Hacker News Reader

Without https, a man in the middle could easily rewrite your website's content in different ways for different purposes, inject scripts, etc. Which at first sounds a little theoretical except that ISPs have actually done this to inject banner ads into unsecured pages (article's about a smaller ISP, but iirc Comcast has done this before as well): https://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-...

View on HN

I was under the impression that I wouldn't care about somebody MITMing me, but you've made me see a number of things in that vein that would bother me.

Comcast used this technique to notify me I was about to hit my 1TB monthly cap. In that case, I was happy that they did so.

Seems intrusive to me - wouldn't an email or text message have been a more appropriate channel to deliver that message?

Yeah, I just thought it was an interesting twist. Sometimes harmful techniques can be leveraged for good.

Let's hope the water utility doesn't decide to send out a spray of brown water when it's time to remind people to leave their taps open when the temperature goes below freezing

Reply on news.ycombinator.com