News for hackers. Stuff that matters.
Re:Bypassing Browser Security Warnings with Pseudo Password ... by jakub_g on Thursday November 02, 2017 @09:14AM (#15610077)
I don't want my ISP to inject JavaScript to random pages or analyze my traffic. That should be downright illegal. They should be like water supply company: provide me damn clean water and get out of my way.

Somehow the sewage company doesn't analyze my urine (I hope) to figure out if I prefer spicy or sour food and get an extra buck from third parties, and somehow they're still in the business.

Re:Bypassing Browser Security Warnings with Pseudo Password ... by throwaway6845 on Thursday November 02, 2017 @12:27PM (#15611855)
> I don't want my ISP to inject JavaScript to random pages or analyze my traffic. That should be downright illegal. They should be like water supply company: provide me damn clean water and get out of my way.

I don't want my search engine to do that either. They should provide me damn accurate results and get out of my way.

Unfortunately, whereas I have a choice of several good ISPs here (UK), I have a choice of precisely one good search engine - Google - and it analyses my traffic to high heaven. (And I've tried DuckDuckGo, on several occasions for several weeks at a time, and I'm afraid it still sucks.)

Re:Bypassing Browser Security Warnings with Pseudo Password ... by banderman on Thursday November 02, 2017 @03:06PM (#15613304)
I find DDG useful for probably ~75% of searches, so I keep it as my default, and switch over to Google if needed.

What aspect of DDG "sucks" for you?

Re:Bypassing Browser Security Warnings with Pseudo Password ... by smsm42 on Thursday November 02, 2017 @04:42PM (#15614113)
I have been using DDG for several years now, and it works just fine. You of course are free to like Google better - to each for their tastes, but please do not claim there's no choice. There is choice, and you just happen to like Google better - fine, so live with Google then :)
Re:Bypassing Browser Security Warnings with Pseudo Password ... by josteink on Thursday November 02, 2017 @09:34AM (#15610239)
> I don't want my ISP to inject JavaScript to random pages or analyze my traffic.

I haven't seen a single reputable ISP do this anywhere. It would illegal.

Is the US really such a third world nation that not even basic regulation like this exist?

Re:Bypassing Browser Security Warnings with Pseudo Password ... by acdha on Thursday November 02, 2017 @11:20AM (#15611192)
If you run a JavaScript error collector or use CSP on a public site you’ll find this all over the world.

Mobile ISPs inject horrible 90s JavaScript which recompresses images (see e.g. https://calendar.perfplanet.com/2013/mobile-isp-image-recomp...).

Many ISPs - both mobile and wired - inject code to send messages about your account.

ISPs like Comcast have tried objecting ads:

https://www.infoworld.com/article/2925839/net-neutrality/cod...

https://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-...

After leaving Mozilla, Andreas Gal described ISPs reselling search engine queries and results to Google competitors:

https://andreasgal.com/2015/03/30/data-is-at-the-heart-of-se...

Re:Bypassing Browser Security Warnings with Pseudo Password ... by rwbcxrz on Thursday November 02, 2017 @10:31AM (#15610713)
I used to have internet from Cox Communications. One day when I was working from home, I was surprised to see a page in my local dev environment load with an overlay telling me my ISP thinks I have a Windows virus (I didn't own any Windows machines at the time).

Turns out our dev environment didn't force CDN assets to load over HTTPS, so my ISP injected some JS into a library we were loading.

I tweeted at them, and they not only verified that it came from them, but also that they consider hijacking and modifying my traffic to be a service.

Re:Bypassing Browser Security Warnings with Pseudo Password ... by zackboe on Thursday November 02, 2017 @01:39PM (#15612466)
"With respect to your complaint that Cox intercepts and injects our own data in order to display alerts, etc, we note that browser alerts are a method Cox utilizes to bring customers’ attention to important information that may affect their Internet experience."

They'll also appear if you're nearing your data allowance or if their email service (that you probably don't use) is undergoing maintenance. When I last asked, there is no possible way to opt-out or disable these.

Re:Bypassing Browser Security Warnings with Pseudo Password ... by pritambaral on Thursday November 02, 2017 @10:06AM (#15610466)
US Cable companies in the past have injected alerts into unsecured sites users browsed, to tell them they're running out of data. If they could do that, they could inject ads too.

US Mobile companies inject identification headers in unsecured HTTP calls, for advertiser tracking; and in other cases allow servers to ping the user's IP back to the ISP to get full details of the user (including addresses).

The regulatory agents responsible for regulating the cable and mobile companies in the US are right now hellbent on removing net neutrality and are fighting against the consumer. Fat chance of those "basic regulation"s existing or surviving.

Re:Bypassing Browser Security Warnings with Pseudo Password ... by yjftsjthsd-h on Thursday November 02, 2017 @05:17PM (#15614369)
Siblings have pointed out how very much it does happen, but if I may take issue with:

> Is the US really such a third world nation that not even basic regulation like this exist?

First, the US is by definition the First World (USSR et al. being second world, third being "everyone not allied with first two"). Second, we have somewhat different ideas about freedom that, often, lead to an extreme lack of regulation; the hope is that this gives more freedom and we'll work around abusive actors (yes, I know monopolies are an obvious weak point in the system).

Re:Bypassing Browser Security Warnings with Pseudo Password ... by peterwwillis on Thursday November 02, 2017 @02:24PM (#15612914)
It has nothing to do with regulation. Users sign contracts that explicitly state the company will do this. You can't fault the company for doing what it told you it would do.