-9

Please redirect to an HTTPS connection by default on stackoverflow.com

To illustrate the problem, please see the screenshot below where a man-in-the-middle attack is being used to forge responses from Stack Overflow and inject advertisements.

enter image description here

A wildly crude estimate of the financial cost of this attack is as follows:

  • Xfinity hotspots / All Wifis in the US = 1.5m/77m = 2%

  • SO revenue = $2m in 2010 * 5x growth = $10m per year

  • 50% of ad clicks will be on the injected ad (because it is more interactive and new)

  • 20% of visitors in the US

LOST REVENUE IS $20,000 PER YEAR DUE TO COMCAST ALONE


Sources for numbers above

marked as duplicate by yannis, Time Traveling Bobby, Flyk, Sathyajith Bhat, James Feb 11 '14 at 14:54

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Alos, FWIW, this ad is damaging your reputation by showing you endorse the Olympics and Comcast/NBC. – William Entriken Feb 11 '14 at 14:06
  • 11
    "...please see the screenshot below where a man-in-the-middle attack is being used to forge responses from Stack Overflow and inject advertisements." I'd dare to say that that's a problem with your ISP if they alter your traffic. ISPs are the ultimate men in the middle, so if they decide to alter your traffic, you have a problem. Try switching or suing. – Time Traveling Bobby Feb 11 '14 at 14:09
  • 1
    This thread forwarded to epic.org for lawsuit possibility. – William Entriken Feb 11 '14 at 14:30
  • @FullDecent, oh, man, you're a funny one. I mean, who...wait, you're serious? o.O – tombull89 Feb 11 '14 at 14:35
  • 2
    @FullDecent Lawsuit from who to who and for what? – Dan Feb 11 '14 at 14:42
  • 5
    I was going to flag it, but there doesn't seem to be an option for "Incomprehensible idiocy" – Dan Feb 11 '14 at 14:43
  • Can epic.org sue people for absurd, trolling, waste of time posts? – Rob Moir Feb 11 '14 at 14:50
  • No, epic.org provides advice. I run a website that Comcast is injecting ads into and implying that I support the Olympics, which I don't. FTC 16 CFR Part 255 applies. If SO don't care about injection, that's fine. I think it's unacceptable and am happy to file against Comcast with the right advice. – William Entriken Feb 11 '14 at 20:09
  • You got it backwards, not the site owners should care, you as customer of Comcast should care. They're altering your traffic, injecting (possible malicious) advertisement (don't forget that advertisement networks have been hijacked before) and there's nothing stopping them if they want to replace advertisements or block other content. Website owners are not affected in the slightest, you as customer on the other hand... – Time Traveling Bobby Feb 12 '14 at 11:29
  • In the United States, regulatory capture results in the ISPs writing the law. In most of the US (by square miles) there is only one choice of broadband ISP. So we are not customers of Comcast -- we are loyal subjects of Comcast. It also means we don't have access to *The Internet", we have access to "Comcast internet". // Commenting because this still gets downvotes. // This post is right from when it became public that NSA infiltrated Google's network and then Google strongly supported HTTPS everywhere. Which of course is best practice now. – William Entriken Dec 10 '18 at 16:31
9

This has absolutely nothing to do with SO and something like this doesn't even need to be posted. It looks like your ISP is the one injecting the ads (or worse, malware) so talk to Comcast. HTTPS won't actually prevent this MITM, either.

  • 1
  • 11
    HTTPS does kind of prevent this attack, in the sense that the only way to do it over HTTPS is to use an SSL terminating proxy with a bogus certificate, and your browser will throw up a big scary warning about that unless it's been configured to trust the authority issuing those certificates (which I hope you're not dumb enough to do voluntarily). Of course, at that point, your choices are to a) accept the bogus certificate, b) not use HTTPS over the proxying AP, or c) find some way (e.g. a VPN) to bypass the proxy. – Ilmari Karonen Feb 11 '14 at 15:08

Not the answer you're looking for? Browse other questions tagged .