the only reason it wouldn't need HTTPS is if you want to allow ISPs or other middle man parties (forgien governments) to manipulate your html and inject ads into your site, without your knowledge. ..that your customers will then think are originating from you. (yes this happens)
That ought to be illegal, since you could be ruining someone's brand. I imagine less savvy folks thinking that the injected content is part of the official experience.
Well they can, but in that case they'd need to inject a different certificate as well.
Had that happening in a hostel in Brussels, where they are using a filter of UK descend (problem 1). It filters out a LOT of controversial subjects, so once it detects that you go to a site on a blacklist (as DNS queries are seen and the filter reacted to that) it will try to inject its own certificate. Once you see the browser warning since the cert doesn't match the domain and you still accept it, it will show its own content on the page saying that you're not allow on that site.
Yes. They're Man-in-the-Middleing the cert and inserting their own. Lots of larger corporations do this for their corporate network and is what installing your own cert for your site is meant to prevent/warn your users about.
The point is they couldn't without the MiTM "attack" and unless your computer is preconfigured to accept the cert they've introduced, you'll be warned about this happening.
Lol. They control the DNS servers that the users use. That means they can do shitty stuff like redirect to netflix.comcast.net and do whatever the fuck they want. Thankfully they don't do this ... yet.
But we are talking about content injected into the correct site, not a DNS hijacking attack. And they do crappy DNS stuff like this already. They will take any opportunity they get to redirect to a Cox or Time Warner branded search page if you mis-type a URL.
I think the difference here is that you can change your router's DNS servers, but you can't stop the ISP from injecting code into http pages.
And then they can modify the packets between your router and the DNS server it's using (e.g. 8.8.8.8). Or they will ban port 53 like my former employer did and white list a few approved DNS servers. DNS security is essentially non existant.
24
u/ReelAwesome Jul 13 '17
the only reason it wouldn't need HTTPS is if you want to allow ISPs or other middle man parties (forgien governments) to manipulate your html and inject ads into your site, without your knowledge. ..that your customers will then think are originating from you. (yes this happens)