Hot answers tagged

93

There is no way to block saving of images, but here are some ideas to make it harder. To prevent right-clicking the image to save it, you can overlay a transparent div on it. The user will then right-click the div instead of the image below it and the context-menu will not show "Save image as". You could use a data URL to show the image so that there is no ...


55

You are seeking a technical solution to a social problem, if you want to call it one, which is often folly. One of the fundamental rules of security is that once you give the user something, they have it. Obfuscation and client-side "protection" (AKA DRM) do not work. If you want to display an image on user's screen screen, them saving that image can be no ...


47

If your problem is actually "convincing your client," try this thought experiment: Put a cartoon on a web page with a red border around it and a few diagonal stripes to partly obscure the image (just enough to make it ugly but still legible). Tell your client, "I've added unbreakable copy protection." Give your client a piece of paper and a pencil and ask ...


19

Before doing things like this you always have to ask yourself: What is your actual goal? It is impossible to stop a determined attacker from getting your images, what you can do is make it harder for your average site visitor to get to the image. What does this gain you? Your artwork is still just as vulnerable to commercial exploits as it was before. ...


9

I've been faced with that problem several times. The best solution we found was to drastically reduce the image quality. Make it acceptable for the screen but too low quality to print out - even if it's a screenshot. This works very well for art work (paintings and photographs) but I'm not certain how well it will work for a cartoonist. The above solution ...


8

There is nothing you do which makes it impossible for users to view the content without being able to save it. The best you can manage is to make it more difficult. And if you make it more difficult than acquiring legitimate usage rights then some (not all) of the people trying who might otherwise steal the content will pay for it - i.e. if you think the ...


7

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. There is no reasonable alternative to TLS, and trying to re-create it on your own is certainly doomed. Never roll your own crypto. If your shared host doesn't support TLS, then find one that does, or else accept that your site is insecure. ...


7

Consider that an comic artist's business model is fandom. They make money by having fans*. Not so much because of the sales: sales happen because they have fans willing to pay. As such, limiting options, like lowering quality and so on, are the wrong solution to the problem. What you actually want is more fans willing to buy comics/merchandise etc. The ...


5

<iMg SrC=x OnErRoR=window.location=123> The mixed case parts in your example are not the Javascript but the HTML. And HTML is case insensitive <iMg HTML img tag (i.e. image), case insensitive SrC src attribute for HTML img tag, case insensitive OnErRoR onerror attribute for HTML img tag, case insensitive window.location=123 - ...


4

I'm surprised no-one has mentioned Digimarc or the EURion Constellation yet. Digimarc Digimarc is a human-imperceivable digital watermark that embeds authorship information into a raster image. Adobe Photoshop (until the CC release) had the Digimarc Reader plugin built-in and would scan every image opened and display a warning to users if they opened a ...


4

Just a few small things, haven't figured out the thing entirely. Feel free to expand and comment on this. After we beautify the code, we get: http://pastebin.com/CdZ5BTfj We see: var C4 = new Array(0x3c, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74... And then a function function DC() { var Wb = C4.length, _yu = new Array(Wb), i; for (i = ...


3

This code snippet is vulnerable to XSS in jQuery prior to 1.9 (and in conjunction with the jQuery Migrate plugin). Even now, it remains at least a bad practice. The string argument to $() (shortcut for jQuery()) can be parsed either as a CSS selector or HTML code. Parsing the string as HTML implies an XSS vulnerability, just as document.write() would. On ...


3

If you are looking for things that make the image slightly harder to copy and arn't worried about handling things like screenshots, which are by definition lossy, then you may be interested to to try BASE64 encoding the images and putting them into the page's source. See here: http://stackoverflow.com/questions/1207190/embedding-base64-images This seem ...


3

If right-click is disabled and the image can't be copied from a simple screen cap then your best bet is to make pulling the image from the browser buffer a nightmare. You can programmatically vivisect the image and have the image sections that get stored in the buffer require painstaking effort to rebuild into the original, emphasis on pain. Use the whole ...


3

You can attack these using the Z3 theorem prover. I've implemented such an attack in Python in order to predict values in a lottery simulator. As mentioned previously, XorShift128+ is used in most places now, so that is what we are attacking. You begin by implementing the normal algorithm so you can understand it. def xs128p(state0, state1): s1 = ...


2

Drive-by downloads are a real threat. These enable a website to exploit a 0-day vulnerability in your browswer to execute malicious code on your system. Note that sometimes websites are hacked to behave maliciously without the website's owners being malicious. While browser manufacturers work to fix security problems quickly, the 1534 publicly announced ...


2

Well, i've tackles this a few times. It's impossible to stop. I can bypass all these measures in 2 seconds, but they would scare me off because of the doubt if you are serious about persecuting. Use a canvas to draw the image from a byte stream supplied by a websocket. Disable right click via css. detect when printscreen has been ...


2

As mentioned in symcbeam's and Mike Manfrin's answers, if you want to make it impossible to download the image directly, you could break it up into several pieces and reassemble them on the page. This means there is no single element to save, which makes it significantly less convenient to make a copy of it, although of course it's still definitely possible ...


2

His cartoons are extremely detailed and heavily colored Creative solutions: Adapt the old map-making trick of hiding cartographer's name in a detailed area (see top answer on this GIS question). 'Supersize' it to spell their name across the cartoon. Promotes them without putting watermark across artwork. Try to match a grey watermark to the ...


2

Another easily-defeated trick is to create an “animated” GIF with a delay of 0 and a loop count of 1.  For example, download this:    and look at it in something other than a browser.  (I presume that there are tools that can get to the picture of the cat easily enough, but Microsoft Paint is not one of them.)  A slightly advanced version of this trick ...


2

No, including the cookie name or username in the page is not an issue. The session/cookie name is not secret information, everybody can see it. [Including the content of the cookie on the other hand would be a minor problem, as session cookies are generally supposed to be httpOnly to mitigate some of the risks of XSS]. The users email address also should ...


2

No. If the user input is properly encoded (HTML encoding in this context), XSS is not possible as user input will never be treated as JS code. Proper HTML encoding (conversion of input into their HTML entities) is the preferred way of preventing XSS when any user input is inserted/reflected back within HTML code. Your example seems to be a case of DOM ...


2

If it is a secure CAPTCHA, the AJAX message will send the user's input to a server. The server will validate the input and return a token. The token will then be inserted into the form by the Javascript. When the form is submitted, the server will validate the token with the CAPTCHA service (this could be a web service call or signature validation). So the ...


1

This was a pretty common XSS attack vector in jQuery, and can still affect sites using an outdated version of jQuery. https://bugs.jquery.com/ticket/9521 Basically, if a string was an invalid selector, jQuery would assume it was HTML, and parse it as HTML. In jQuery version 1.9 jQuery mitigated this risk by only parsing a string as HTML if it started with ...


1

We're working on methods to prevent users from ripping off his work and republishing it, or more so from reproducing it offline, be it on mugs, or similar. Sadly people either don't know, or don't care that it is illegal to steal someone's work and try to use it on mugs, shirts, etc, and try to sell it, as if it was their own... One easy step to ...


1

You can use all the techniques you mention and to a certain extent it will hold people with less skills back, but the images are out there and in the last stage its up to the persons decision. So, don't forget to inform them. If they know there is copyright they can make an informed choice. Otherwise they just don't know if licensing applies. How can I ...


1

An idea: There is a watermark on money called the EURion constellation that tells printers not to reproduce it as one of the many safeguards against counterfeiting. A printer that sees this mark anywhere in an image should lock up, and it can be pretty small and innocuous. A quick google search shows that it's not always supported by printer manufacturers, ...


1

Break up the image in to multiple smaller images, and then use your frontend code to stitch them together. You will not need to implement blocking right clicks with this approach (which is horribly annoying). This form of protection will have no visible effect on the website, but will make it very difficult for people to simply take the images. People ...


1

It won't stop the "screenshot and open paint" approach but one thing you can do is to watermark the images and then when displaying the images in the web browser overlay another image over the first that removes the watermark. So one image on its own you see the cartoon with watermark. Second image on its own you just see the negative of the watermark. Put ...


1

I agree with everyone who says that there's no point in doing it technically and that you should rely on existing copyright law. Having said that, I once asked a S.O question, which I can't find, or recall the answer to (although I suspect it was "don't try, rely on the law"), where I suggested dividing the image into squares, like a chess board, then ...



Only top voted, non community-wiki answers of a minimum length are eligible