Does disabling right click have any impact on security?

Question

On a banking website I see that they have disabled right-click. Does that make the site any more secure? Is it a good general practice?

Answer 1

Does it make the site any more secure?

No, it doesn't alter anything other than your ability to conveniently save items from a page. Using a browser's developer mode, turning off JS, overriding this with a different script that disables that pop-up, or just grabbing data off the wire after stripping the SSL will all work.

Is it a good general practice?

This is an ache that the Internet has had to suffer from the height of GeoCities fame when folks didn't want you to "steal" their very poorly composed photos of dandelions and family pets. Dispensing all professionalism and being straight-forward as possible, I might hesitate to convict a person for smacking the responsible party of any modern site using this upside the head with a cast iron skillet. Aside from that it has generally fallen out of favor due to being a combination of ineffective and annoying. For instance, it would also make my spellchecker misbehave.

Answer 2

Client side security is just a smokescreen. It will prevent inexperienced people from saving the images or messing with the HTML, but one can easily disable this with a single line of injected javascript. You can mess with the HTML even without this line of JS, using Chrome Inspector.

When this trick is used to keep images "secure":

I've seen a lot of tricks used by sites to avoid images being fetched. One, of course, is trapping the right click bubble. The other is to overlay two images (or to use a CSS background-image:url()), making the first one 'inaccessible' to right click. But that will only prevent the folks that don't know much more than "right click>save image as".

Is it a good practice? Probably not. It's still very easy for people to get the image. But yeah, if you want to cull the pool of possible "thieves", I guess it's OK to do. Still, you should come to terms with the fact that once you send something to the client, it can be stolen.

When this trick is used to keep the website "secure"

Please don't do this. Your security should be on your server-side. Client side security should be in the form of CSRF/clickjacking preventions. Not in the form of "making the source code difficult to mess with". Because it always can be messed with.

Answer 3

I actually think it might compromise security by a fraction. The one who are prevented by the disabling of the button would never be able to compromise the security at all. But disabling the right click might annoy someone who can get past it to do exactly that, and by doing that breaking down a small barrier that might lead the person to continue hacking.

Another point is that "features" like this might lead a potential hacker to question the skills of the implementers of the site, which also is something that might entice hacker to "check out" the implementation.

Of course this is just psychology and have nothing to do with the actual security of the site, but still a valid point I think.

Answer 4

On a banking website I see that they have disabled right-click. Does that make the site any more secure?

No. Out of the top of my head:

• you can use greasemonkey to remove their right-click functionality on page load.

• you can save the web page, then open it in your favorite editor.

• you can get the webpage again, using wget (or any other client that gets the page without reading any javascript).

• you can inspect the code and contents of the page by using any web-developer extension to your browser.

Is it a good general practice?

It limits the capabilities of your browser on their website. As far as I can think of, the only thing they achieve is a poorer user experience on their website (you cannot use the full capabilities of your browser with their website) and (if we're looking at very naive website owners / managers / other people responsible) a dangerous illusion of security.

Answer 5

Surprisingly often web sites foolishly aren't designed to cope with clicks on "Back" or "Forward" browser buttons. For instance, some banking or e-commerce web sites may commit a transaction twice if you hit "Back". In such cases, there may be a case for trying to disable right-click (where these options are included).

Answer 6

Disabling right-click has no impact on security; its completely trivial to get around, though it alone doesn't open up any security holes.

Giving the banking web site the benefit of the doubt -- there possibly could be a non-security effect that they intended from disabling right click. They may want to prevent users from accidentally doing unintended actions on the banking website.

For example, you may be familiar with websites that say only "press submit once" to prevent the form being double submitted. If you press submit twice, then you may initiate a money transfer twice which was not what you intended. Granted, there are much saner ways of accomplishing this (giving each action a unique ID before its submitted, only processing a request once), etc.

Or maybe they have set up the site that if you load a page, visit another page, and press the back button in your browser to go to the original page (versus navigating through their website), the previously visited page will no longer work (e.g., there's a token that expired once you visited a new page). Maybe they feared you would navigate away from a site, and an attacker could then use the computer after you press back a couple of times and get to your banking information. (Again, not the sanest method of accomplishing this goal, versus say a session timeout after 5 minutes of inactivity and encouraging people to logout and not use public computers).

Answer 7

No, if you need secure things,,,don't trust any client side things.

As an example if you do only client side validations in a website which needs more security, you gonna be fail. Do both validations, server and clients.

And main things is - providing security means its not securing the stuffs. It increase the time to break in the system. By disabling right click it can be increased the breaking time by second or two ;)

Answer 8

The only conceivable benefit I could think this could offer would be if they are expecting the casual user to do something stupid that would require a right click. I am not aware of any attack vectors where right clicking on something would cause an exploit to be able to occur though, so I don't see any valid security explanation for this behavior. Perhaps they don't want the user to copy and paste some information and hope the user doesn't know about ctrl-c and ctrl-v?

Answer 9

It is probably intended to make life more difficult for phishing attacks. The idea would be that an attacker needs to create a convincing fake page, and to do so he will naturally try to save images from the real web page, so making it marginally harder to get to the image must be a good thing, right?

Obviously it is completely ineffective and contributes only negative usability, but I'm assuming that's the thinking as I've seen sec products claim that protecting against downloading public web assets has some kind of worth against phishing.

Answer 10

Yes, “disabling” right click does have an impact on security.

“Disabling” right click entices users like me into turning off JavaScript. So all the other — rather poor — security measures implemented in JavaScript get shut down as well.

That is what I call counter-productive security.

[“Disabling” right click is not really disabling right click. It is trying to disable right click, and it just makes right click more difficult. Some Web browsers even have the option to just ignore this absurd annoyance.]