The bad guy could be your evil sister on your home network. It could be anyone in your university. What if they replaced the like button under your cat photo wi

The bad guy could be your evil sister on your home network. It could be anyone in your university. What if they replaced the like button under your cat photo with a like button for something evil? Or what if they put their own ads and tracking scripts into the page to make themselves some money? Lots of ISPs already do that on HTTP pages, so it's not just a hypothetical.