I opened my browser today & somehow, my ISP sent me a message box inside my browser telling me Im nearing my data cap for the month. How the hell did they do that? How can they get to my PC, inside my browser & send me a message?
Edit: It wasnt the very first page I opened. The message box only appeared once I started a video stream in a new tab.
Edit 2: Ok, have some clarity now. Apparently my VPN was actually off & this message only popped up once I visited a page not using https. So from the great answers here (thanks for the responses), it seems my ISP intercepted my traffic, injected a JavaScript message box, and sent it back to me. Very creepy, but hey, thats ISPs for ya.
Operator: The call is coming from inside the house!
Did you have the VPN connected at the time?
Your VPN is not working if they were able to do that.
Without a VPN its simple HTML injected into whatever you requested, kinda messed up but not actually that hard
Two ways off the top of my head they could do this:
​
1. They can inject javascript into any unencrypted website you visit. This could present itself as a message box or they could redirect you to their notification page. There’s a lot they can do there actually, but anywho… They would not be able to inject javascript on any website if the connection was going through your VPN.
2. If your computer is using their DNS servers, which your router would have enabled by default, they could return the IP address for their notification page instead of example[.]com’s IP address. You can change this in your computer’s connection properties. You can also likely change this on your router if you don’t want any of your home’s devices to use your ISP’s DNS servers.
This has happened to me and I think it oversteps some boundaries they should respect, but I imagine it’s totally legal. Hope that helps.
Your ISP can put you into what’s known as a padded cell. When you attempt to visit a site, you get redirected to their site. This happens a lot when someone is found to be sharing media that received a DMCA complaint.
So just to get this straight:
You’re using a VPN. You know you have a cap; you’re near the cap. That’s not the issue.
If you were on the clear Internet, you’d understand how they could inject such a message. That’s well-known; ISPs do that, much to the irritation and outrage of many users.
But since you’re on a VPN, you’re unsettled that somehow despite that they were still able to inject this. Your assumption is that since everything goes through the VPN, at very least, the infrastructure between your device and your VPN ought to be fully encrypted and there should be no way to inject anything in there.
I am curious myself what happened here.
I am unsure how they do this from their side.
They are not “inside your PC”, they just injected stuff to your traffic. ISP sees and controls all your web traffic.
From a few years ago: [Code injection: A new low for ISPs](https://www.infoworld.com/article/2925839/code-injection-new-low-isps.html)
TIL people have data caps on their broadband. Wow
My assumption is because your isp is supplying your internet connection. as in you still have a data cap, regardless of vpn, unless you get unlimited data.
​
vpn doesn’t remove data cap, also using a vpn doesn’t hinder the fact your computer is processing the data sent from your isp.