As a content provider this is why you need HTTPS, and it's why you should ensure you certificate is in the transparency logs, and that your site requires CT entries.
The sad thing is that with many kinds of cybercrime, it's easier to fix the security vulnerability, than it is to track down the criminals and make them stop :)
In this case, the vulnerability is using HTTP, not HTTPS.
Edit: Also, what stops those ISPs from impersonating the requested host by means of their own root certificate, just like antivirus software does it?
You mean like that "setup software" Comcast spent ages trying to pretend I had to install just to get things running?
I ran Linux in those days, which always meant a little extra support time but I never had to install jack.
> Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites.
> Late on December 24, Chrome detected and blocked an unauthorized digital certificate for the "*.google.com" domain.
https://security.googleblog.com/2013/01/enhancing-digital-ce...
Terms and conditions of this comment: This comment is provided for free to <https://news.ycombinator.com> AKA "Hacker News", including any redistribution to be considered under the clause of fair use. Any other redistribution, including injection of third party content or surrounding content, chrome, or any other HTML element(s), be it in static or generated code, is considered a violation of the terms of this contribution.