Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I don't really have an issue with advertisements simply being blocked by individual users who are visiting a customers site or my own site. As an individual you have the freedom to choose not to look at them. The issue is with browser add-ons that detect and conceal a websites ad space with a third party application. The majority of which, these days contain their own advertisements and are in essence stealing a viable product. Is there an ethical way to override the technology or is the only recourse to simply script for detection and lock sites to users with those types of add-ons enabled?

for an example click to view overapps

share|improve this question
+1 Wow, thanks, great promo, I did not know about The problem is that just blocking takes most interactivities (rich content) down too – Gennady Vanin Геннадий Ванин Nov 12 '11 at 9:07
Interesting - I had never heard of this, as I block all advertising content on all my machines. I think you might have trouble finding a legal challenge to things like Overapps, as the end user is still the one making the decision. However, I am not a lawyer. Nor have I seen any cases in this area. – Rory Alsop Nov 13 '11 at 13:24
I don't understand your objection. If you are alright with a user blocking ads within a browser, why can they not block it within an application, I don't see the difference. – Ramhound Nov 14 '11 at 21:14

You can detect client-side modifications to your content by using javascript.

A very simple solution is to load a "base" page without useful content, but which contains your basic page layout, your ad, and some detection code. Once the base page is loaded, yout detection code checks to make sure that your ad is visible and displaying the expected content. Once that verification is complete, your client-side code fetches the "main" content via AJAX and inserts it into the page.

Obviously this is sub-optimal on so many different levels that I won't even go in to it, and obviously it can be circumvented by a determined attacker. But if your priority is ad traffic, and your a small enough target that you're not likely to attract the attention of someone who can circumvent your measures, then solutions (albeit less-than-perfect ones) exist.

share|improve this answer

Legally you can't control what a user does with your ads because it is illegal to enforce your or any advertising.

It is vice versa. To be legally correct you should:

  • you should have received explicit consent of a user to show/delivers him your advertising
  • and even after that, you should have yourself provided a user with opt-out option to refuse/block/unsubscribe from your advertising

There are various laws on internet, services, advertising of different countries which have such common clauses

Unavoidable advertising -- Is it legal in U.S.?

I hoped it was clear that I didn't mean absolute recipe but subject to context and amongst other possible criteria.

Section 5 of FTC Act tells:

"An act or practice is unfair, also in violation of the FTC Act, if it
causes injury to consumers that: (1) is substantial; (2) is not outweighed by countervailing benefits to consumers and competition;
and (3) consumers themselves could not reasonably have avoided"

So, if a webmaster (web resource owner) permits on his web resource the advertisements, like banners, coming from 3d party (not controlled by him), then the only lever to play safely is to eliminate {3), IMO by providing a visitor by opt-out option.

And, US legislature is quite relaxed in comparison to advertising laws of most other countries' (for example, one of the most common requirements of ads distributors is to store copies of provided ads for a year or more) and one does not know in advance the origin of a visitor.

share|improve this answer
In which jurisdiction? Can you cite a relevant article? – curiousguy Nov 13 '11 at 7:19
I updated my answer. I did not give references since they are easily searchable and I had a lot of my previous answers here downvoted for giving references – Gennady Vanin Геннадий Ванин Nov 13 '11 at 11:18
Hi WebMAOhist - references are good when they supoort the content you write, as you have done here. References instead of content are what get downvoted. – Rory Alsop Nov 13 '11 at 13:21
"you should have yourself provided a user with opt-out option to refuse/block/unsubscribe from your advertising" And the "opt-out" option the user has is to close the browsing tab. No ad on a website is "unavoidable" as you always have the option to not go to this website. – curiousguy Nov 13 '11 at 13:38
@curiousguy, this is the same logic as you always have the option not to read spam Email sent to you by closing the browsing tab or by cutting off electricity (power) cables – Gennady Vanin Геннадий Ванин Nov 14 '11 at 7:55

You can't force the user not to modify the data he fetches, as long as it's for "his/her personal use only". That's the negative side of things.

The only way to protect yourself from alike things is trying to detect the overlay (if possible) and act upon detection. I've seen addons like "adblocker" detected on websites several times ( example: ) and which - at least - gave website owners the option to "force" the user to disable the addon before being able to see the site itself. On the other hand, it's a bit like slamming the door into their face and some browser addons are smarter than ye average website javascript implementation.

All in all, I would put it this way: if a user thinks he/she wants to use an addon that displays third-party advertisements instead of the advertisements that originally were displayed on the website, it's their way of opting-out of your website's advertising and opting-in to other advertising at the same time.

I personally can't see the value of this, but they apparently do see some value. I agree that it might be frustrating, depending on the point of view that something like that exists... but it's nothing else than sticking a post-it on your monitor screen with a big smiley, where actually some advertising area would be displayed. Is it logic? No. Do people do it? Yes, I wouldn't have imagined that myself either - until I saw it happen the first time and hit myself on the forehead while asking myself about the reasoning behind that.

I guess it's in the nature of things. Like Murphy's law: if they can mess with things, they will. But they also have every right to. If not, running a website which displays "forced" advertising could be compared to a little "dictatorship"... and (hope you've been following the news the last few months) we've all seen what happens to dictators as time goes by. ;)

As for the legal side of it all: too many countries with too many potential visitors being able to access and browse your website makes "the law" a hard thing to discuss. After all, even US jurisdiction would run into trouble taking a side on questions like these. In the end, it shows one of the qualia of the internet: it can't simply be pinned down, not even a little.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.