Really Locking Down a Site's Content

I’m starting a project with a group that is very, very paranoid about it’s content. We’d like to collaborate in a forum environment but are concerned someone will leave a page open, and someone else will walk on their computer and take images or ideas. It’s an annual design thing, and last year images got leaked this way at a party. While I know it’s ridiculous, I’m trying to create an online solution that prevents this from happening at all costs. The idea is, despite how inconvenient these features may make the site, it will still be more convenient then physically meeting to discuss everything.

Here’s what I got so far:

  • Prevent anything from getting in the clipboard. I think this can be done with Flash. Also, if anyone tries, log them out.
  • Prevent use of function keys in general with flash. Any keyPress Javascript can’t see will lead to a log out.
  • On right click, log user’s out.
  • Use htaccess to prevent direct access to an image. Load all images with server-side scripting. Tell the browser not to cache this image.
  • Only load images on click and hold. Eliminate the image from the DOM on the next event.
  • 10 Minute Timeout on pages with sensitive information.
  • Everything on https
  • Log out anyone without flash or javascript

What should I do to prevent people from directly accessing my image loading script? Log in will be required, and I know I can check the referrer, but that’s not as bulletproof as I would like.

Am I forgetting anything?

Does anyone else think this will be fun to build?


The way around that one is to have the computer set so that it automatically locks the computer a minute or so after the last activity and then requires a password to unlock it again to continue using it. That way it doesn’t matter what they might have been doing as their entire login is locked off when they are not actively using it.

Any further ideas on this? I’d really like a way to lock out the images besides a referrer.


I don’t think it matters if it’s online or not. There might be a few more issues to code for, but that doesn’t compare to development time for a custom application.

Our primary concern is someone going on a team member’s computer and stealing the information. Leaving a custom application open is just as easy as leaving a browser open.


Don’t rely on referrer for something serious. Good enough for some/most but not the best you can do.

You can have a link in one of your pages that sets a session point to a file that gets the content from a folder outside of the root only if the session is valid.

A better solution would be not to put this online. Instead use VPNs and bring your clients into a private network. And probably with a proprietary application running on the user’s computer that handles browsing and exchange of data.

We didn’t have mice for the report entry terminals, so for us it was keypress only. As I said, it was really aggravating at first. But after a while it became second nature. True enough, I doubt if the information is as important as something that might affect a persons health or life, but if they’re that concerned about it they should accept the quick timeout as an important precaution.

I used to work in a medical laboratory where we were logged out after 1 minute of inactivity. At first it was very frustrating to have to keep logging in if I had been away from the terminal for a short period of time (answering the phone, getting a reagent, etc, But I got used to it, and as patient results were at stake I think it was justified.

So I think your 10 minutes is a bit generous and if people really care they’ll get to where they don’t mind logging in so often too.

Thanks. I was actually thinking 5, but figured I’d get yelled at if I said that. Actually, I guess I haven’t really thought enough about this requirement.

What should be considered inactivity? Not scrolling? Not clicking links?