up vote 55 down vote favorite
8

My ISP has a bad habit of putting every page I visit into an iframe so they can overlay it with their commercials etc.. (I'm guessing they are using a transparent proxy to do it)

Is there an add-on that can remove the frames or block the attempt to do so?

Something like AdBlock does not work in this case.

share|improve this question
  • 17
    What ISP do you have? And are you sure it's the ISP doing this? That sounds very sketchy, and I wonder if you might have a virus that's doing this. I'm not aware of any ISP except for a handful of free dialup providers that do this. – nhinkle♦ Jan 28 '13 at 3:12
  • 7
    It's the ISP alright :-) As soon as I enable VPN I don't have the problem. Problem is the same on Windows, Android, WinRT (surface), iOS, Linux... I'm in China... It's pretty common here. StackOverflow/Superuser even informs me that I'm framed, and then removes the frame. – TimothyP Jan 28 '13 at 3:41
  • 34
    Because this is China, they want to monitor and block everything – TimothyP Jan 28 '13 at 6:22
  • 3
    If possible, go to another ISP ASAP. – user89864 Jan 28 '13 at 9:14
  • 13
    For best results, live and work in a different country. – Michael Butler Jan 28 '13 at 20:21
up vote 52 down vote accepted

If the frame-busting code on Stack Exchange sites is working for you, then you could write a userscript to insert frame-busting code on every site. If you've never made a userscript before, here are some resources to get started:

There's a good Stack Overflow thread on frame busting and frame-bust-buster-busting. You could theoretically take some of the code from the answers on the SO post and inject them into every page using a userscript.

share|improve this answer
  • This seems to be what I'm looking for, thnx – TimothyP Jan 28 '13 at 7:02
up vote 38 down vote

Vote with your wallet and don't use ISP that does this garbage.

If that's not possible, your next best bet would be to hide all the traffic from your ISP so that they can't see inside and consequently modify it. You can accomplish this by encrypting all/as much as possible of your traffic.

You can do that with browser addons like HTTPS Everywhere. It has a large list of websites to which this addon forces HTTPS connection. Also make sure your browser has SPDY protocol enabled. As part of SPDY spec, all connections are encrypted.

To go one step further, consider using some VPN service. That will make content of your traffic totally hidden to your ISP and will prevent such content modification.

share|improve this answer
  • 4
    We use VPN as much as possible, but they actively scan and block it. Right now OpenVPN has been rendered useless and PPTP connections... well we're lucky if they can stay up for 10 minutes. We're looking into changing providers... but there's a big chance that won't do us any good, privacy isn't something that is respected in China – TimothyP Jan 28 '13 at 6:21
  • If they are blocking openvpn and pptp, there's still ipsec. You can also setup vpn-like connection using SSH protocol. One more thing to consider is to do all your browsing from outside of China by using some sort of Remote Desktop connection. It will be slower, but at least they won't spy on you.. – Mxx Jan 28 '13 at 6:28
  • 10
    Is getting the hell out of the PRC an option? I don't see how any person who makes a living in tech could really work there without it feeling like one hand was tied behind their back. Are they still blocking GitHub? They started that garbage right in the middle of my trip there… – Garrett Albright Jan 28 '13 at 7:38
  • 4
    Hey, Github works without issues. What can I say... went to China a few years back for work, met a girl, got married, etc... but that's not for S.U. :p – TimothyP Jan 28 '13 at 13:04
  • 3
    @TimothyP Not to FUD, but are you quite sure that Github is working exactly the way you think it is? – kojiro Jan 29 '13 at 1:40
up vote 16 down vote

If your ISP is doing this by injecting JavaScript sourced from a specific domain, you could use a JavaScript blacklist extension to avoid running any JavaScript from that domain. (One of the public hotspots I connect to uses this approach.) However, if your ISP injects the entire script directly, then I don't think this will work.

Chrome: JavaScript Blacklist

Firefox: YesScript

You should also be able to use ad blocking extensions to block JavaScript. The most popular ones support custom filter lists, and it should be pretty easy to add an extra filter pattern to catch the framing code. If you're already running an ad blocker anyway, this might be the most sensible approach.

share|improve this answer
  • I'll try and figure out what they are doing exactly first – TimothyP Jan 28 '13 at 6:29
  • 4
    It would be helpful to get a full HTML dump from a page that gets framed. View-source on the page holding the frame would be instructive. – nhinkle♦ Jan 28 '13 at 6:51
  • @jjlin if web pages are displayed Inside iframes, I’m unsure what blocking Javascript completely would provide. – user2284570 Jul 5 at 17:23
  • @user2284570 As the first sentence says, "If your ISP is doing this by injecting Javascript sourced from a specific domain..." But these days, it's probably simpler just to go through a VPN or HTTPS proxy. – jjlin Jul 5 at 21:48
  • @jjlin easier to say than to do : 社會信用體系. Not sure using a ᴠᴘɴ is a bad cast… – user2284570 Jul 6 at 3:31
up vote 15 down vote

Besides the frame busting trick, I would suggest getting the IPs of the servers that serve the framed pages and block them. If you are using China Telecom like me, they don't always frame the pages and, when they do so, a simple reload will give you the un-framed page. I guess they cannot frame everything since hijacking millions of connections per minute would bring down their resources quickly.

So what I ended up doing is to block all these IPs so I get a clean connection error when they try to mess with the current request. Then I know I can reload to get the real page. An added advantage of this method is that you don't send these servers any information, while for the frame-busting trick, the request still goes there (and given the crap they send back, I wouldn't trust them with the sensitive info that might end up in their logs).

For information here the IPs I've currently collected and blocked:

enter image description here

share|improve this answer
  • Hey, thnx I will give this a try as well – TimothyP Jan 28 '13 at 13:32
  • 2
    Where is this screenshot from? – That Brazilian Guy Jan 29 '13 at 12:51
  • 4
    @ruda.almeida, from Windows Firewall (Advanced settings). – this.lau_ Jan 29 '13 at 13:35

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.