Comments on: WARNING: This page may be altered in transit!

WARNING: This page may be altered in transit!

loquacious — Wed, 16 Apr 2008 13:44:51 -0800

ArsTechnica is reporting on the practice of altering and editing web-traffic enroute from the server to your client/browser. Is your ISP, work or connection path altering your requested documents? Find out here.

By: loquacious

loquacious — Wed, 16 Apr 2008 13:45:38 -0800

(Tag suggestions welcomed.)

By: shmegegge

shmegegge — Wed, 16 Apr 2008 14:12:44 -0800

But such interventions, though worrisome, are rare. Only 1.3 percent of pages tested were modified in any way, and 70 percent of those modifications were caused by client proxies installed to deal with pop-ups or to block advertising. so only 30% of 1.7% could be something to worry about? math... hurts. .51%? did I use my calculator correctly? The researchers also note that not every alteration is problematic; some cellular operators, for example, will strip extra whitespace from pages or will provide extra compression for images to keep bandwidth usage low and browsing quick. ok, so then what was that remaining extra tiny percentage of the alterations? was there, in fact, some nefarious alteration made? I understand that some folks wouldn't want their pages messed with no matter what the reason, but I'm just curious what these rare isps are doing.

By: soundofsuburbia

soundofsuburbia — Wed, 16 Apr 2008 14:13:34 -0800

"You're safe! If you are seeing this text, then this page has arrived at your browser without modification." Hooray!

By: jlowen

jlowen — Wed, 16 Apr 2008 14:14:16 -0800

This comment was very witty. Unfortunately it was edited by my ISP.

By: davejay

davejay — Wed, 16 Apr 2008 14:14:37 -0800

CHANGE FOUND: we have detected that this comment has been modified between leaving our server and arriving in your browser. To see the exact changes to this comment, click here.

By: TheOnlyCoolTim

TheOnlyCoolTim — Wed, 16 Apr 2008 14:16:32 -0800

was there, in fact, some nefarious alteration made? In some cases advertising was being inserted, so yes, very nefarious.

By: infinitewindow

infinitewindow — Wed, 16 Apr 2008 14:27:46 -0800

Great. Apparently my ISP is looking out for my best interests as a consumer and is a good value. Thanks, MetaFilter, for bringing this to my attention.

By: mkb

mkb — Wed, 16 Apr 2008 14:31:22 -0800

Well, that's it. SSL everything from now on.

By: delmoi

delmoi — Wed, 16 Apr 2008 14:42:34 -0800

Sounds like most of the pages changes were caused by ad blockers.

By: mr_crash_davis

mr_crash_davis — Wed, 16 Apr 2008 15:03:55 -0800

"Our experiment assumes that you are using a modern web browser with JavaScript enabled. We have tested our experiment with Firefox 2, Internet Explorer 6 and 7" Well, clearly you can't trust this. IE6, "modern"? /pre-emptive

By: majikstreet

majikstreet — Wed, 16 Apr 2008 15:24:51 -0800

that is just freaky.. ISP's shouldn't been screwing with your internets anyway.

By: backseatpilot

backseatpilot — Wed, 16 Apr 2008 15:36:05 -0800

Interesting article, but I'm not sure the tags fit - "freeV!@GR@" and "hotbabes"? A little much, no?

By: DU

DU — Wed, 16 Apr 2008 17:02:16 -0800

I did a similar series of experiments a few years ago and I was able to detect that my ISP was taking all my data, both incoming and outgoing, and converting it to electromagnetic radiation and then beaming it around the world. I dropped them toot sweet!

By: jeffamaphone

jeffamaphone — Wed, 16 Apr 2008 19:16:42 -0800

SSL is very processor intensive. Servers would need massive upgrading. It'd be good for the economy. In other news: Go UW. I love it when my alma mater does cool stuff.

By: Kadin2048

Kadin2048 — Wed, 16 Apr 2008 21:34:50 -0800

Does this mean that only 1.3% of people are using ad blockers? I find that surprisingly low.

By: jewzilla

jewzilla — Wed, 16 Apr 2008 21:49:59 -0800

I used to work for an ISP that did this. One day, my boss complained that the product managers wanted to modify the content on SSL pages, but that it was (obviously) impossible. I jokingly said that, "hey, we install the browser on customers' machines...why not throw in a root CA cert of our own? Then we can run a man-in-the-middle attack on every request and do whatever we want." Someone took the joke seriously, and I spent the next week trying to disabuse people of this insane and immoral idea.

By: TheOnlyCoolTim

TheOnlyCoolTim — Wed, 16 Apr 2008 21:54:24 -0800

It only detects adblockers that function as a proxy.

By: mkb

mkb — Thu, 17 Apr 2008 05:05:08 -0800

I jokingly said that, "hey, we install the browser on customers' machines...why not throw in a root CA cert of our own? Then we can run a man-in-the-middle attack on every request and do whatever we want." Someone took the joke seriously, and I spent the next week trying to disabuse people of this insane and immoral idea. You joke? Think again! Sprint is about to start doing that on their mobile network.