Can a website know if I am running a userscript?

Can, for example, Facebook.com run a version control script on my browser and find out if I am running altered HTML code with the use of a script?

Could that be done with a script that can read the HTML code in the cache and produce some kind of hash tag that is sent back to the server and compared with the code that was sent to the client?

Answers


Yes, in theory, a site can deduce the presence of scripts in various situations.

This is not foolproof and usually is way too much trouble for the negligible "threat" to the site. (Then again, some webmasters can be obsessive-paranoids about such things. ;) )

Some methods, depending on what the script does (in no particular order):

  1. Gaming or auction sites can monitor the timing (speed and regularity) of "bid" clicks.

  2. A site can AJAX-back the count of say, <script> nodes, looking for extras.

  3. Similarly, a site can AJAX-back any or all of the content of a page and compare that to expected values.

  4. Extra AJAX calls, or AJAX calls that don't meet hidden requirements can be noted (and allowed to appear to succeed).

  5. If the script uses unsafeWindow in just the right (wrong) way, a page can detect that and even hijack (slightly) elevated privileges.

  6. "Clicks" that were not preceded by mouseover events can be detected. I've actually seen this used in the wild.

  7. A page's javascript can often detect script-generated clicks (etc.) as being different than user generated ones. (Thanks, c69, for the reminder.)

Ultimately, the advantage is to the userscript writer, however. Any counter-measures that a webpage takes can be detected and thwarted on the user end. Even custom, required plugins or required hardware dongles can be subverted by skilled and motivated users.


Update: The methods below are fully ineffective as of Greasemonkey 3.3.



See (Dead link) How-to Detect Greasemonkey.

Javascript to detect if GM is installed (but not whether a script is actually running on that page):

Obsolete Option 1:

if (Components.interfaces.gmIGreasemonkeyService) {
  alert("I smell a monkey!");
}

Obsolete Option 2:

<script type="text/javascript" src="resource://greasemonkey/addons4.js"></script>
<script type="text/javascript">
if (typeof GM_addonsStartup !== "undefined") {
  alert("I smell a monkey!");
}
</script>

Need Your Help

Dictionary-like structure with custom search behavior

c# dictionary customization

I'm looking for a data structure which can do search on a specific key. The key is an interval. Once a single value is passed to this structure it should find the correct interval (appropriate key)...

WPF Slow window resizing with borderless window

c# .net wpf optimization mvvm

I have a borderless transparent (rounded corners) WPF Window. It is a fairly complex app with a lot of dialogs that can be shown or hidden. We do this via MVVM binding to the Visibility property ...

About UNIX Resources Network

Original, collect and organize Developers related documents, information and materials, contains jQuery, Html, CSS, MySQL, .NET, ASP.NET, SQL, objective-c, iPhone, Ruby on Rails, C, SQL Server, Ruby, Arrays, Regex, ASP.NET MVC, WPF, XML, Ajax, DataBase, and so on.