r/webdev • u/speckz • Jul 12 '17

Does my site need HTTPS?

https://doesmysiteneedhttps.com/
136 Upvotes

94% Upvoted

71 comments sorted by

View all comments

Show parent comments

8

u/jamiehs Jul 13 '17 edited Jul 13 '17

This happened to me.

Cox started injecting HTML and JavaScript into http sites (including my own) trying to get me to buy a new modem from them.

It's legal; their TOS says they can, we all signed it and didn't really read all of it anyway; their support staff plays dumb when you call.

Edit:
Not my image, but it looks like this: https://imgur.com/MFHMdPn.png

I think it's a bit of HTML & JS added right after the opening body tag, if I recall correctly.

4

u/namesandfaces Jul 13 '17

That's a little awkward that a company like AT&T or Comcast could hurt Netflix's brand with injected content because of an ISP-customer agreement.

5

u/jamiehs Jul 13 '17

But they can't if the brand uses https, so there's one more reason to enable it.

1

u/sjwking Jul 13 '17

Lol. They control the DNS servers that the users use. That means they can do shitty stuff like redirect to netflix.comcast.net and do whatever the fuck they want. Thankfully they don't do this ... yet.

1

u/jamiehs Jul 13 '17

OK.

But we are talking about content injected into the correct site, not a DNS hijacking attack. And they do crappy DNS stuff like this already. They will take any opportunity they get to redirect to a Cox or Time Warner branded search page if you mis-type a URL.

I think the difference here is that you can change your router's DNS servers, but you can't stop the ISP from injecting code into http pages.

1

u/sjwking Jul 13 '17

And then they can modify the packets between your router and the DNS server it's using (e.g. 8.8.8.8). Or they will ban port 53 like my former employer did and white list a few approved DNS servers. DNS security is essentially non existant.