Somehow the sewage company doesn't analyze my urine (I hope) to figure out if I prefer spicy or sour food and get an extra buck from third parties, and somehow they're still in the business.
I don't want my search engine to do that either. They should provide me damn accurate results and get out of my way.
Unfortunately, whereas I have a choice of several good ISPs here (UK), I have a choice of precisely one good search engine - Google - and it analyses my traffic to high heaven. (And I've tried DuckDuckGo, on several occasions for several weeks at a time, and I'm afraid it still sucks.)
What aspect of DDG "sucks" for you?
I haven't seen a single reputable ISP do this anywhere. It would illegal.
Is the US really such a third world nation that not even basic regulation like this exist?
Mobile ISPs inject horrible 90s JavaScript which recompresses images (see e.g. https://calendar.perfplanet.com/2013/mobile-isp-image-recomp...).
Many ISPs - both mobile and wired - inject code to send messages about your account.
ISPs like Comcast have tried objecting ads:
https://www.infoworld.com/article/2925839/net-neutrality/cod...
https://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-...
After leaving Mozilla, Andreas Gal described ISPs reselling search engine queries and results to Google competitors:
https://andreasgal.com/2015/03/30/data-is-at-the-heart-of-se...
Turns out our dev environment didn't force CDN assets to load over HTTPS, so my ISP injected some JS into a library we were loading.
I tweeted at them, and they not only verified that it came from them, but also that they consider hijacking and modifying my traffic to be a service.
They'll also appear if you're nearing your data allowance or if their email service (that you probably don't use) is undergoing maintenance. When I last asked, there is no possible way to opt-out or disable these.
US Mobile companies inject identification headers in unsecured HTTP calls, for advertiser tracking; and in other cases allow servers to ping the user's IP back to the ISP to get full details of the user (including addresses).
The regulatory agents responsible for regulating the cable and mobile companies in the US are right now hellbent on removing net neutrality and are fighting against the consumer. Fat chance of those "basic regulation"s existing or surviving.
> Is the US really such a third world nation that not even basic regulation like this exist?
First, the US is by definition the First World (USSR et al. being second world, third being "everyone not allied with first two"). Second, we have somewhat different ideas about freedom that, often, lead to an extreme lack of regulation; the hope is that this gives more freedom and we'll work around abusive actors (yes, I know monopolies are an obvious weak point in the system).
That is not true. The main threat it protects against is MitM (man in the middle attacks) that allow someone to redirect all traffic to a website through their machine and thus see all the data including your password.
HTTPS when combined with root certificate trust is very effective at preventing these kind of attacks. Without it, using any shared internet at all (such as a company, school, or coffee shop) to log into any website or enter your credit card would be trivially easy to hack.
Seriously, I can boot up Wireshark, go to my coffee shop and easily see every non-HTTPS communication going over the network. IM messages, emails, and in cases like this post suggests... passwords too.
Edit: As a side note... I do this all the time to reverse engineer the wireless protocol for IOT devices since most of them do not use HTTPS yet. I use it for personal use but it could be used for harm as well. For instance, if the security cameras are IP cameras over HTTP I could probably intercept the password and use it to remotely turn off the cameras.
The one thing that reduces the likelihood of that happening is to minimize the amount of credentials you could get your hands on using that attack.
But if you target is only a single network, packet sniffing is pretty effective and is stopped by HTTPS.
And if you target is a single person or small group of enumerable machines, arp poisoning still works on many (most?) networks.
Personally I am more scared of the damage that can be caused by being a direct target than I am having my info in one of those massive dark-web data dumps.
Edit: Also, the ops post is actually an example of a MitM (where the ISP is the one in the middle). I just expanded it to the superset.
Until recently, I had no idea that manufacturers actually PAY Google to have the services on Android... Talk about idiocy.
I mean, you _could_ go the amazon route, but how's that working out for them? Their mobile platform is not exactly flourishing. An Android device without Google Apps simply isn't going to sell in the millions.
As someone living in Europe, this literally happens nowhere. Because it's illegal.
SSL in browser has nothing to do with our ISPs. Stop being US-centric.
Oh wait.
http://www.telegraph.co.uk/technology/news/8438461/BT-and-Ph...
This is an interesting observation of how Google's technical crusades often align with its profit interests.
The main threat that HTTPS everywhere secures against is preventing your ISP from analyzing your traffic in order to build and sell an advertising profile on you.
Now, obviously that is something I don't want, so I am all for HTTPS everywhere, but Google already has that profile, so for them HTTPS everywhere is eliminating the competition.