I have HTML and SWF files that I want to put on a CD. How can I protect the contents on the CD, or make it difficult for someone to burn or duplicate them?

  • 1
    Can you expand on the threat a little - who do you expect to attempt to copy the disk? Regular users? Or professional software pirates? Apr 13 '12 at 11:35
  • 2
    Can you expand on the value of the asset a little? Are you prepared to spend $50, or $100,000,000 to protect it? Are you prepared to get into serious trouble for it? (See for example en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal ) Apr 13 '12 at 11:43
  • 1
    Well he can forget about the latter. At the end of the day major pirates will win. As for Sony's rootkit, it never affected linux machines ;)
    – ewanm89
    Apr 13 '12 at 11:44
  • Read on, please. There's some thought about security that states that once you don't have physical protection to it, it's not yours anymore. Sooner or later, anyone who has access to the thing (be it a cd, dvd, flash drive, chip, etc) can make a reverse engineering of it. I know, so far some cards and tokens are protected, but you can rely on it if your protection is that valuable. What's your objetive in such files ? You will send it to someone, sell it anyway, or it's your backup? If you're the only one using it, making a kind of backup, you'll be better encrypting it than trying to protec Apr 13 '12 at 12:15

Fundamentally, you can't. It's impossible.

This is because you are unable to distinguish between an attacker and a legitimate user. You want the legitimate user to be able to access the data, you want the attacker not to be able to, but you can't tell if Alice is a legitimate user or an attacker.

Despite it being impossible, a lot of people have put a lot of effort and resources into trying to do it anyway. The closest they've come is with two approaches:

  1. Have the users access the data only using computers that you control.
  2. Authenticate each user before giving them access to the data, analyze their usage patterns, and revoke their access if you believe them to be an attacker.

Note that neither of these techniques work (because it's impossible) but they can sometimes delay unsophisticated attackers very briefly. (While unsophisticated attackers can't break these techniques, they can download copies of your data from sophisticated attackers.)

  • thanks for the answers. I'm prepared to pay some few hundreds of dollars. At least i want to make it difficult for users to make copies to friends.
    – karto
    Apr 24 '12 at 11:53
  • 3
    A few hundred dollars? You're 7 orders of magnitude too low, try billions. Yet even a budget of billions as the MPAA has is showing how utterly terrible their "copy protection" is.
    – forest
    Dec 11 '17 at 5:48

Realistically, you cannot. Anyone who has the CD in their possession and can read the files on it, can make a copy of it.

Your best course of action is one of two options: physical security (only give the CD to people who you trust will not act contrary to your interests), or encryption (encrypt the files on the CD so that only people who have the decryption key can read the files, and only give the decryption key to people who you trust will not act contrary to your interests).

But once someone has a cleartext copy of the file (e.g., the HTML or the SWF file), you can't realistically stop them from making copies and sharing copies of the file.

If you have a high budget, you may be able to embed a unique watermark in the file that is different for each person you give the CD to. The idea would be that, if they do share copies of the file widely, and if you later come across a copy, you can tell which person was the original source. But you can't prevent copying and sharing.

P.S. Please don't cross-post your question on multiple Stack Exchange sites.


You are basically asking for a DRM system

Digital Rights Management systems provide the features you are requesting.

TL;DR: don't waste your time and re-think your security model. Someone will make a lot of copies if they have interest

The theory is that when you burn data on media, it is perfectly readable as it is made of 0/1 bits. Everyone with a CD/DVD reader can access those 0es and 1s, so you need a system on top of those that prevents people from running the content after cloning the media.

The practice is that you basically can't protect an HTML page which is a static content. I'm not sure about SWF, as Adobe Flash is gone dead, and that possibly all past DRM systems running on the user's machine have been eventually broken. Of course, they make it harder to make a copy.

As I recall, old DRM schemes for PCs and consoles relied on special sectors that are sculptured into the media by the very factory, e.g. if you buy a TDK blank media at your store, that brand is marked (and visible by software such as Nero Burning Rom) permanently on an area you can't write.

If your Adobe Flash-fu 🥋 is great, you could try to read those special sectors. But you can't burn the master gold with a dekstop CD/DVD burner, as you need a factory to make the media for you.

[Edit] I lack knowledge of the exact functioning of the PS1 DRM scheme, and I lack knowledge of Adobe Flash (ActionScript) programming

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.