[austincheney]

I remember that and defacement is a valid and important concern. This is probably the most realistic and valid concern raised here.

These attacks would work well for advertising because the ISP would inject an iframe into the page that sources unique content and beacons data back to the source of the iframe. This breaks anonymity, but it doesn't break privacy since the code in the iframe cannot access the surrounding page.