4 ms·

>While this push for security is good for protecting modern communication, there is a whole web full of information and services that don’t need to be secured

by kgeist 4y ago

>While this push for security is good for protecting modern communication, there is a whole web full of information and services that don’t need to be secured It's not only about security. I wonder if it happens in other countries too - here in Russia ISPs used to inject advertisements directly into HTTP traffic which was very annoying and now they inject propaganda justifying the war. Fortunately very few sites use HTTP nowadays compared to 10 years ago, so I haven't seen such ads in a while.

bongobingo1 4y ago
Comcast used to do this, Verizon too I think (as well as DNS hijacking).
- zrail 4y ago
  Ugh DNS hijacking is the worst. One of the big residential ISPs for a time would trap NXDOMAIN and redirect to a damn search page with ads. So gross.
nicoco 4y ago
The author is aware of this. At the bottom of the article: > Please don’t contact me to “well ackchyually” me and explain MITM attacks and how your terrible ISP inserts ads into your unencrypted web pages
- tadfisher 4y ago
  ... which in no way addresses the issue. Again, a proxy solves the problem for old devices without sacrificing security.
tialaramex 4y ago
> It's not only about security. That's still security, and such security is part of why HTTPS exists. TLS promises three things: * Integrity :: that the two participants (for HTTPS this will be a web server and user agent) move data without anybody else getting to alter it successfully. * Confidentiality :: that the two participants move data without anyone else learning what the data is [but they can learn when data is moved and a upper limit on how much data was moved] * Authenticity :: that the participants can, at their option, reveal some proof of identity to the other tied to this TLS session. For HTTPS typically only web servers provide such identity, as a Certificate. Injecting crap into your data is forbidden by the Integrity requirement.

by kgeist 4y ago

bongobingo1 4y ago

Comcast used to do this, Verizon too I think (as well as DNS hijacking).

zrail 4y ago
Ugh DNS hijacking is the worst. One of the big residential ISPs for a time would trap NXDOMAIN and redirect to a damn search page with ads. So gross.

nicoco 4y ago

The author is aware of this. At the bottom of the article: > Please don’t contact me to “well ackchyually” me and explain MITM attacks and how your terrible ISP inserts ads into your unencrypted web pages

tadfisher 4y ago
... which in no way addresses the issue. Again, a proxy solves the problem for old devices without sacrificing security.

tialaramex 4y ago

> It's not only about security. That's still security, and such security is part of why HTTPS exists. TLS promises three things: * Integrity :: that the two participants (for HTTPS this will be a web server and user agent) move data without anybody else getting to alter it successfully. * Confidentiality :: that the two participants move data without anyone else learning what the data is [but they can learn when data is moved and a upper limit on how much data was moved] * Authenticity :: that the participants can, at their option, reveal some proof of identity to the other tied to this TLS session. For HTTPS typically only web servers provide such identity, as a Certificate. Injecting crap into your data is forbidden by the Integrity requirement.