Many companies seem to be determined to defeat encryption via the public use of vanity domains that redirect without supporting TLS on the published domain name

Many companies seem to be determined to defeat encryption via the public use of vanity domains that redirect without supporting TLS on the published domain name. Usually this is for particular marketing campaigns and not the main site, however as long as browers support HTTP only redirects it is a poential risk for many sites (depending on the browser and any other measures they take to avoid such things). US banks have also been training customers to accept redirects to various shady sounding domains as a normal thing so there is a huge variety of domains that could be used to MITM with full TLS and without seeming unusual. Still not trivial to do the MITM and avoid detection. So hopefully that raises the cost to the point that Centurylink and Comcast won't actually do it but they obviously would not have any ethical reservations about doing something like that if it made them more money.