3 ms·
Tell me again what the threat mode TLS protects against for a marketing site? The only thing I can think of is my ISP injecting some HTML at the top of the pag
by josho 6y ago
Tell me again what the threat mode TLS protects against for a marketing site?
The only thing I can think of is my ISP injecting some HTML at the top of the page. Something that I haven’t seen for years.
- nayuki 6y agoLetting the ISP inject stuff is the threat model, and it has happened in real life. https://www.theregister.com/2015/03/27/github_under_fire_from_weaponized_great_firewall/ https://www.theregister.com/2015/03/27/github_under_fire_fro... Every connection that happens over unsecured HTTP is a connection that can be hijacked by middlemen for nefarious purposes, both for spying and for attacking. Encrypting as many connections as possible is a form of herd immunity. Encrypting even unimportant "marketing" websites protects everyone on the web by raising the cost of interception and lowering the benefits.
- jtheory 6y ago100% yes. It's also about the entire internet & its users, not just threat models on specific sites. We can't ask the general public to consider threat models and evaluate what sites should need HTTPS or just HTTP. General, non-technical intuition is basically useless for this eval; it's not a good path. It's much smarter to just make HTTPS the default, make it easy & free for any site to provide it, and then let browsers show big warnings for any site that's not secured. (Browsers are moving this way already)
- ev1 6y agoMy ISP injects HTML and scripting onto the page (US). In many countries MITMing your page and replacing its contents, or using it to serve malware to targets is a frequent case.
- josho 6y agoI had no idea that was still practiced. Thank you for sharing. What is the ISP injecting into page?