zlacker

It doesn't need https.

>>teknop+(OP)
Of course it does. Otherwise intermediaries can inject ads, tracking, spoof the content, or even redirect it to a malicious page.

>>Square+K1
https does not 100% prevent any of those things.

>>teknop+64
How can someone spoof the page/inject ads if the site is served over https?

They would need to have compromised one of the root certificates on your machine to not give you a giant security warning.

In modern browsers there’s not even a button to bypass them (although I know I chrome you can type “this is unsafe” to a hidden input in the error page and it will let you bypass it temporarily).

>>charro+C6
MITM - https termination at a gateway or proxy.