Can an ISP do this? I'm no security expert, but this looks like a MITM attack
imgur.com
imgur.com
You should ask lawyers in your country about that.
> Isn't my browser sending each visited-domain's cookies to my ISP now?
Yes, but that's not different even if they didn't hijack your sessions. Everything goes thru your ISP, so in any case, they see everything (not just cookies) that goes thru http.
> Doesn't this pose a security risk?
Yes.
> I have no idea whom to complain to.
As first measure, complain with those sites and ask them to implement and enforce TLS and move all traffic to https. That way your ISP doesn't see your traffic and can not MITM you. Then, complain to your ISP or even better find new one (after you complained to them, vote with your money).
Btw, TLS is really first solution (but not the only and last) to this (and many other) problems on the web.
Some providers put this kind of stuff in one of the following cases:
- you didn't paid your bills;
- they have new offers to show you;
- they are just jerks.
@ OP, what happens when you browse to https://www.stackoverflow.com ?
Regardless of whether it's MITM or DNS hijacking causing the issue, it's clearly your ISP doing it.
- I have paid the bills
- Clicking continue just goes into my ISP account panel and not to the actual site, so not really an "offer" popup or anything.
- Yes they definitely are. Most of the "my Internet" now points to their servers. I have no idea how long they're going to take to fix this.