4 ms·
Does this apply to ad networks as well?
by fun2have 15y ago
Does this apply to ad networks as well?
- cperciva 15y agoDepends how you insert the ad code into your website; but probably, yes.
- hendi_ 15y agoIf the ad code is inserted via JavaScript, then yes, the problem is real. Most ad code is inserted via JS, e.g. Google's AdSense. But according to https://www.google.com/adsense/support/bin/answer.py?answer=10528 https://www.google.com/adsense/support/bin/answer.py?answer=... AdSense isn't available over https, so this specific problem of forged SSL certs does not apply here. But if you embed non-SSL code in your httpS page (and I assume that most users just ignore the message that would popup in this case, alerting them that non-SSL code is loaded into the "secure" site) there's no need to do that: just do the MitM attack.
- troels 15y agoYes, certainly. This is a constant battle I'm having with marketing/seo people. "Just drop this code into all your pages". Not that I can present much alternative, so I end up caving in ..