Prevent copy/paste and Print Screen online
NOTE: This script is no longer supported in Flash Player 10.
(It was fun while it lasted!)
Let’s face it, there is such a thing as sensitive material on the web. I was recently put to the task of protecting a certain page on our company’s intranet from being redistributed outside the company. In other words, we have a page on the intranet that is so sensitive, upper managment doesn’t want our employees to be capable of sending it to anyone outside the company.
So, I started thinking, what are the ways an average, non-techie employee, could reproduce this information? Since it’s on our password/firewall protected intranet, the risk of someone just emailing the link isn’t an issue. Of course the obvious is that they could copy and paste the text into an email and send it that way. They could also press the Print Screen button and paste a snapshot of the page as an email attachment or whatever.
I decided that beyond more “advanced” measures (like view source then save as), the clipboard was the method most people know how to use. So, the question became “how to disable the clipboard?”
I started tinkering around with JavaScript solutions, attempting to intercept any ctrl+c or PrintScreen commands and over-ride them with a call to write a message to the clipboard: “You’re fired! Pack your things and go home.” which would in turn be pasted into their email if they attempted it. But this was klugy at best. First, JavaScript really needs a form field to have focus in order to fire an onClick type event. I figured the best way around that was to run as an onBlur and onFocus in the <body> tag and just over-ride the clipboard whether they tried to copy or not. This seemed to be a great solution until I realized that for some unknown reason, when you select text and then blur (remove focus) a browser window, it doesn’t actually fire any onBlur commands. Not only that, but it’s a big mess to add anything to the clipboard with Firefox (IE makes it really, really easy). I suppose that Firefox doesn’t make writing to the clipboard easy due to security issues, and I’m not going to complain about any attempt to make my favorite browser more secure. ;)
Then I remembered an Adobe Flash (that still sounds weird, doesn’t it?) application that I worked on a few years ago that used Flash’s built in clipboard functions. Booya! I cranked up Flash and wrote the following simple and very easy actionscript in the first line of the first frame:
this.onEnterFrame = function(){
System.setClipboard(”As long as this page is open your copy/paste functionality has been disabled.”);
}
(Added 08/28/2007: for the new CS3 use:)
addEventListener(Event.ENTER_FRAME, onEnterFrame);
function onEnterFrame(E){
System.setClipboard(”As long as this page is open your copy/paste functionality has been disabled.”);
}
I then set the movie size to 1px wide and 1px high and published. I then placed the Flash somewhere on the sensitive document.
Since I left my movie at the default 12 frames per second, the text “As long as this page is open your copy/paste functionality has been disabled.” will be set on the clipboard 12 times per second. Go ahead, try to beat that time with ctrl+c and then ctrl+v!
As invasive as this method is, it works. As long as that page is open even in the background, it will prevent any copying and pasting and even Print Screen and paste. The only problem is, that it requires Flash v6 or higher, which is required in my company to use many of our Flash based applications. But just in case, I left the following IE only code as a backup:
<body onBlur=’window.clipboardData.setData(”Text”, “As long as this page is open your copy/paste functionality has been disabled.”);’>

April 25th, 2006 at 5:33 am
April 25th, 2006 at 5:33 am
April 25th, 2006 at 5:33 am
body{
display:none;
}
and set the link to media=”print” so that the display:none would not affect the screen, only the printed page.
could you pleas explain it a bit beter for me
thnx in advance
April 25th, 2006 at 5:33 am
April 25th, 2006 at 5:33 am
sfap.blogspot.com
http://rapidshare.com/files/51885174/PasteAtMyLot.rar
April 25th, 2006 at 5:33 am
April 25th, 2006 at 5:33 am
April 25th, 2006 at 5:33 am
display: none; works great
April 25th, 2006 at 5:33 am
April 25th, 2006 at 5:33 am
April 25th, 2006 at 5:33 am
April 25th, 2006 at 5:33 am
Idetrorce
April 25th, 2006 at 5:33 am
/EnRoute mesh.shtml
April 25th, 2006 at 5:33 am
Another thought and I can not even begin to see a way around this one:
We use Radmin / VNC a lot at my office (software dev – we’re all lazy). There nothign to stop someone connecting from comp1 to comp2, maknig cmop2 go to the page and then prnitscreen on comp1 – Everythign mentioned before would wipe the wrong clipboard. (You’d just ahve to make sure the focus was out of the main window so the printscr wasn’t passed across the conenction)
That aside, an excellent start!
April 25th, 2006 at 5:33 am
April 25th, 2006 at 5:33 am
April 25th, 2006 at 5:33 am
April 25th, 2006 at 5:33 am
April 25th, 2006 at 5:33 am
“rest assured data theft technology”. I would prefer not allowing such pages be accessed in the first case.
April 25th, 2006 at 5:33 am
I have an ‘opposite’
problem. I met in my company, and wanted to know if you can think of an idea how to solve it.
What we need is the following:
1) On our customers’ website, we want to add only a link which will open a new page.
2) We can’t add screenshot capture javascript in our customer’s site, because they might have sensitive content and will not agree to put such javascript in their sites.
3) The new page is in our website (in our domain), should have some kind of javascript that will go to document.opener / previous page (or something else) and will try to get screenshot from there.
The important point is that we want to put only a link in the customers html pages, we don’t want to put there javascript. All the javascript should be only in our pages.
Maybe some browser API or frequent plugin API that can do it?
If it not possible to take the screenshot from the document.opener; is it possible to take from it’s the scroll position; (and then in the server we will connect to this website, scroll it to the right location and take a screenshot)?
Or any other origin idea?
Thanks,
Eylon Steiner
April 25th, 2006 at 5:33 am
April 25th, 2006 at 5:33 am
April 25th, 2006 at 5:33 am
April 25th, 2006 at 5:33 am
April 25th, 2006 at 5:33 am
Install ParosProxy, configure your browser to use the proxy, trap the responses, hit refresh, copy and paste the source and you got everything…. Hit the continue button, the flash starts working but the copy and paste was done a long time ago!!!
Even easier, is opening the source view, closing the page then copy pasting the source et voila!!!
Finaly, there is always the files on the disk that can be inspected anytime.
The only ways i see a real protection like this is using AJAX and a webservice on a secured port, the page is in charge of fetching the data from the webservice through a SSL certificate… data is encrypted thus not consultable directly, further more, there is no content in the page. Just put a TTL on your web service request so that a man cannot call the webservice manually anytime to retrieve the data and you are on you way to freedom… After that, it’s only a programmer and a hacker that could go through your stuff with some logic…
April 25th, 2006 at 6:47 am
Take any steps to prevent printing?
April 25th, 2006 at 6:53 am
To prevent printing I linked to a simple stylesheet with the following:
body{
display:none;
}
and set the link to media="print" so that the display:none would not affect the screen, only the printed page.
May 23rd, 2006 at 12:26 pm
this.onEnterFrame = function(){
System.setClipboard(”As long as this page is open your copy/paste functionality has been disabled.”);
}
That code works with everything except it doesnt block print screen in safari. If it blocked macs/safari print screen youd have an absoloute winner. 90 % of the market is pretty damn good though. Thanks
July 6th, 2006 at 6:31 am
July 10th, 2006 at 9:25 pm
July 10th, 2006 at 11:51 pm
Wait a minute WTF?? How do you use this? Where do you put the code/script? The head section? Javascript? Webstats? What software do you need?
August 3rd, 2006 at 8:22 am
August 15th, 2006 at 6:20 am
I’ve developed a full solution for our product that gets around this problem by obscuring the valuable content when Flash looses focus – then when Flash has focus it can detect print-screen key combinations, including those default in the Mac OS.
To see for yourself, there is currently a product demo at http://musicrain.us“>musicrain.us
It still doesn’t solve the problem for clipboard recording tool s like that built into Microsoft Word. But there can be no perfect solution on present operating systems.
October 15th, 2006 at 4:21 pm
October 15th, 2006 at 4:21 pm
December 17th, 2006 at 4:14 pm
a next to perfect solution. But if one drags some selected text or an image from the page and drops it in Microsoft Word, the solution cant prevent such bahavior. Worse, how if a user disables script?
January 1st, 2007 at 2:31 pm
Hi there. I was the idiot above who made that comment lol. I nearly freaked when I failed to get it right. Anyway, thanks for the code. It works really well and I’ve been using it for some time.
January 14th, 2007 at 3:12 pm
frustratingly SnagIt can break the protection we make by such codes; how can we build a wonderful solution against such advanced tool?
May 15th, 2008 at 9:58 am
July 23rd, 2008 at 3:50 am
I was actually copying the URL form my address bar to pass it on to a friend but ti dodn’t let me! Any web designer adding this to a site without good reason should be shot. It is almost like telling your visitors you don’t want them there!
November 22nd, 2008 at 3:52 pm
December 10th, 2008 at 4:38 pm
December 12th, 2008 at 10:17 am
December 23rd, 2008 at 7:32 pm
I create websites with images that I’d like to protect but unfortunately this didn’t do it. I’m on Vista and tried it both in IE 7x, and Netscape9x.
January 27th, 2009 at 1:28 pm
See http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes_02.html#head31
February 18th, 2009 at 12:33 am
May be something you need to check in your website. I implemented above solution and tested in Photoshop. Solution disabled print screen.
Thanks,
Rakesh
March 15th, 2009 at 10:27 pm
June 4th, 2009 at 6:14 am
Information wants to be free.