A monumentally more difficult task than intercepting an unencrypted connection.

> But the site isn't being censored?

How do you know? Without https, a MITM-attack might already be in place, and you wouldn't even notice.

> Is your ISP actually doing that to you right now? Or is that just hypothetical?

Yes there are multiple instances where my isp was injecting stuff. More frequently at public wifi spots.

> Is your ISP actually doing that to you right now? Or is that just hypothetical?

I was on a Southwest flight earlier this week which did exactly this, using HTTP injection to display an overlay on every HTTP page. It's certainly useful to provide flight information (or Amber alerts, weather information, billing alerts), but it's Just Wrong™ to violate the integrity of a communication to do so. Perhaps there should be some standard protocol for ISPs to send messages to clients, permitting the connected OS to determine how to display them?

I can't remember which country it was, but it was either a Vodaphone or O2 sim which would inject their little banner at the top of websites that weren't HTTPS. It was super annoying, especially seeing it on my own site!

A café I go to sometimes for coffee injects ads to non-HTTPS websites. Full screen ads with a timer. It's a good reminder that HTTP sites can be and are being arbitrarily manipulated and surveilled by WiFi operators.

My ISP, WideOpenWest, uses HTTP injection as their primary method for notifying customers of maintenance, etc.