The future of unencrypted web traffic

Really, we need a regulatory solution. Something like: IF ISP X modifies data in transit or
modifies DNS results, THEN ISP X is no longer a "common carrier" and becomes responsible for
all the content it transmits.

I bet that'd put an end to these kinds of funny games much faster than any technical solution.

Name-based virtual hosting doesn't work with https. This means there needs to be one IP
address per web site, which doesn't seem viable until we are all using IPv6.

In Germany the situation is specal.  Providers are not liable for forbidden content
(pornography for minors, "special interest" pornography as sodomy, nazi propaganda), because
they only pass it through.  BUT if the manipulate pages they may turn into a content provider
which is responsible.

The real solution is to make it mandatory for ISPs to indicate if they are manipulating
content and what restrictions they are putting on their network connections. (like not giving
you a public IP address, port blocking, content filtering, transparent proxies, P2P
monitoring, etc etc.)

Then make it easier and cheaper to compete by eliminating regional monopolies for phone and
cable providing and releasing restrictions on the use of the radio spectrum for data
transmissions. In addition to releasing these restrictions encourage the growth of
fiber-to-the-home as a municipal service, like sewage or electrical connections. Have cities
hire companies to do the cabling and maintain it, but not provide data services over it. Then
let people pick what ISP they choose to use over the fiber.

All of this together will allow customers to choose between having content filtered and not
and will incourage a massive growth in competition, bandwidth, and drop in the costs
associated with internet access. This would free up resources for VoIP and other stuff
lowering the costs of that also.


All this speak of regulating what ISPs can and cannot do is just going to make problems worse.
This would increase the red tape ISPs go through and all that sort of BS and in addition will
restrict innovation by locking these people into a forced mode of operation. There are plenty
of people that would love to have ISPs filtering out malicious websites and such things, for
example. All that is needed is a way to make it easy for people to know if this sort of thing
is happenning.

I hate to recommend anything to do with lawyers, but isn't this a perfect job for them? If an
ISP takes someone's web page and alters its content before serving it up, they are surely
creating a derived work for commercial gain, in flagrant violation of the owner's copyright.
We aren't talking a few lines of symbol definitions in a million lines of system. We're
talking about plagiarism of an entire work and them deliberate misrepresentation of the
authorship and origin of the bastardised version! 

So set up a web site, with copyrighted material. Make it necessary for the users to accept the
copyrights explicitly (sign up, read, all modification strictly verboten, click OK). Get a
tame user to browse and obtain evidence of the derived works. Then sue! Possibly even for
libel, rather than copyright violation. Adding adverts, possibly containing malware, could be
highly damaging to the copyright owner and/or the owner of the website serving the copyrighted
material without the adverts).

Note the adverts might inadvertently cause offense or outrage through mis-targetting. "First
picture of motorcyclist shot dead on motorway" alongside a motorcycle advert tagline "Nobody
ever wished they stayed in more". An advert for a mobile phone called a "Blast" alongside what
later proved to be an erroneous report of a man killed by an exploding mobile. Such is
unfortunate, but the ads were placed there by an organisation invited in by the copyright
owner. Imagine if not. Also the ads might contain malware. ISPs beware. You could get sued
from both sides (copyright owner and browser user) at once!

And finally, consider the ISP's customers. If my ISP starts doing this I'll immediately take
my custom elsewhere, and make a small-claims claim for the cost of being forced to do so. Some
customers might also be able to sue for larger damages, if for example they are already
post-processing web pages for themselves (loading share prices into databases and suchlike)
when such post-processing is broken by an ISP choosing to alter the HTML in transit. 

All in all, it's a really dumb idea for the ISPs. I can't imagine it'll catch on, they'll be
making themselves into large and ill-defended targets if they do. 

The paragraph about signed certificates misses an important point.  The 
only thing keeping an ISP from proxying https traffic and effectively 
mounting a man-in-the-middle attack is the browser's certificate check.  
And if the end-user just clicks through the browser warnings, using https 
instead of http does nothing to prevent the ISP from messing with content.

A simple solution to this particular problem is to for the web server to encrpyt simply a
checksum to the contents of the page. This would greatly cut down on the comuptational
overhead on the server but retain the benefit of preventing modification by the ISP.