seirdy.one/content/notes/unencrypted-connections-do-mean-injection.md

title	date	replyURI	replyTitle	replyType	replyAuthor	replyAuthorURI	replyDate	syndicatedCopies
Unencrypted connections do mean injection	2024-04-15T10:45:12-04:00	https://lethallava.land/notes/9s4irgazxf	wdym [ISPs inject content], any examples?	SocialMediaPosting	dflxh	https://lethallava.land/@dflxh	2024-04-15T08:52:40-04:00	title url The Fediverse https://pleroma.envs.net/notice/AgIhXz3q628odren2G title url IndieNews https://news.indieweb.org/en

[My previous response to similar concerns]({{<relref "/notes/on-enforcing-https.md">}}) is relevant. To elaborate:

If nothing prevents bad behavior from an ISP, and it has happened before, then you should assume it's happening. This extends to injecting JavaScript apps into insecure connections.

• Marriott hotels inject scripts via Revenue eXtraction Gateway hardware (2012)
• Infrastructure likely belonging to the Great Firewall of China tampers with Baidu analytics to DDoS GitHub (2015)
• Comcast continues to inject its own code into websites you visit (2017)
• How is my ISP able to inject into this webpage? (2019)
• Optimum ISP is MITMing its customers (2023)

Unless you trust every hop from your browser to the destination server (and back), assume anything unencrypted can and will be inspected (and potentially tampered with). Encrypt everything you can.