3 ms·

Do these injectors work with https (ssl) sites? Where in the web page fetch/render process does this occur?

ceejayoz 12y ago
They're often browser toolbars, which'll work fine on SSL sites.
rebelde 12y ago
That HTTPS supposedly keeps out ads like this was one of Google's selling points for suggesting HTTPS to publishers. I was expecting this article to end with "and that is why all sites should be running HTTPS now". 5% is a lot. If HTTPS reduces this number to 1%, it might be worth the change.
- jacquesm 12y ago
  HTTPS will keep out injection during transit from the server to your computer. But it will do absolutely nothing against toolbars and other browser extensions and that is what this article is about so at a guess the 5% is on top of injection in transit.
  - vbcr 12y ago
    Why does the browser even allow any toolbar/extension to modify the content that was delivered on a HTTPS connection. Isn't the data that is delivered over HTTPS pristine that it should not be modified at the browser endpoint by the browser. I am a layman in security and do not understand a lot of this. May be I missed something here. Is my question correct?
    - jacquesm 12y ago
      Not all HTTPS connections are to your bank. You're probably reading this page using https and there are quite a few extensions to modify the look and feel of hackernews. Changing on-page content is just about the only reason extensions exist in the first place. Without that you could retire just about all of them.
    - epel 12y ago
      Extensions MUST be able to modify content. Think about noscript or adblock - if ads were served over https, and you were not allowed or could not technically block them? If analytics trackers were all over HTTPS and can't be blocked or disabled?
nickhalfasleep 12y ago
Most extensions and toolbars have access to the DOM via browser javascript methods (Safari, Chrome, Firefox), or C++ Browser Helper Objects (BHO's) in IE, so they can inject and redirect content if the user installs it.
charonn0 12y ago
Not unless they do something incredibly stupid like install a certificate authority and hijack every SSL session. [1] [1]: http://en.wikipedia.org/wiki/Superfish#Lenovo_security_incident http://en.wikipedia.org/wiki/Superfish#Lenovo_security_incid...

They're often browser toolbars, which'll work fine on SSL sites.

That HTTPS supposedly keeps out ads like this was one of Google's selling points for suggesting HTTPS to publishers. I was expecting this article to end with "and that is why all sites should be running HTTPS now". 5% is a lot. If HTTPS reduces this number to 1%, it might be worth the change.

jacquesm 12y ago
HTTPS will keep out injection during transit from the server to your computer. But it will do absolutely nothing against toolbars and other browser extensions and that is what this article is about so at a guess the 5% is on top of injection in transit.
- vbcr 12y ago
  Why does the browser even allow any toolbar/extension to modify the content that was delivered on a HTTPS connection. Isn't the data that is delivered over HTTPS pristine that it should not be modified at the browser endpoint by the browser. I am a layman in security and do not understand a lot of this. May be I missed something here. Is my question correct?
  - jacquesm 12y ago
    Not all HTTPS connections are to your bank. You're probably reading this page using https and there are quite a few extensions to modify the look and feel of hackernews. Changing on-page content is just about the only reason extensions exist in the first place. Without that you could retire just about all of them.
  - epel 12y ago
    Extensions MUST be able to modify content. Think about noscript or adblock - if ads were served over https, and you were not allowed or could not technically block them? If analytics trackers were all over HTTPS and can't be blocked or disabled?

nickhalfasleep 12y ago

Most extensions and toolbars have access to the DOM via browser javascript methods (Safari, Chrome, Firefox), or C++ Browser Helper Objects (BHO's) in IE, so they can inject and redirect content if the user installs it.

charonn0 12y ago

Not unless they do something incredibly stupid like install a certificate authority and hijack every SSL session. [1] [1]: http://en.wikipedia.org/wiki/Superfish#Lenovo_security_incident http://en.wikipedia.org/wiki/Superfish#Lenovo_security_incid...