Hacker News Reader

> generally is because they chose to use unsafe public access points

It sounds like you are penalizing users for not using a vpn or some other method when out of their homes. Yes, people can do that, but in 2018 having https on the sites you manage is a lot easier than asking every possible visitor to use a vpn. I hope you would reconsider and enable https on all the sites you are an admin.

> If your ISP is MITMing you, I think you have bigger problems then whether they change the content of my static site when you visit it. If they were, they could potentially target your initial download of your browser and downgrade to http to infect your browser so that you never realize after that that https is faked out...

They could, and maybe in countries other than the US you have plenty of ISP choices, but in many places in the US, you are stuck with just one ISP.

And so far, we know that ISPs are manipulating http traffic but so far they haven't gone all the way to give you an infected browser. Again, it is possible, but I think that a better approach is if we all do as much as we can to help each other, the internet could be a better place.

It's all good to point this out, but it's a social argument, not a technical one. If the technical arguments have been eliminated (e.g. you have no technical use for encrypting the connection) then you're left with "Join us in giving the finger to ISPs/cafe routers that inject foreign JS!" Don't be upset when people say "Meh. Take it up with those ISPs directly, or with web browser vendors, I don't care and don't want to join your crusade." At some point web browsers will stop serving content over HTTP unless perhaps with a custom flag turned on, and even then, some people will still not use HTTPS.

> I don't particularly care if people get MITM'ed when visiting my static sites. If they did so it generally is because they chose to use unsafe public access points ( wifi ). This extends to some degree to all forms of wifi since so many security forms in use on them can be easily broken.

While wifi offers little "complete" security, some methods of security, (like implementing HTTPS) require very little work for a relatively large decrease in attack surface

Also, remember that people who get MITMed are not going to say "Oh, sucks to be me for using insecure public wifi and getting pwned when visiting nanoscopic.io, I'm such an idiot..." - they're going to say "The shit-weasel who runs nanoscopic.io installed a fucking cryptominer and configured porn ad dns servers on my laptop! Don't _ever_ visit that site!"

The "very little work" required to use https these days could one day be incredibly valuable in terms of not having your reputation trashed... Perhaps you _should_ care a little more about people getting MITMed...

There are other threat vectors you aren't considering such as DNS cache poisoning, [BGP hijacking][1], and [rogue USB sticks][2].

But even ignoring that, why wouldn't you want to take basic steps to protect against rogue access points or ISPs? "I don't particularly care if people get MITM'ed when visiting my static sites" seems, at least to me, like a rather dismissive attitude towards the security of your site's users.

I'd also like to point out that with the ever-widening deployment of HTTPS the hypothetical attack you described where your ISP MITMS your browser install is becoming less and less feasible. Nearly all modern browsers include a [HSTS preload list][3] which ensures they will never attempt to connect to certain domains over an insecure connection. A browser download site (or even just the user's search engine, which would link directly to the HTTPS-protected download page) being on this list would make the downgrade attack you describe much more difficult.

[1]: https://www.internetsociety.org/blog/2018/04/amazons-route-5...

[2]: https://samy.pl/poisontap/

[3]: https://scotthelme.co.uk/hsts-preloading/

Rogers Cable is one of the few major ISPs in Canada and they used to (maybe still do? I moved away years ago) modify your page content to include data overage warnings or past due balance warnings at the top of pages you visited.

HTTPS everything please.

One benefit of HTTPS is that ISPs can't insert their ads onto your website. Believe me, there are ISPs that do that.

> If your ISP is MITMing you, I think you have bigger problems then whether they change the content of my static site when you visit it.

Perhaps. But in the UK ISPs are legally required to log every web page you visit. However, they are not going to serve you a fake version of Chrome (which is signed anyway).

>I don't particularly care if people get MITM'ed when visiting my static sites.

I for one would be honored, and then irritated.

> The only benefit of https I perceive in the case of static public content is that ISPs cannot easily monitor which specific pages on my domains are being visited

What about HTTP2?

I don't particularly care if people get MITM'ed when visiting my static sites.