Hacker News Reader

Then again, Vodafone Portugal was caught rewriting CSPs of all your visited pages to whitelist their own domain last year [0].

Nothing can save you if you don't trust your hosting provider, or don't use HTTPS.

However, "was caught" is important :) The more noise they make the more likely they are to get caught.