Re: HTTP is just fine

Kurt Roeckx wrote on 20.11.2015 10:05:
> I've seen javascript being injected

Me too. A lot. And 99% are *not* on the network level.

Sites carry a ton of JavaScript today. Multiple trackers, multiple ad 
servers, third party JS libraries or web services loaded from third 
party servers. Most of them are less than trusted. Ad servers have been 
hacked or simply paid for malware repeatedly, causing the biggest, most 
trusted websites to deliver malware. Repeatedly.

And then there's extensions that inject stuff into every website. They 
are often sideloaded without the user's actual awareness. Not only 
malware does injection, but at least one huge online retailer (which you 
know) does that as well.

If the ISP is really bent on hacking their users, they'll find other 
ways. Worst case, they make you install a "dial-in" program on your PC. 
If your own ISP has bad intent against you, TLS won't rescue you. There 
are too many attack angles.

Ben