Hacker News Reader

Comment by acomjean | Hacker News Reader

Do these injectors work with https (ssl) sites?

Where in the web page fetch/render process does this occur?

Most extensions and toolbars have access to the DOM via browser javascript methods (Safari, Chrome, Firefox), or C++ Browser Helper Objects (BHO's) in IE, so they can inject and redirect content if the user installs it.

Not unless they do something incredibly stupid like install a certificate authority and hijack every SSL session. [1]

[1]: http://en.wikipedia.org/wiki/Superfish#Lenovo_security_incid...

They're often browser toolbars, which'll work fine on SSL sites.

That HTTPS supposedly keeps out ads like this was one of Google's selling points for suggesting HTTPS to publishers. I was expecting this article to end with "and that is why all sites should be running HTTPS now".

5% is a lot. If HTTPS reduces this number to 1%, it might be worth the change.

HTTPS will keep out injection during transit from the server to your computer. But it will do absolutely nothing against toolbars and other browser extensions and that is what this article is about so at a guess the 5% is on top of injection in transit.

Why does the browser even allow any toolbar/extension to modify the content that was delivered on a HTTPS connection. Isn't the data that is delivered over HTTPS pristine that it should not be modified at the browser endpoint by the browser.

I am a layman in security and do not understand a lot of this. May be I missed something here. Is my question correct?

Not all HTTPS connections are to your bank.

You're probably reading this page using https and there are quite a few extensions to modify the look and feel of hackernews.

Changing on-page content is just about the only reason extensions exist in the first place. Without that you could retire just about all of them.

Extensions MUST be able to modify content. Think about noscript or adblock - if ads were served over https, and you were not allowed or could not technically block them? If analytics trackers were all over HTTPS and can't be blocked or disabled?

Reply on news.ycombinator.com