I thought HTTPS was supposed to prevent this sort of man in the middle attack? (Or at least make it harder) -- and I thought that most websites used HTTPS these days...
or am I misunderstanding?
If they are able to do this, and are injecting JavaScript for something as low-return as online ads, then what is to prevent them from changing the news headlines on <insert your news website of choice here>, or the stock ticker feed... How do we know that they aren't?
Do we, as a community, have any mechanism to detect if these sorts of attacks are occurring?
or am I misunderstanding?
If they are able to do this, and are injecting JavaScript for something as low-return as online ads, then what is to prevent them from changing the news headlines on <insert your news website of choice here>, or the stock ticker feed... How do we know that they aren't?
Do we, as a community, have any mechanism to detect if these sorts of attacks are occurring?