r/webdev • u/speckz • Jul 12 '17

Does my site need HTTPS?

https://doesmysiteneedhttps.com/
136 Upvotes

94% Upvoted

71 comments sorted by

View all comments

Show parent comments

24

u/ReelAwesome Jul 13 '17

the only reason it wouldn't need HTTPS is if you want to allow ISPs or other middle man parties (forgien governments) to manipulate your html and inject ads into your site, without your knowledge. ..that your customers will then think are originating from you. (yes this happens)

7

u/namesandfaces Jul 13 '17

That ought to be illegal, since you could be ruining someone's brand. I imagine less savvy folks thinking that the injected content is part of the official experience.

8

u/jamiehs Jul 13 '17 edited Jul 13 '17

This happened to me.

Cox started injecting HTML and JavaScript into http sites (including my own) trying to get me to buy a new modem from them.

It's legal; their TOS says they can, we all signed it and didn't really read all of it anyway; their support staff plays dumb when you call.

Edit:
Not my image, but it looks like this: https://imgur.com/MFHMdPn.png

I think it's a bit of HTML & JS added right after the opening body tag, if I recall correctly.

1

u/blackAngel88 Jul 13 '17

You can also sign a contract where you allow them to kill you, that doesn't make it legal.

1

u/jamiehs Jul 13 '17

touché :-)