News for hackers. Stuff that matters.
Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by upofadown on Monday June 14, 2021 @05:15PM (#27508394)
>HTTPS prevents ads/trackers/malware being injected into the page by unscrupulous ISPs.

If you are in a legal/political environment that allows active attacks by an ISP on their customers then you have a much bigger problem than just this sort of thing.

Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by xahrepap on Monday June 14, 2021 @05:22PM (#27508481)
Comcast in the US has injected content into non-secured pages to notify customers of things. That is a horrible business practice that should not be allowed.

What can I, an individual with nearly zero political clout (I can vote... but I live in a gerrymandered district... another layer to the problem!) do to get this problem fixed? Best case scenario, I say something, it goes viral, people march in protest against bad ISPs, the monopolies get broken up, etc. But how long does that all take?

Meanwhile, I'll only use HTTPS websites as a first-line of defense. The "much bigger problem" can be solved in parallel.

Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by joshuajill on Monday June 14, 2021 @08:22PM (#27509989)
"It is in fact quite possible – and quite common – for a firewall or other device in your network path to terminate your TLS connection with a website and then re-create a TLS connection from the device to your browser." https://www.internetsociety.org/resources/deploy360/dane/

Isn't it then possible, albeit harder to do a MITM attack at this point with HTTPS?

Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by tialaramex on Monday June 14, 2021 @08:38PM (#27510084)
If you've decided that you trust the "firewall or other device", perhaps because you purchased it, or because doing so is a condition of employment, then you get to keep both halves.

If the "firewall or other device" tries to interpose when you don't trust it, that won't work, for the same reason it doesn't work for bad guys. We do not distinguish the apparent reason for attempts to destroy the confidentiality, integrity or authenticity promises in TLS, whatever the apparent motive your HTTP transaction will either work, delivering those promises or you get an error and no progress is made.

Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by NikolaNovak on Tuesday June 15, 2021 @08:52AM (#27514583)
This has happened in both USA & UK; in Toronto Canada, my top-2-in-the-country ISP has hijacked DNS, hijacked 404, and injected "helpful ads" at times. Every time there was a substantial backlash, but that came in on the nerds + grassroots level, not because of pre-existing laws.
Re:Supporting Let’s Encrypt, the nonprofit making HTTPS free... by gsich on Monday June 14, 2021 @06:06PM (#27508924)
"you" and clients connecting to your server might be different entities.