it is often overlooked that we have two kinds of exploitations in this space. I tend to label them as "active" and "passive". One of the best known passive exploitations is a JavaScript injection from ISP---Comcast did it in 2017 [1] for example. They alone are typically harmless or annoying at best, but they are indicative of the real security problem lurking around, and often can evolve into active exploitations. It might be probably true that APT is a simple service that does not require the full TLS capability. But APT is only prepared for active exploitations. Passive exploitations will effectively compromise the availability, by compromising the integrity in the relatively predictable way. I don't think APT is also prepared for passive exploitations---casual users will be much more prone to them. [1] https://forums.xfinity.com/t5/Customer-Service/Are-you-aware/td-p/3009551 https://forums.xfinity.com/t5/Customer-Service/Are-you-aware...