"Mike"  wrote

| Once you're out of the "server" things still aren't safe and solid ...
|
| There's injection into what the server *originally* sent *before* it gets
to
| the client. Look up the furore around "BT Phorm", part of which involved
| BT (as an ISP) injecting profiling and other stuff into pages that had
| nothing to do with them.
|
| Some of this shows up when a web developer can't understand why stuff
| works for some users, but not others -- and the common feature becomes
| an ISP tampering with the data in transit (adding or editing the HTTP
| on the fly).

  That's an interesting case, but probably very rare.
The only thing I've ever seen is some ISPs intercepting
a 404 to inject their own ad page. In general an ISP
is the least of your worries.

    But there can be unexpected
adulteration. For example, in the US a large percentage
of webpages are actually coming from Akamai, used as a
load balancing service even by such big compaines as
Microsoft. Several years ago Akamai decided to start
double dipping by selling traffic data. It's like a moving
company that decides to copy and study the contents
of desks that it moves in order to profile their customers
and sell that data to realtors and kitchen remodelers in
the destination city. In other words, the content and
customers' data are actually none of their business in
any way that could be construed, yet it's apparently
not illegal. And good luck blocking Akamai. They're a
sleazeball built into the backbone. As far as I
can tell, a sniffer can see that your browser is contacting
them, but the connection is somehow direct through the
target site and doesn't go through DNS. In other words, your
browser loads index.html from acme.com and it comes
from an Akamai server, but the browser doesn't know that
and never did a DNS lookup for Akamai.

http://blogs.wsj.com/digits/2010/11/30/a-new-type-of-tracking-akamais-pixel-fre
e-technology/

   The full article is now blocked. Essentially what it says
is that Akamai carries 15-30% of Web traffic (as of 2010)
and in 2008 started offering spyware services to clients,
tracking browsers' activity. The article goes on to say that
Akamai doesn't track if people delete their cookies, but that
excuse makes no sense. They don't need a cookie. That's
the whole point of their "pixel-free" method. They can track
without tracking devices because they're serving all the
webpages!

--- SoupGate-Win32 v1.05