-9

Please redirect to an HTTPS connection by default on stackoverflow.com

To illustrate the problem, please see the screenshot below where a man-in-the-middle attack is being used to forge responses from Stack Overflow and inject advertisements.

enter image description here

A wildly crude estimate of the financial cost of this attack is as follows:

  • Xfinity hotspots / All Wifis in the US = 1.5m/77m = 2%

  • SO revenue = $2m in 2010 * 5x growth = $10m per year

  • 50% of ad clicks will be on the injected ad (because it is more interactive and new)

  • 20% of visitors in the US

LOST REVENUE IS $20,000 PER YEAR DUE TO COMCAST ALONE

Sources for numbers above

Improve this question
10
  • Alos, FWIW, this ad is damaging your reputation by showing you endorse the Olympics and Comcast/NBC.
    – William Entriken
    Feb 11, 2014 at 14:06
  • 11
    "...please see the screenshot below where a man-in-the-middle attack is being used to forge responses from Stack Overflow and inject advertisements." I'd dare to say that that's a problem with your ISP if they alter your traffic. ISPs are the ultimate men in the middle, so if they decide to alter your traffic, you have a problem. Try switching or suing.
    – Time Traveling Bobby
    Feb 11, 2014 at 14:09
  • 1
    This thread forwarded to epic.org for lawsuit possibility.
    – William Entriken
    Feb 11, 2014 at 14:30
  • @FullDecent, oh, man, you're a funny one. I mean, who...wait, you're serious? o.O
    – tombull89
    Feb 11, 2014 at 14:35
  • 2
    @FullDecent Lawsuit from who to who and for what?
    – Dan
    Feb 11, 2014 at 14:42
  • 5
    I was going to flag it, but there doesn't seem to be an option for "Incomprehensible idiocy"
    – Dan
    Feb 11, 2014 at 14:43
  • Can epic.org sue people for absurd, trolling, waste of time posts?
    – Rob Moir
    Feb 11, 2014 at 14:50
  • No, epic.org provides advice. I run a website that Comcast is injecting ads into and implying that I support the Olympics, which I don't. FTC 16 CFR Part 255 applies. If SO don't care about injection, that's fine. I think it's unacceptable and am happy to file against Comcast with the right advice.
    – William Entriken
    Feb 11, 2014 at 20:09
  • You got it backwards, not the site owners should care, you as customer of Comcast should care. They're altering your traffic, injecting (possible malicious) advertisement (don't forget that advertisement networks have been hijacked before) and there's nothing stopping them if they want to replace advertisements or block other content. Website owners are not affected in the slightest, you as customer on the other hand...
    – Time Traveling Bobby
    Feb 12, 2014 at 11:29
  • In the United States, regulatory capture results in the ISPs writing the law. In most of the US (by square miles) there is only one choice of broadband ISP. So we are not customers of Comcast -- we are loyal subjects of Comcast. It also means we don't have access to *The Internet", we have access to "Comcast internet". // Commenting because this still gets downvotes. // This post is right from when it became public that NSA infiltrated Google's network and then Google strongly supported HTTPS everywhere. Which of course is best practice now.
    – William Entriken
    Dec 10, 2018 at 16:31

1 Answer 1

Reset to default
9

This has absolutely nothing to do with SO and something like this doesn't even need to be posted. It looks like your ISP is the one injecting the ads (or worse, malware) so talk to Comcast. HTTPS won't actually prevent this MITM, either.

Improve this answer
2
  • 1
    indeed - see also arstechnica.com/tech-policy/2013/04/how-a-banner-ad-for-hs-ok
    – tombull89
    Feb 11, 2014 at 14:55
  • 11
    HTTPS does kind of prevent this attack, in the sense that the only way to do it over HTTPS is to use an SSL terminating proxy with a bogus certificate, and your browser will throw up a big scary warning about that unless it's been configured to trust the authority issuing those certificates (which I hope you're not dumb enough to do voluntarily). Of course, at that point, your choices are to a) accept the bogus certificate, b) not use HTTPS over the proxying AP, or c) find some way (e.g. a VPN) to bypass the proxy.
    – Ilmari Karonen
    Feb 11, 2014 at 15:08

Not the answer you're looking for? Browse other questions tagged .