Hacker News Reader

HTTPS will keep out injection during transit from the server to your computer. But it will do absolutely nothing against toolbars and other browser extensions and that is what this article is about so at a guess the 5% is on top of injection in transit.

View on HN

Why does the browser even allow any toolbar/extension to modify the content that was delivered on a HTTPS connection. Isn't the data that is delivered over HTTPS pristine that it should not be modified at the browser endpoint by the browser.

I am a layman in security and do not understand a lot of this. May be I missed something here. Is my question correct?

Not all HTTPS connections are to your bank.

You're probably reading this page using https and there are quite a few extensions to modify the look and feel of hackernews.

Changing on-page content is just about the only reason extensions exist in the first place. Without that you could retire just about all of them.

Extensions MUST be able to modify content. Think about noscript or adblock - if ads were served over https, and you were not allowed or could not technically block them? If analytics trackers were all over HTTPS and can't be blocked or disabled?

Reply on news.ycombinator.com