4 ms·

What if I visit your roof repair guy's site and content is injected, informing me that they now take payments online? Or that I can download their special Roof

What if I visit your roof repair guy's site and content is injected, informing me that they now take payments online? Or that I can download their special Roof Repair App to manage my bookings? Or it contains an exploit payload? It is extremely uncommon for me to actually visit an HTTP website - I even have HTTPSEverywhere block them by default, so I'd know if I were. That means that I am relatively protected to such avenues until I visit your roof repair guy's website.

DenisM 6y ago
If I was the bad actor I would simply purchase google ads in the name of the target business sending traffic to my own site with wonderful green padlock - it's cheaper and has bigger reach than trying to hijack TCP/IP traffic. More to the point - if I am running a collection of Karl Marx works it is highly unlikely that he would request payments.
- staticassertion 6y ago
  You're describing a completely different attack vector, which is the entire point - to push attackers to different attacks. if we eliminate HTTP, we can focus more effort on the attacks you're describing. Regardless of the content, hijacking is a danger to users.
  - DenisM 6y ago
    It's worrisome that you injected yourself into the conversation between me and my users. How is this any of your business?
    - CydeWeys 6y ago
      Because he might be a user too. And are you blocking all Web traffic except from people who your users, somehow? If not, then everyone is your user.
    - staticassertion 6y ago
      I don't really understand your point. You're upset because I am advocating for your users despite not being one? I... don't care at all. It isn't my business so I've done nothing to reach out to your users or interfere in your website. We're having a discussion about technology on a technical forum. It is the browser developers' business though since they are tasked with protecting users from these specific threats.

DenisM 6y ago

If I was the bad actor I would simply purchase google ads in the name of the target business sending traffic to my own site with wonderful green padlock - it's cheaper and has bigger reach than trying to hijack TCP/IP traffic. More to the point - if I am running a collection of Karl Marx works it is highly unlikely that he would request payments.

staticassertion 6y ago
You're describing a completely different attack vector, which is the entire point - to push attackers to different attacks. if we eliminate HTTP, we can focus more effort on the attacks you're describing. Regardless of the content, hijacking is a danger to users.
- DenisM 6y ago
  It's worrisome that you injected yourself into the conversation between me and my users. How is this any of your business?
  - CydeWeys 6y ago
    Because he might be a user too. And are you blocking all Web traffic except from people who your users, somehow? If not, then everyone is your user.
  - staticassertion 6y ago
    I don't really understand your point. You're upset because I am advocating for your users despite not being one? I... don't care at all. It isn't my business so I've done nothing to reach out to your users or interfere in your website. We're having a discussion about technology on a technical forum. It is the browser developers' business though since they are tasked with protecting users from these specific threats.