News for hackers. Stuff that matters.

A comment on Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed. Parent comment

Re:Google Says 5% of Visitors to Its Sites Have Ad Injectors... by vbcr on Wednesday April 01, 2015 @12:41PM (#9304897)
Why does the browser even allow any toolbar/extension to modify the content that was delivered on a HTTPS connection. Isn't the data that is delivered over HTTPS pristine that it should not be modified at the browser endpoint by the browser.

I am a layman in security and do not understand a lot of this. May be I missed something here. Is my question correct?

[ Parent | on HN ]
Re:Google Says 5% of Visitors to Its Sites Have Ad Injectors... by jacquesm on Wednesday April 01, 2015 @02:37PM (#9305798)
Not all HTTPS connections are to your bank.

You're probably reading this page using https and there are quite a few extensions to modify the look and feel of hackernews.

Changing on-page content is just about the only reason extensions exist in the first place. Without that you could retire just about all of them.

[ Parent | on HN ]
Re:Google Says 5% of Visitors to Its Sites Have Ad Injectors... by epel on Wednesday April 01, 2015 @02:40PM (#9305826)
Extensions MUST be able to modify content. Think about noscript or adblock - if ads were served over https, and you were not allowed or could not technically block them? If analytics trackers were all over HTTPS and can't be blocked or disabled?
[ Parent | on HN ]