8 ms·

I think that if we didn't do TLS, every ISP would be injecting ads into websites these days. Making it difficult for middle-of-the-road interlopers is a good t

I think that if we didn't do TLS, every ISP would be injecting ads into websites these days. Making it difficult for middle-of-the-road interlopers is a good thing. ISPs don't want the customer service burden of proxy configurations and custom certs (god knows your IT department hates the support aspect of this tampering), so TLS keeps us free of excessive advertising. (Of course, they like do tampering with DNS which is why we have to do DNS-over-HTTPS. If you make it easy to tamper with your traffic, your ISP has a good business case to tamper with your traffic. Sad but true.) I'm not as convinced as the author is that nation states can easily tamper with certificates these days. I am not sure how much CT checking we do before each page load, but either nation states are compelling the issue of certs that aren't in the CT database, or they are and you can just get a list of who the nation states are spying on. Seems like less of a problem than it was a decade ago. The author seems to miss the one guarantee that certificates provide; "the same people that controlled this site on $ISSUANCE_DATE control the site right now". That can be a useful guarantee.

pavel_lishin 1y ago
We had this happen to us at work, once. We were working on some feature for a client's website, and suddenly things started breaking. We eventually tracked it down to some shoddy HTML + Javascript being on our page that we certainly didn't put there, and further investigation revealed that our ISP - whom we were paying for a business connection - was just slapping a fucking banner ad on most of the pages that were being served. This was around ... 2008? I wonder if they were injecting it into AJAX responses, too. My boss called them up and chewed them several new assholes, and the banner was gone by afternoon.
- jabroni_salad 1y ago
  My ISP (Mediacom) appears to have a deal with certain websites to display service messages. The only two I've encountered it on is Amazon and Facebook but they are somehow able to insert a maintenance banner at the top of those two when downtime is anticipated or if I am near the end of my bandwidth quota. Haven't gotten any ads this way but they have the technology.
  - Philip-J-Fry 1y ago
    Pretty sure this is done on your router. They terminate TLS on your router, inject their malware and then re-encrypt.
    - notpushkin 1y ago
      > and then re-encrypt How?
      - tialaramex 1y ago
        One thing you can arrange is "Oh, you need to trust our Router's security thing" and so you're adding a new private root CA trust, then they "just" issue CA certs which they've arranged for you to trust. This is commonly how corporate and institutional systems are set up, it's a terrible idea but it's very common. One thing that helps drive it away at work is that we're a University, and essentially all the world's universities have a common authenticated WiFi (because students and perhaps more importantly, academics, just travel from one to another and expect stuff to work, if you got a degree in the last 20 or so years you likely used this, eduroam) but obviously they don't trust each other on this stuff so their sites all use the Web PKI, the same public trust as everybody else, internal stuff might not, but the moment you're asking some History professor to manually install a certificate you might as well assign them a dedicated IT person, so, everything facing ordinary users has public certs from, of course, Let's Encrypt. Edited to name eduroam specifically.
        notpushkin 1y ago
        > This is commonly how corporate and institutional systems are set up, it's a terrible idea but it's very common. Tbh makes it kinda sense for those systems, when used only with internal tools and on company devices... but yeah I’d just (of course) Let’s Encrypt if I was setting it up for a client.
        BrandoElFollito 1y ago
        Wrong information removed - you were right, I was wrong. I apologize.
- nurettin 1y ago
  The modern version of that is brave or ublock or screen reader extensions or spyware inserting JS or data attributes which leads to user complaints. We don't need ISPs hacking lines, people do it to themselves when they sign up to shady sms services on download sites.
- dunham 1y ago
  Our app reports all of the runtime exceptions to the server. We had one years ago (maybe before 2008) that was caused by somebody's "toolbar" replacing a method like Element.appendChild with one that sometimes crashed. This inspired me to add a list of all script tags to error reports.
- navigate8310 1y ago
  This was common back in the early 2010s with Indian ISPs as well, particularly the state-controlled BSNL.
- sehugg 1y ago
  Haha, yeah this kind of stuff made HTTP long polling requests over mobile pretty fun. IIRC, we ran HTTP over IMAP and POP3 ports for cases where port 80 was unreliable.
- brightball 1y ago
  I don't know what the official name for the phenomena is where you widely experience a huge problem, the market reacts to fix the problem almost completely, people who never experienced the problem in the first place because the world before them solved it begin to complain about the solution, people defending the solution are mocked by people who have no context, the solution is rolled back and all the people who did it are happy with their win for a brief moment in time, then the original problem comes back in force but all of the walls put up to tear down the original solution make it 1000x harder to fix. I feel like there needs to be a name for this. For now, "Those who do not learn from history are doomed to repeat it." is the most apt I think. Happens constantly when you're essentially born on 3rd base. Maybe that's the proper name. Born on 3rd Base Syndrome.
  - sd9 1y ago
    Chesterton's Fence?
    - brightball 1y ago
      That probably covers it, yes. Thank you.
    - charles_f 1y ago
      Oooh didn't know but I like that. "if you can't explain what the fence is doing i won't let you remove it", makes for a great refactoring principle!
  - supportengineer 1y ago
    Is this about vaccines?
    - brightball 1y ago
      Ha! No, it wasn't intended to be. Applies to a lot of different things though.
    - DemocracyFTW2 1y ago
- benjiro 1y ago
  > suddenly things started breaking. We eventually tracked it down Amateur level ... Around 2006, we enjoyed some clients complaining why information on our CMS was being duplicated. No matter what we did, there was no duplication on our end. So we started to trace the actions from the from the client (inc browser, ip etc). And low and behold, we got one action coming from the client, and another from a different IP source. After tracing back the IP, it was a anti virus company. We installed the software on a test system, and ... Yep, the assh** duplicated every action, inc browser settings, session, you name it. Total and complete mimic beyond the IP. So any action the user did + the information of the page, was send to their servers for "analyzing". Little issue ... This was not from the public part of our CMS but the HTTPS protected admin pages! Sure, our fault for not validating the session with extra IP checks but we did not expect the (admin only) session to leak out from a HTTPS connection. So we tried to see if they reacted to login attempts at several bank pages. O, yes, they send the freaking passwords etc. We tried on a unused bank account, o, look, it was duplicating bank actions (again, bank at fault for not properly checking the session / ip). It only failed on a bank transfer because the token for authorization was different on their side, vs our request. You can imagine that we had a rather, how to say, less then polite talks / conversation with the software team behind that anti-virus. They "fixed it" in a new release. Did they remove the whole tracking? Nowp, they just removed the code for the session stealing if the connection was secure. O, and the answer to why they did it. "it a bug" (yea, right, your mimic a total user behavior, and its a "bug"). Translation: Legal got up their behinds for that crap and they wanted to avoid legal issues with what they did. Remember folks, if its free your the product. And when its paid, you are often STILL the product. And yes, that was a paid anti-virus "online protection". And people question why i never run any anti-virus software beyond a off-line scan from time to time, and have Windows "online" protections disabled. Companies just can not stop themselves from being greedy. Same reason why i NEVER use Windows 11... You expect if you paid for Windows, Office or whatever, to not be the product, but hey ...
octoberfranklin 1y ago
Your comment is disingenuous -- the article isn't arguing against TLS. It is arguing against WebPKI. You can stop ISP ad injection with solutions much less complex than WebPKI. Simply using TOFU-certificates (Trust On First Use) would achieve this. It also gives you the "people who controlled this website the first time I visited it still control it" guarantee you mention in your last paragraph. TOFU isn't ideal, but it's an easy counterexample to your claims.
- blenderob 1y ago
  > Simply using TOFU-certificates (Trust On First Use) would achieve this. As a user how would I know if I should trust the website's public key on first use?
  - octoberfranklin 1y ago
    The same way you know if you should trust the WebPKI Rube-Goldberg-contraption: you don't. It's a counterexample, not a recommendation. If you need this guarantee, use self-certifying hostnames like Tor *.onion sites do, where the URL carries the public key. More examples of this: https://codeberg.org/amjoseph/not-your-keys-not-your-name https://codeberg.org/amjoseph/not-your-keys-not-your-name
    - akerl_ 1y ago
      I trust the WebPKI infra quite a bit. Cert validation is publicly logged, CAs that do nefarious things get booted from browser trust stores. I can set which CAs can sign certs for my domains, and monitor if any are issued that I didn't expect.
  - akerl_ 1y ago
    I guess we could organize regional parties where site operators and users meet up and exchange key material. I'm sure that will scale and won't have any problems of its own.
  - 1718627440 1y ago
throw_a_grenade 1y ago
> I'm not as convinced as the author is that nation states can easily tamper with certificates these days. I am not sure how much CT checking we do before each page load [...] They can MITM the connection between the host and LE (or any other CA resolver, ACME or non-ACME, doesn't matter). This was demonstrated by the attack against jabber.ru, at the time hosted in OVH. I recommend reading the writeup by the admin (second link from the top in TFA). This worked, because no-one checked CT.
- fragmede 1y ago
  LE checks from multiple places, so you'd have to MITM all of them, which makes it seem rather challenging to actually pull off.
  - Ajedi32 1y ago
    AFAIK that's not a required feature of the DV process, and even if it were it wouldn't help if the MITM was happening between the website and the wider internet. That said, I don't think there's a way to stop a nation state from seizing control of a domain they control the TLD name servers for without something like Namecoin where the whole DNS system is redesigned to be self-sovereign.
    - tialaramex 1y ago
      Multi-perspective is or will be (I didn't pay attention to the timeline) required by the Baseline Requirements which are effectively the rules for how Web PKI certs work. The system is tamper evident not tamper proof. A nation state adversary can indeed impersonate my web site and obtain a new certificate, but the Web Browser doesn't trust that certificate without seeing Proof it was in the CT logs. So, now the nation state adversary need Proof it was Logged. Whoever issued them the proof has 24 hours to include that dodgy certificate in their public logs for everyone to see. If they lie and don't actually log it, the proof will be worthless and if shown to a trust root this bad proof will result in distrust of the log's operator. That's likely a six or seven figure investment thrown away, for each time this happens. On the other hand if they do log it, everybody can see what was issued and when, which is inconvenient if you'd prefer to be subtle like the NSA and to some extent Mossad. If you're happy to advertise that you're the bad guys, like the Russians and North Koreans, you do have the small problem that of course nobody trusts you, so, you can't expect any co-operation from the other actors...
nasretdinov 1y ago
I remember when Wi-Fi was first introduced in Moscow metro system (underground trains) in 2014, this is exactly what happened: most sites were HTTP and thus allowed ads to be injected essentially as form of payment for the Wi-Fi service. Almost immediately most Russian web sites switched to HTTPS because the ads often broke CSS layout and caused other issues in general
- stop_nazi 1y ago
  And who now uses metro wifi «от оленевода»? Noone
bgwalter 1y ago
ISPs should be regulated like common carriers. Modifying the data in transit should be illegal. ISP supercookies should be illegal.
- Avamander 1y ago
  We can do that and also use HTTPS to be more certain of it.
- tomrod 1y ago
  Wasn't that the core idea of net neutrality?
stop_nazi 1y ago
1. using http-only for decades, never seen “injections” 2. just change ISP
- bilekas 1y ago
  > using http-only for decades, never seen “injections” This has to be a rage bait comment, but anyway, how do you expect 'injections' to show up on 'http-only' ? "Don't mind us, we're just sitting in the middle of your traffic here and recording your logins in plaintext"
  - stop_nazi 1y ago
    I'm not talking about logins, it's supposed to be encrypted. If I go to read news that is open to an unlimited number of people, there is no need for encryption: the information is open.
    - Avamander 1y ago
      You assume that you will _never_ read something that might be out in the open but at the same time the fact that you're reading it might be the thing that needs protecting? A public invitation to a protest against your autocratic government, for example?
      - pKropotkin 1y ago
        A public invitation to protest against my authoritarian government should not turn on total paranoia mode and cipher the opening hours of the local bakery. It's unnecessary I'd also like to remind you that the vast majority of e-mails are still unencrypted
        Avamander 1y ago
        Can you say that for everyone though, that they should have a local bakery and use its opening hours? There are also more cases than that, where something being public does not mean that someone should see you looking at that info. While the situation with emails is worse it does not mean it should be like that.
bilekas 1y ago
> I think that if we didn't do TLS, every ISP would be injecting ads into websites these days. Thats the least of the problems, they (anyone with basic access to your network actually) could easily overwrite every cooking or session on your machine to use their referral links. IE : Honey &* PayPal's Fraud [0] without you having any idea, now maybe you don't care, but it's stealing other peoples potential earnings. [0] https://www.theverge.com/24343913/paypal-honey-megalag-coupon-scam-affiliate-fees https://www.theverge.com/24343913/paypal-honey-megalag-coupo...
schoen 1y ago
I also want to mention that several governments probably have large-scale tapping infrastructure to passively record Internet traffic. However, they like people not to pay attention to that or think about it (because, you know, we might try to protect ourselves or even try to get them to stop!). This is especially true when your communications cross national borders, as many governments have promoted a theory that normal privacy rules (that they might accept in other contacts) shouldn't apply at the border or outside of their territory. HTTPS is a really important defense against this, but it's really hard to know when it worked or when it was relevant, because the wiretappers weren't announcing what they were doing and similarly don't usually announce when it's being thwarted. There are lots of limitations there. For example, traffic analysis may sometimes allow identifying pairs of people who communicate with each other in low-latency ways like a real-time call, or possibly also those who communicate in a distinctive way in high-latency ways. It may also allow determining, for example, which Wikipedia page you looked at, because the pages are different sizes and contain different numbers of images, so the timing and volume of your browser communications could be distinctive depending on which page you browsed to. But, if you don't do the HTTPS part, then you're basically just saying "we're going to allow anyone who controls network infrastructure to permanently record 100% of all communications in an easily searchable way, if they so choose".

pavel_lishin 1y ago

We had this happen to us at work, once. We were working on some feature for a client's website, and suddenly things started breaking. We eventually tracked it down to some shoddy HTML + Javascript being on our page that we certainly didn't put there, and further investigation revealed that our ISP - whom we were paying for a business connection - was just slapping a fucking banner ad on most of the pages that were being served. This was around ... 2008? I wonder if they were injecting it into AJAX responses, too. My boss called them up and chewed them several new assholes, and the banner was gone by afternoon.

jabroni_salad 1y ago
My ISP (Mediacom) appears to have a deal with certain websites to display service messages. The only two I've encountered it on is Amazon and Facebook but they are somehow able to insert a maintenance banner at the top of those two when downtime is anticipated or if I am near the end of my bandwidth quota. Haven't gotten any ads this way but they have the technology.
- Philip-J-Fry 1y ago
  Pretty sure this is done on your router. They terminate TLS on your router, inject their malware and then re-encrypt.
  - notpushkin 1y ago
    > and then re-encrypt How?
    - tialaramex 1y ago
      One thing you can arrange is "Oh, you need to trust our Router's security thing" and so you're adding a new private root CA trust, then they "just" issue CA certs which they've arranged for you to trust. This is commonly how corporate and institutional systems are set up, it's a terrible idea but it's very common. One thing that helps drive it away at work is that we're a University, and essentially all the world's universities have a common authenticated WiFi (because students and perhaps more importantly, academics, just travel from one to another and expect stuff to work, if you got a degree in the last 20 or so years you likely used this, eduroam) but obviously they don't trust each other on this stuff so their sites all use the Web PKI, the same public trust as everybody else, internal stuff might not, but the moment you're asking some History professor to manually install a certificate you might as well assign them a dedicated IT person, so, everything facing ordinary users has public certs from, of course, Let's Encrypt. Edited to name eduroam specifically.
      - notpushkin 1y ago
        > This is commonly how corporate and institutional systems are set up, it's a terrible idea but it's very common. Tbh makes it kinda sense for those systems, when used only with internal tools and on company devices... but yeah I’d just (of course) Let’s Encrypt if I was setting it up for a client.
      - BrandoElFollito 1y ago
        Wrong information removed - you were right, I was wrong. I apologize.
nurettin 1y ago
The modern version of that is brave or ublock or screen reader extensions or spyware inserting JS or data attributes which leads to user complaints. We don't need ISPs hacking lines, people do it to themselves when they sign up to shady sms services on download sites.
dunham 1y ago
Our app reports all of the runtime exceptions to the server. We had one years ago (maybe before 2008) that was caused by somebody's "toolbar" replacing a method like Element.appendChild with one that sometimes crashed. This inspired me to add a list of all script tags to error reports.
navigate8310 1y ago
This was common back in the early 2010s with Indian ISPs as well, particularly the state-controlled BSNL.
sehugg 1y ago
Haha, yeah this kind of stuff made HTTP long polling requests over mobile pretty fun. IIRC, we ran HTTP over IMAP and POP3 ports for cases where port 80 was unreliable.
brightball 1y ago
I don't know what the official name for the phenomena is where you widely experience a huge problem, the market reacts to fix the problem almost completely, people who never experienced the problem in the first place because the world before them solved it begin to complain about the solution, people defending the solution are mocked by people who have no context, the solution is rolled back and all the people who did it are happy with their win for a brief moment in time, then the original problem comes back in force but all of the walls put up to tear down the original solution make it 1000x harder to fix. I feel like there needs to be a name for this. For now, "Those who do not learn from history are doomed to repeat it." is the most apt I think. Happens constantly when you're essentially born on 3rd base. Maybe that's the proper name. Born on 3rd Base Syndrome.
- sd9 1y ago
  Chesterton's Fence?
  - brightball 1y ago
    That probably covers it, yes. Thank you.
  - charles_f 1y ago
    Oooh didn't know but I like that. "if you can't explain what the fence is doing i won't let you remove it", makes for a great refactoring principle!
- supportengineer 1y ago
  Is this about vaccines?
  - brightball 1y ago
    Ha! No, it wasn't intended to be. Applies to a lot of different things though.
  - DemocracyFTW2 1y ago
benjiro 1y ago
> suddenly things started breaking. We eventually tracked it down Amateur level ... Around 2006, we enjoyed some clients complaining why information on our CMS was being duplicated. No matter what we did, there was no duplication on our end. So we started to trace the actions from the from the client (inc browser, ip etc). And low and behold, we got one action coming from the client, and another from a different IP source. After tracing back the IP, it was a anti virus company. We installed the software on a test system, and ... Yep, the assh** duplicated every action, inc browser settings, session, you name it. Total and complete mimic beyond the IP. So any action the user did + the information of the page, was send to their servers for "analyzing". Little issue ... This was not from the public part of our CMS but the HTTPS protected admin pages! Sure, our fault for not validating the session with extra IP checks but we did not expect the (admin only) session to leak out from a HTTPS connection. So we tried to see if they reacted to login attempts at several bank pages. O, yes, they send the freaking passwords etc. We tried on a unused bank account, o, look, it was duplicating bank actions (again, bank at fault for not properly checking the session / ip). It only failed on a bank transfer because the token for authorization was different on their side, vs our request. You can imagine that we had a rather, how to say, less then polite talks / conversation with the software team behind that anti-virus. They "fixed it" in a new release. Did they remove the whole tracking? Nowp, they just removed the code for the session stealing if the connection was secure. O, and the answer to why they did it. "it a bug" (yea, right, your mimic a total user behavior, and its a "bug"). Translation: Legal got up their behinds for that crap and they wanted to avoid legal issues with what they did. Remember folks, if its free your the product. And when its paid, you are often STILL the product. And yes, that was a paid anti-virus "online protection". And people question why i never run any anti-virus software beyond a off-line scan from time to time, and have Windows "online" protections disabled. Companies just can not stop themselves from being greedy. Same reason why i NEVER use Windows 11... You expect if you paid for Windows, Office or whatever, to not be the product, but hey ...

octoberfranklin 1y ago

Your comment is disingenuous -- the article isn't arguing against TLS. It is arguing against WebPKI. You can stop ISP ad injection with solutions much less complex than WebPKI. Simply using TOFU-certificates (Trust On First Use) would achieve this. It also gives you the "people who controlled this website the first time I visited it still control it" guarantee you mention in your last paragraph. TOFU isn't ideal, but it's an easy counterexample to your claims.

blenderob 1y ago
> Simply using TOFU-certificates (Trust On First Use) would achieve this. As a user how would I know if I should trust the website's public key on first use?
- octoberfranklin 1y ago
  The same way you know if you should trust the WebPKI Rube-Goldberg-contraption: you don't. It's a counterexample, not a recommendation. If you need this guarantee, use self-certifying hostnames like Tor *.onion sites do, where the URL carries the public key. More examples of this: https://codeberg.org/amjoseph/not-your-keys-not-your-name https://codeberg.org/amjoseph/not-your-keys-not-your-name
  - akerl_ 1y ago
    I trust the WebPKI infra quite a bit. Cert validation is publicly logged, CAs that do nefarious things get booted from browser trust stores. I can set which CAs can sign certs for my domains, and monitor if any are issued that I didn't expect.
- akerl_ 1y ago
  I guess we could organize regional parties where site operators and users meet up and exchange key material. I'm sure that will scale and won't have any problems of its own.
- 1718627440 1y ago

throw_a_grenade 1y ago

> I'm not as convinced as the author is that nation states can easily tamper with certificates these days. I am not sure how much CT checking we do before each page load [...] They can MITM the connection between the host and LE (or any other CA resolver, ACME or non-ACME, doesn't matter). This was demonstrated by the attack against jabber.ru, at the time hosted in OVH. I recommend reading the writeup by the admin (second link from the top in TFA). This worked, because no-one checked CT.

fragmede 1y ago
LE checks from multiple places, so you'd have to MITM all of them, which makes it seem rather challenging to actually pull off.
- Ajedi32 1y ago
  AFAIK that's not a required feature of the DV process, and even if it were it wouldn't help if the MITM was happening between the website and the wider internet. That said, I don't think there's a way to stop a nation state from seizing control of a domain they control the TLD name servers for without something like Namecoin where the whole DNS system is redesigned to be self-sovereign.
  - tialaramex 1y ago
    Multi-perspective is or will be (I didn't pay attention to the timeline) required by the Baseline Requirements which are effectively the rules for how Web PKI certs work. The system is tamper evident not tamper proof. A nation state adversary can indeed impersonate my web site and obtain a new certificate, but the Web Browser doesn't trust that certificate without seeing Proof it was in the CT logs. So, now the nation state adversary need Proof it was Logged. Whoever issued them the proof has 24 hours to include that dodgy certificate in their public logs for everyone to see. If they lie and don't actually log it, the proof will be worthless and if shown to a trust root this bad proof will result in distrust of the log's operator. That's likely a six or seven figure investment thrown away, for each time this happens. On the other hand if they do log it, everybody can see what was issued and when, which is inconvenient if you'd prefer to be subtle like the NSA and to some extent Mossad. If you're happy to advertise that you're the bad guys, like the Russians and North Koreans, you do have the small problem that of course nobody trusts you, so, you can't expect any co-operation from the other actors...

nasretdinov 1y ago

I remember when Wi-Fi was first introduced in Moscow metro system (underground trains) in 2014, this is exactly what happened: most sites were HTTP and thus allowed ads to be injected essentially as form of payment for the Wi-Fi service. Almost immediately most Russian web sites switched to HTTPS because the ads often broke CSS layout and caused other issues in general

stop_nazi 1y ago
And who now uses metro wifi «от оленевода»? Noone

bgwalter 1y ago

ISPs should be regulated like common carriers. Modifying the data in transit should be illegal. ISP supercookies should be illegal.

Avamander 1y ago
We can do that and also use HTTPS to be more certain of it.
tomrod 1y ago
Wasn't that the core idea of net neutrality?

stop_nazi 1y ago

1. using http-only for decades, never seen “injections” 2. just change ISP

bilekas 1y ago
> using http-only for decades, never seen “injections” This has to be a rage bait comment, but anyway, how do you expect 'injections' to show up on 'http-only' ? "Don't mind us, we're just sitting in the middle of your traffic here and recording your logins in plaintext"
- stop_nazi 1y ago
  I'm not talking about logins, it's supposed to be encrypted. If I go to read news that is open to an unlimited number of people, there is no need for encryption: the information is open.
  - Avamander 1y ago
    You assume that you will _never_ read something that might be out in the open but at the same time the fact that you're reading it might be the thing that needs protecting? A public invitation to a protest against your autocratic government, for example?
    - pKropotkin 1y ago
      A public invitation to protest against my authoritarian government should not turn on total paranoia mode and cipher the opening hours of the local bakery. It's unnecessary I'd also like to remind you that the vast majority of e-mails are still unencrypted
      - Avamander 1y ago
        Can you say that for everyone though, that they should have a local bakery and use its opening hours? There are also more cases than that, where something being public does not mean that someone should see you looking at that info. While the situation with emails is worse it does not mean it should be like that.

bilekas 1y ago

> I think that if we didn't do TLS, every ISP would be injecting ads into websites these days. Thats the least of the problems, they (anyone with basic access to your network actually) could easily overwrite every cooking or session on your machine to use their referral links. IE : Honey &* PayPal's Fraud [0] without you having any idea, now maybe you don't care, but it's stealing other peoples potential earnings. [0] https://www.theverge.com/24343913/paypal-honey-megalag-coupon-scam-affiliate-fees https://www.theverge.com/24343913/paypal-honey-megalag-coupo...

schoen 1y ago

I also want to mention that several governments probably have large-scale tapping infrastructure to passively record Internet traffic. However, they like people not to pay attention to that or think about it (because, you know, we might try to protect ourselves or even try to get them to stop!). This is especially true when your communications cross national borders, as many governments have promoted a theory that normal privacy rules (that they might accept in other contacts) shouldn't apply at the border or outside of their territory. HTTPS is a really important defense against this, but it's really hard to know when it worked or when it was relevant, because the wiretappers weren't announcing what they were doing and similarly don't usually announce when it's being thwarted. There are lots of limitations there. For example, traffic analysis may sometimes allow identifying pairs of people who communicate with each other in low-latency ways like a real-time call, or possibly also those who communicate in a distinctive way in high-latency ways. It may also allow determining, for example, which Wikipedia page you looked at, because the pages are different sizes and contain different numbers of images, so the timing and volume of your browser communications could be distinctive depending on which page you browsed to. But, if you don't do the HTTPS part, then you're basically just saying "we're going to allow anyone who controls network infrastructure to permanently record 100% of all communications in an easily searchable way, if they so choose".