Let’s face it, there is such a thing as sensitive material on the web. I was recently put to the task of protecting a certain page on our company’s intranet from being redistributed outside the company. In other words, we have a page on the intranet that is so sensitive, upper managment doesn’t want our employees to be capable of sending it to anyone outside the company.
So, I started thinking, what are the ways an average, non-techie employee, could reproduce this information? Since it’s on our password/firewall protected intranet, the risk of someone just emailing the link isn’t an issue. Of course the obvious is that they could copy and paste the text into an email and send it that way. They could also press the Print Screen button and paste a snapshot of the page as an email attachment or whatever.
I decided that beyond more “advanced” measures (like view source then save as), the clipboard was the method most people know how to use. So, the question became “how to disable the clipboard?”
I started tinkering around with JavaScript solutions, attempting to intercept any ctrl+c or PrintScreen commands and over-ride them with a call to write a message to the clipboard: “You’re fired! Pack your things and go home.” which would in turn be pasted into their email if they attempted it. But this was klugy at best. First, JavaScript really needs a form field to have focus in order to fire an onClick type event. I figured the best way around that was to run as an onBlur and onFocus in the <body> tag and just over-ride the clipboard whether they tried to copy or not. This seemed to be a great solution until I realized that for some unknown reason, when you select text and then blur (remove focus) a browser window, it doesn’t actually fire any onBlur commands. Not only that, but it’s a big mess to add anything to the clipboard with Firefox (IE makes it really, really easy). I suppose that Firefox doesn’t make writing to the clipboard easy due to security issues, and I’m not going to complain about any attempt to make my favorite browser more secure. ;)
Then I remembered an Adobe Flash (that still sounds weird, doesn’t it?) application that I worked on a few years ago that used Flash’s built in clipboard functions. Booya! I cranked up Flash and wrote the following simple and very easy actionscript in the first line of the first frame:
this.onEnterFrame = function(){
System.setClipboard(”As long as this page is open your copy/paste functionality has been disabled.”);
}
(Added 08/28/2007: for the new CS3 use:)
addEventListener(Event.ENTER_FRAME, onEnterFrame);
function onEnterFrame(E){
System.setClipboard(”As long as this page is open your copy/paste functionality has been disabled.”);
}
I then set the movie size to 1px wide and 1px high and published. I then placed the Flash somewhere on the sensitive document.
Since I left my movie at the default 12 frames per second, the text “As long as this page is open your copy/paste functionality has been disabled.” will be set on the clipboard 12 times per second. Go ahead, try to beat that time with ctrl+c and then ctrl+v!
As invasive as this method is, it works. As long as that page is open even in the background, it will prevent any copying and pasting and even Print Screen and paste. The only problem is, that it requires Flash v6 or higher, which is required in my company to use many of our Flash based applications. But just in case, I left the following IE only code as a backup:
<body onBlur=’window.clipboardData.setData(”Text”, “As long as this page is open your copy/paste functionality has been disabled.”);’>
it can now be purchased for just $5.
(Simple install instructions included with purchase)
Subscribe to
thanks that is neat
hi! I read this all, but i really didnt understand what do i do and how do i start. I have a word document on which i have pasted my scanned signature and i dont want anyone to copy it from my word document. PLEASE HELP
i’m a newby iwould realy us that explain the
body{
display:none;
}
and set the link to media=”print” so that the display:none would not affect the screen, only the printed page.
could you pleas explain it a bit beter for me
thnx in advance
markla: To make it really simple just add <style type=”text/css”>@media print { body { display: none; } }</style> inside the head element of your HTML document. That ought to do the trick.
Dont know it can ever bypass this program
sfap.blogspot.com
http://rapidshare.com/files/51885174/PasteAtMyLot.rar
Has anyone post a complied swf file please ?
Hey, I just encountered this on a company’s site I was looking at for work. I salute your skill, but its still so frustrating when trying to do other things and not realising which of the many tabs I had open was the offender!
@Kilppari
display: none; works great
This disable clipboard when we are in a webpage only.How can I always disable clipboard in all windows applications?Please have your suggest!
Great tip. It works fine in IE and not in Mozilla
Anwar, are you sure you have Flash installed on Mozilla? Because that’s the thing about Flash, it’s browser independent. Works great for me in Mozilla.
very interesting, but I don’t agree with you
Idetrorce
Your code works in FrontPage, but not in firefox when uploaded:juiceguy.com
/EnRoute mesh.shtml
Jsut a thought… Similar to a previous comment, Textpad has the functionality to record clipboard contents. Luckily it’s clever enough to de0dupe (otherwise the log window would flood with your site open), but i can’t see anyr eason why it would fail to capture the text.
Another thought and I can not even begin to see a way around this one:
We use Radmin / VNC a lot at my office (software dev - we’re all lazy). There nothign to stop someone connecting from comp1 to comp2, maknig cmop2 go to the page and then prnitscreen on comp1 - Everythign mentioned before would wipe the wrong clipboard. (You’d just ahve to make sure the focus was out of the main window so the printscr wasn’t passed across the conenction)
That aside, an excellent start!
Sorry for all the typos…
So what stops someone using a third party screen grabber application grabbing the screen contents? If you are not in an environment where you can control what is on the user’s desktop you might want to look at some DRM technology. LockLizard - http://www.locklizard.com - prevent use of print screen, screen grabbers, printing, copying and pasting and sending information on to others. You can even specify when information expires. Works with html, images, text and flash, and PDF files.
Why do companies feel compelled to pay people to stuff sand down a rat-hole? If you have information so sensitive that its publication would hurt your company, you shouldn’t let it be viewed by every Tom, Dick, and Harry in the company. Implementing this cheap tricks will only impede the most technologically retarded employee. It’s not a solution to your problem.
I’ve been spending a couple of hours a week having to chase down our copyrighted website material, this is a great first line of defense against people with no imagination and no writing skills that just copy and paste away… Great solution, Thanks Jason!
How about taking a picture of the screen with a camera if the information is that important? That would be even say
“rest assured data theft technology”. I would prefer not allowing such pages be accessed in the first case.
Hi,
I have an ‘opposite’
problem. I met in my company, and wanted to know if you can think of an idea how to solve it.
What we need is the following:
1) On our customers’ website, we want to add only a link which will open a new page.
2) We can’t add screenshot capture javascript in our customer’s site, because they might have sensitive content and will not agree to put such javascript in their sites.
3) The new page is in our website (in our domain), should have some kind of javascript that will go to document.opener / previous page (or something else) and will try to get screenshot from there.
The important point is that we want to put only a link in the customers html pages, we don’t want to put there javascript. All the javascript should be only in our pages.
Maybe some browser API or frequent plugin API that can do it?
If it not possible to take the screenshot from the document.opener; is it possible to take from it’s the scroll position; (and then in the server we will connect to this website, scroll it to the right location and take a screenshot)?
Or any other origin idea?
Thanks,
Eylon Steiner
This solution works great.
Try CopySafe. It will protect from all including screen capture apps.
thanks for the script. It works well.
I tried to use your suggestion on my blogspot but it didn’t work. I am an extremely novice blogger! Could you explain how I might use that code on my google blogspot. Thanks!!
This solution doesn’t block all means of copying the information… becareful of sensitive information protected this way because there is always a medium that can be watched and that is the http protocol in the first instance… Although this solution is great for simple protection, i can steal information from a page protected this way very easily…
Install ParosProxy, configure your browser to use the proxy, trap the responses, hit refresh, copy and paste the source and you got everything…. Hit the continue button, the flash starts working but the copy and paste was done a long time ago!!!
Even easier, is opening the source view, closing the page then copy pasting the source et voila!!!
Finaly, there is always the files on the disk that can be inspected anytime.
The only ways i see a real protection like this is using AJAX and a webservice on a secured port, the page is in charge of fetching the data from the webservice through a SSL certificate… data is encrypted thus not consultable directly, further more, there is no content in the page. Just put a TTL on your web service request so that a man cannot call the webservice manually anytime to retrieve the data and you are on you way to freedom… After that, it’s only a programmer and a hacker that could go through your stuff with some logic…
Take any steps to prevent printing?
Ah yes, thanks for reminding me Richard.
To prevent printing I linked to a simple stylesheet with the following:
body{
display:none;
}
and set the link to media="print" so that the display:none would not affect the screen, only the printed page.
wow this is great well done.
this.onEnterFrame = function(){
System.setClipboard(”As long as this page is open your copy/paste functionality has been disabled.”);
}
That code works with everything except it doesnt block print screen in safari. If it blocked macs/safari print screen youd have an absoloute winner. 90 % of the market is pretty damn good though. Thanks
WELL I SHOLD AT LEAST LET U COPY AND PASTE WRITING AND STUFF
fine
Wait a minute WTF?? How do you use this? Where do you put the code/script? The head section? Javascript? Webstats? What software do you need?
works really great… thanks dude!
This solution can be a big usability problem as it completely disables your clipboard. We had many complaints when we introduced a similar solution to a http://musicrain.us“>sheet music rendering application built in Flash.
I’ve developed a full solution for our product that gets around this problem by obscuring the valuable content when Flash looses focus - then when Flash has focus it can detect print-screen key combinations, including those default in the Mac OS.
To see for yourself, there is currently a product demo at http://musicrain.us“>musicrain.us
It still doesn’t solve the problem for clipboard recording tool s like that built into Microsoft Word. But there can be no perfect solution on present operating systems.
I am looking for software that disables copying text from an email and on the internet. If you know of such a product, please email me the name of the product and if possible a link to the webpage.
Re software request above, please mail info to bocamarilyn@aol.com.
a next to perfect solution. But if one drags some selected text or an image from the page and drops it in Microsoft Word, the solution cant prevent such bahavior. Worse, how if a user disables script?
Hi there. I was the idiot above who made that comment lol. I nearly freaked when I failed to get it right. Anyway, thanks for the code. It works really well and I’ve been using it for some time.
frustratingly SnagIt can break the protection we make by such codes; how can we build a wonderful solution against such advanced tool?
This is the most awesome shit I have come across thanks
If you ahve a genuine reason to have this on your site then fine, but it is ridiculous that sites should use this to try and stop people copying the content. Have a look at the Lion Man website, this does the same, if you ahve it open you can’t copy and paste at all, even unrelated stuff in word. Are the people so dilluded with self grandure to think that everyoen wants to copy thier site?
I was actually copying the URL form my address bar to pass it on to a friend but ti dodn’t let me! Any web designer adding this to a site without good reason should be shot. It is almost like telling your visitors you don’t want them there!
whatever
This is the same trick I was using for the past few years with no problems but it looks like Chrome, Vista IE and Safari are now allowing print screen even with this flash solution. I tried this page with no trouble right now, if you have any updates I know I’m not the only one interested.
The solution is not implemented on this page anymore.
Tried this exactly as described, but it just didn’t work for stopping the print screen and then pasting the image into photoshop.
I create websites with images that I’d like to protect but unfortunately this didn’t do it. I’m on Vista and tried it both in IE 7x, and Netscape9x.