3 ms·

>HTTPS prevents ads/trackers/malware being injected into the page by unscrupulous ISPs. If you are in a legal/political environment that allows active attacks

>HTTPS prevents ads/trackers/malware being injected into the page by unscrupulous ISPs. If you are in a legal/political environment that allows active attacks by an ISP on their customers then you have a much bigger problem than just this sort of thing.

xahrepap 5y ago
Comcast in the US has injected content into non-secured pages to notify customers of things. That is a horrible business practice that should not be allowed. What can I, an individual with nearly zero political clout (I can vote... but I live in a gerrymandered district... another layer to the problem!) do to get this problem fixed? Best case scenario, I say something, it goes viral, people march in protest against bad ISPs, the monopolies get broken up, etc. But how long does that all take? Meanwhile, I'll only use HTTPS websites as a first-line of defense. The "much bigger problem" can be solved in parallel.
gsich 5y ago
"you" and clients connecting to your server might be different entities.
joshuajill 5y ago
"It is in fact quite possible – and quite common – for a firewall or other device in your network path to terminate your TLS connection with a website and then re-create a TLS connection from the device to your browser." https://www.internetsociety.org/resources/deploy360/dane/ https://www.internetsociety.org/resources/deploy360/dane/ Isn't it then possible, albeit harder to do a MITM attack at this point with HTTPS?
- tialaramex 5y ago
  If you've decided that you trust the "firewall or other device", perhaps because you purchased it, or because doing so is a condition of employment, then you get to keep both halves. If the "firewall or other device" tries to interpose when you don't trust it, that won't work, for the same reason it doesn't work for bad guys. We do not distinguish the apparent reason for attempts to destroy the confidentiality, integrity or authenticity promises in TLS, whatever the apparent motive your HTTP transaction will either work, delivering those promises or you get an error and no progress is made.
NikolaNovak 5y ago
This has happened in both USA & UK; in Toronto Canada, my top-2-in-the-country ISP has hijacked DNS, hijacked 404, and injected "helpful ads" at times. Every time there was a substantial backlash, but that came in on the nerds + grassroots level, not because of pre-existing laws.

xahrepap 5y ago

Comcast in the US has injected content into non-secured pages to notify customers of things. That is a horrible business practice that should not be allowed. What can I, an individual with nearly zero political clout (I can vote... but I live in a gerrymandered district... another layer to the problem!) do to get this problem fixed? Best case scenario, I say something, it goes viral, people march in protest against bad ISPs, the monopolies get broken up, etc. But how long does that all take? Meanwhile, I'll only use HTTPS websites as a first-line of defense. The "much bigger problem" can be solved in parallel.

gsich 5y ago

"you" and clients connecting to your server might be different entities.

joshuajill 5y ago

"It is in fact quite possible – and quite common – for a firewall or other device in your network path to terminate your TLS connection with a website and then re-create a TLS connection from the device to your browser." https://www.internetsociety.org/resources/deploy360/dane/ https://www.internetsociety.org/resources/deploy360/dane/ Isn't it then possible, albeit harder to do a MITM attack at this point with HTTPS?

tialaramex 5y ago
If you've decided that you trust the "firewall or other device", perhaps because you purchased it, or because doing so is a condition of employment, then you get to keep both halves. If the "firewall or other device" tries to interpose when you don't trust it, that won't work, for the same reason it doesn't work for bad guys. We do not distinguish the apparent reason for attempts to destroy the confidentiality, integrity or authenticity promises in TLS, whatever the apparent motive your HTTP transaction will either work, delivering those promises or you get an error and no progress is made.

NikolaNovak 5y ago

This has happened in both USA & UK; in Toronto Canada, my top-2-in-the-country ISP has hijacked DNS, hijacked 404, and injected "helpful ads" at times. Every time there was a substantial backlash, but that came in on the nerds + grassroots level, not because of pre-existing laws.