News for hackers. Stuff that matters.

A comment on Consider disabling HTTPS auto redirects. Parent comment

Re:Consider disabling HTTPS auto redirects by Sohcahtoa82 on Monday June 27, 2022 @12:06PM (#31896544)
It's not just your own connection, it's every device your packets flow through.

And if you use Comcast/Xfinity, then your own connection can't be trusted. They've been caught injecting messages in plaintext HTTP web pages.

[ Parent | on HN ]
Re:Consider disabling HTTPS auto redirects by strogonoff on Monday June 27, 2022 @12:16PM (#31896704)
I may use a self-provisioned VPN, but actually this doesn’t matter. The point is that the user has no choice, regardless of circumstances.

As an example (although it’s whataboutism), the option of using insecure SMS 2FA is routinely offered in much more sensitive contexts compared to the option of using plain HTTP to read static text content—yet the former is considered acceptable but the latter isn’t.

[ Parent | on HN ]