Protecting images from download, etc.

[forrie]

I website I've seen recently uses a clever technique, which I'm still working to figure out. When you go to view an image, a pop-up window opens -- the image is downloaded (non-cached) and then some javascript (presumably) loads a replacement image in its place (it's not displayed) -- when you go to save it, you get the dummy image.

Further, they make some javascript call (presumably, or jquery) to replace the document content of that page, so when you do a View Source, you get something totally different.

I think that's very clever; anyone know how this is actually working, and whether something like that could be cross-browser supported.

[JimmyP]

There is no way to protect your images 100%.

My guess is they're using a CSS background-image to display the actual image applied to a transparent GIF <img/> stretched to the same size as the BG-image.

[paul_wilkins]

If you use something like firebug you can see each and every piece of page content as it's brought through.

No matter what techniques are attempted, the image MUST be shown on the screen at some stage for the person to see. Once that happens anyone can take it.

[forrie]

Firebug works for the top level document, but not for windows that open up, as it seems. The page I'm looking at disables right-click, etc.

I may just need to craft a proxy that caches everything...

If you use something like firebug you can see each and every piece of page content as it's brought through.

No matter what techniques are attempted, the image MUST be shown on the screen at some stage for the person to see. Once that happens anyone can take it.

[felgall]

The image still needs to be downloaded to your browser before the web page can display it regardless of what method the page uses to try to block your copying the image.

If JavaScript is interfering then you just disable javaScript temporarily so as to bypass whatever "protection" has been built in with javaScript.

The only protection that is even slightly effective is that built into the image itself.

[JimmyP]

And, as a last resort, someone could just print-screen and extract the image from there! Like Felgall side, the only way is to protect the image itself, with a watermark or something...

[forrie]

You are quite right.

I'm just trying to learn how it's being done - I'd like to use the technique in some of my own things. It's simply a deterrent.

The image still needs to be downloaded to your browser before the web page can display it regardless of what method the page uses to try to block your copying the image.

If JavaScript is interfering then you just disable javaScript temporarily so as to bypass whatever "protection" has been built in with javaScript.

The only protection that is even slightly effective is that built into the image itself.

[paul_wilkins]

If it's a deterrent that you're after, a watermarked copyright notice on the image itself is a lot easier to perform than the complexities of controlling a visitors web browser.

[felgall]

a lot easier to perform than the complexities of controlling a visitors web browser.

Particularly since it is much easier for them to disable any "protection" you apply through JavaScript than it is for you to apply it in the first place. Why spend two minutes writing code that is disabled by default in some browsers and which can be disabled in two seconds in most other browsers.