TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Ask HN: My ISP is injecting code to pages. What measures can I take?

12 点作者 bbayer大约 6 年前
Today I saw a strange pop up entitled with logo of my ISP while I was browsing a random page. First I thought it was an ad added by site owner but when I check closely it was even on an another pop up. I checked the source and saw that it was clearly coming from somewhere else. An iframe added to page by using a JS script that sourced from direct IP address. No domain, just an IP and path. I am sure it wasn&#x27;t part of site because iframe was just a static page. It doesn&#x27;t contain any tracker links that can be seen every ad today. When I refreshed the page, pop up disappeared.<p>This page could be my mail or bank account or anything that might contain private information. Is there any practical way to prevent something like this?

3 条评论

richinfante大约 6 年前
&gt; An iframe added to page by using a JS script that sourced from direct IP address<p>This can kind of page tampering happen if your connection to the website is not encrypted (<a href="http:&#x2F;&#x2F;" rel="nofollow">http:&#x2F;&#x2F;</a> instead of <a href="https:&#x2F;&#x2F;" rel="nofollow">https:&#x2F;&#x2F;</a>)<p>For practical defense against this, you can install the HTTPS Everywhere browser extension: <a href="https:&#x2F;&#x2F;www.eff.org&#x2F;https-everywhere" rel="nofollow">https:&#x2F;&#x2F;www.eff.org&#x2F;https-everywhere</a> which attempts to redirect you to secure versions of websites.<p>If there&#x27;s no secure version of the site available, there&#x27;s not much you can do to prevent this besides changing your ISP or using a VPN, however this just moves the trust issue to a different entity.
noonespecial大约 6 年前
&gt;This page could be my mail or bank account or anything that might contain private information.<p>They should not be able to read or inject into any URL that starts with <a href="https:&#x2F;&#x2F;" rel="nofollow">https:&#x2F;&#x2F;</a> so your mail, bank, paypal etc should be OK.<p>That said, any tampering at all is a really sucky thing to do. If you can&#x27;t switch ISP&#x27;s I&#x27;d get a VPN subscription somewhere and send all of your traffic through it.
评论 #19513239 未加载
uberman大约 6 年前
It might help to ensure your DNS is not provided by your ISP. You might also want to look into a &quot;VPN&quot;.