I'm designing a website that displays commercial images and want to avoid people saving the image on their computer. I realise that any security measure like this can be defeated by a determined attacker. I'm just looking for approaches the make things harder - enough to deter a casual attacker.

One idea I had was to serve valid images, with the pixel data encrypted, e.g. each byte XORed with X. JavaScript in the page would decrypt this and render the original image in a <canvas> block.

Can anyone recommend a library that helps implement this or a similar scheme?

  • 1
    Casual attackers can still just simply "print-screen" them. – gre_gor Jul 10 '20 at 21:49
  • @gre_gor - True, I guess that makes this pretty pointless. Gonna leave the question up in case I get any other ideas. – paj28 Jul 10 '20 at 22:04
  • The canvas also has "Save image as" option on right click. – gre_gor Jul 10 '20 at 22:13
  • @gre_gor - Looks like a dead-end. I may use a Windows native app. Still not foolproof of course. – paj28 Jul 10 '20 at 22:17
  • Even with a desktop app, no matter how much effort you put into disabling screen capture, there will be a way for the user to overcome it, especially if the user is a local Windows admin. You could consider adding a watermark (either heavy or light) on the displayed images if that doesn't obstruct the applications functionality and usefulness. This way, the users can't re-sell the images as their own. – Amin Dodin Jul 12 '20 at 19:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.