5 ms·
Letting the ISP inject stuff is the threat model, and it has happened in real life. https://www.theregister.com/2015/03/27/github_under_fire_from_weaponized_gre
by nayuki 6y ago
Letting the ISP inject stuff is the threat model, and it has happened in real life. https://www.theregister.com/2015/03/27/github_under_fire_from_weaponized_great_firewall/ https://www.theregister.com/2015/03/27/github_under_fire_fro...
Every connection that happens over unsecured HTTP is a connection that can be hijacked by middlemen for nefarious purposes, both for spying and for attacking.
Encrypting as many connections as possible is a form of herd immunity. Encrypting even unimportant "marketing" websites protects everyone on the web by raising the cost of interception and lowering the benefits.
- jtheory 6y ago100% yes. It's also about the entire internet & its users, not just threat models on specific sites. We can't ask the general public to consider threat models and evaluate what sites should need HTTPS or just HTTP. General, non-technical intuition is basically useless for this eval; it's not a good path. It's much smarter to just make HTTPS the default, make it easy & free for any site to provide it, and then let browsers show big warnings for any site that's not secured. (Browsers are moving this way already)