> What would be the economic incentive towards carrying out a sufficiently complex MITM attack on a blog or a newsfeed?
Gee, I don't know, imagine plastering your brand all over the NYT homepage or libelously accusing your political opponent of some heinous crime or behavior or injecting your malicious script onto millions of visitors' machines.
> There's no MITM required for this.
Um, local scripts injecting ads are still MITM by definition.
> TLS wouldn't fix this in any way as far as I am aware.
Yes it would. That's why pesky "antivirus" software MITMs TLS connections on your local computer.
Gee, I don't know, imagine plastering your brand all over the NYT homepage or libelously accusing your political opponent of some heinous crime or behavior or injecting your malicious script onto millions of visitors' machines.
> There's no MITM required for this.
Um, local scripts injecting ads are still MITM by definition.
> TLS wouldn't fix this in any way as far as I am aware.
Yes it would. That's why pesky "antivirus" software MITMs TLS connections on your local computer.