Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have HTML and SWF files that I want to put on a CD. How can I protect the contents on the CD, or make it difficult for someone to burn or duplicate them?

share|improve this question
Can you expand on the threat a little - who do you expect to attempt to copy the disk? Regular users? Or professional software pirates? – Graham Hill Apr 13 '12 at 11:35
Can you expand on the value of the asset a little? Are you prepared to spend $50, or $100,000,000 to protect it? Are you prepared to get into serious trouble for it? (See for example ) – Graham Hill Apr 13 '12 at 11:43
Well he can forget about the latter. At the end of the day major pirates will win. As for Sony's rootkit, it never affected linux machines ;) – ewanm89 Apr 13 '12 at 11:44
Read on, please. There's some thought about security that states that once you don't have physical protection to it, it's not yours anymore. Sooner or later, anyone who has access to the thing (be it a cd, dvd, flash drive, chip, etc) can make a reverse engineering of it. I know, so far some cards and tokens are protected, but you can rely on it if your protection is that valuable. What's your objetive in such files ? You will send it to someone, sell it anyway, or it's your backup? If you're the only one using it, making a kind of backup, you'll be better encrypting it than trying to protec – woliveirajr Apr 13 '12 at 12:15
This is a duplicate of the following post. The answer is the same. You cannot prevent a user from copying files it can read.… – Ramhound Apr 13 '12 at 13:05

Fundamentally, you can't. It's impossible.

This is because you are unable to distinguish between an attacker and a legitimate user. You want the legitimate user to be able to access the data, you want the attacker not to be able to, but you can't tell if Alice is a legitimate user or an attacker.

Despite it being impossible, a lot of people have put a lot of effort and resources into trying to do it anyway. The closest they've come is with two approaches:

  1. Have the users access the data only using computers that you control.
  2. Authenticate each user before giving them access to the data, analyze their usage patterns, and revoke their access if you believe them to be an attacker.

Note that neither of these techniques work (because it's impossible) but they can sometimes delay unsophisticated attackers very briefly. (While unsophisticated attackers can't break these techniques, they can download copies of your data from sophisticated attackers.)

share|improve this answer
thanks for the answers. I'm prepared to pay some few hundreds of dollars. At least i want to make it difficult for users to make copies to friends. – karto Apr 24 '12 at 11:53

Realistically, you cannot. Anyone who has the CD in their possession and can read the files on it, can make a copy of it.

Your best course of action is one of two options: physical security (only give the CD to people who you trust will not act contrary to your interests), or encryption (encrypt the files on the CD so that only people who have the decryption key can read the files, and only give the decryption key to people who you trust will not act contrary to your interests).

But once someone has a cleartext copy of the file (e.g., the HTML or the SWF file), you can't realistically stop them from making copies and sharing copies of the file.

If you have a high budget, you may be able to embed a unique watermark in the file that is different for each person you give the CD to. The idea would be that, if they do share copies of the file widely, and if you later come across a copy, you can tell which person was the original source. But you can't prevent copying and sharing.

P.S. Please don't cross-post your question on multiple Stack Exchange sites.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.