Hacker News new | past | comments | ask | show | jobs | submit login

>To overcome government censorship and surveillance.

But the site isn't being censored? Also https won't stop the government from knowing that you connected to those servers. I agree that we want to avoid censorship and surveillance in general, but it really doesn't seem relevant here.

>To stop internet providers from injecting ads and tracking scripts.

Is your ISP actually doing that to you right now? Or is that just hypothetical?




> Is your ISP actually doing that to you right now? Or is that just hypothetical?

I was on a Southwest flight earlier this week which did exactly this, using HTTP injection to display an overlay on every HTTP page. It's certainly useful to provide flight information (or Amber alerts, weather information, billing alerts), but it's Just Wrong™ to violate the integrity of a communication to do so. Perhaps there should be some standard protocol for ISPs to send messages to clients, permitting the connected OS to determine how to display them?


> But the site isn't being censored?

How do you know? Without https, a MITM-attack might already be in place, and you wouldn't even notice.


I guess that's a fair point.


> Is your ISP actually doing that to you right now? Or is that just hypothetical?

Yes there are multiple instances where my isp was injecting stuff. More frequently at public wifi spots.


I can't remember which country it was, but it was either a Vodaphone or O2 sim which would inject their little banner at the top of websites that weren't HTTPS. It was super annoying, especially seeing it on my own site!


A café I go to sometimes for coffee injects ads to non-HTTPS websites. Full screen ads with a timer. It's a good reminder that HTTP sites can be and are being arbitrarily manipulated and surveilled by WiFi operators.


My ISP, WideOpenWest, uses HTTP injection as their primary method for notifying customers of maintenance, etc.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: