Comment by moehm

The article mentions they are injecting a http header, so shouldn't https be enough to prevent tampering?