Flash MX image protection project

chrishoggy · #1 02-09-2006, 06:42 AM

I'm embarking on a new project to protect images from being copied. This method will also prevent screen shots being taken. It's only in development/working theory stage at the moment. I was just wondering if this type of high security would be of interest to users here?

The final result would mean you can have high res proofs for customers to view, without the risk of them printing off and getting your work for free

.
I'm looking at giving output images in swf format like this Here (and the final release would have download, direct link and copy protection/blocking. It will have password encryption even if download was achieved, and decompiler protection to cut out image ripping from the swf. There will also be the ability to disable the print screen function and render any key activity useless while the image is in view.

Kraellin · #2 02-09-2006, 01:13 PM

chris,

i have yet to view ANY image that i cant copy, one way or another. if i can see it on my monitor, i can copy it. i guarantee it. if in no other way, i can ALWAYS take a photo of the monitor. so, if it can be seen, it can be copied, regardless of how many keys you disable. and with flat screens being so prevalent nowadays, you dont even get any barrel distortion from the screen. and if you somehow figured out an interlace method to defeat digital cameras, there are still optical/analog cameras that would not be fooled.

now, i have seen some decent methods to slow or stop most folks from copying and a lot of them are swf based, so if that's what you're shooting for, why ok. just be aware that there's always a way to pick any lock

the best way for proofs is still watermarks across the image. i know. i rip a LOT of images just for personal pleasure and the ones i always leave alone are the watermarked ones. it's just not worth the effort to try to clean them up.

craig

Dave Mamet · #3 02-10-2006, 05:31 AM

It's a noble attempt but as Kraellin says: Where there's a will, there's a way.

Dave.

chrishoggy · #4 02-11-2006, 06:35 AM

It may be impossible to stop the tech minded from getting your images. But we are talking about showing customers your work, and they are mainly not able to do work on images. If they were, they would not have needed your services in the first place

I do like the cool watermarks you can put on with flash. Here is one on one of my own photos

http://www.chrishoggy.pwp.blueyonder.co.uk/wm.swf

chrishoggy · #5 02-11-2006, 11:01 AM

Here is a quick example with low security and no folder lockdown (no htaccess files added etc). Let me know how long it takes for you to get the restored image (it isn't a fully restored image by the way

)
http://www.chrishoggy.pwp.blueyonder.co.uk/test/

Image you are looking for is a 1600x1146 jpg file

Frank Lopes · #6 02-11-2006, 03:53 PM

You are not displaying the big image. Display the big image and then ask how long it takes...

Quote:

Originally Posted by chrishoggy

Here is a quick example with low security and no folder
...
Image you are looking for is a 1600x1146 jpg file

chrishoggy · #7 02-11-2006, 04:04 PM

Quote:

You are not displaying the big image. Display the big image and then ask how long it takes...

You are viewing the big image, as that is the restored image you can see through the viewer. It's there, being viewed and you can see every bit of the image. It's just not all showing at the same time

.

Images that are in the script can be hotlinked to and viewed from source. So like I said, show me the image

Move viewer with your mouse

Frank Lopes · #8 02-11-2006, 04:19 PM

Then it must be me: all I get to see is a small image with a magnifying glass that I can move around. Granted it magnifies the area that is on top of, but I don't get to see the "big picture"... pun intended.

If you feel that strongly, look into the possibility of having an applet that does not display anything unless the browser is in focus (I don't know if it can be done without mucking with the OS...) and disabling the keyboard. Then the only method left (there is always a way...), would be by taking a photograph of the monitor.

I think, it is an interesting and valiant effort but a futile one.

Just my 2 cents.

Quote:

Originally Posted by chrishoggy

You are viewing the big image, as that is the
....
Images that are in the script can be hotlinked to and viewed from source. So like I said, show me the image

chrishoggy · #9 02-11-2006, 04:33 PM

Quote:

I think, it is an interesting and valiant effort but a futile one.

Fact is, a customer can view any part of a restored image via the viewer (that can be made bigger). They can zoom in on detail and see the work done, but they can't print the restored image

Fact that you can't show me the whole image, proves it isn't that easy to get/grab/hotlink to, or what ever. So it proves the method works

Doug Nelson · #10 02-11-2006, 05:09 PM

My (ex)father-in-law used to say "Locks only keep out honest people"

Frank Lopes · #11 02-11-2006, 06:13 PM

The fact Sir, is that it does NOT work.
It took me 10 minutes to get it.
Here is the URL:
http://www.chrishoggy.pwp.blueyonder...oneyouwant.jpg

Quote:

Originally Posted by chrishoggy

get/grab/hotlink to, or what ever. So it proves the method works

chrishoggy · #12 02-12-2006, 01:09 AM

You did it via common folder name, thats after you got it from the swf. And you received 6 url 404 errors when trying.
/test/thisistheoneyouwant.jp HTTP/1.1" 404
/images/thisistheoneyouwant.jp HTTP/1.1" 404
/test/imagebase/thisistheoneyouwant.jpg HTTP/1.1" 404
/imagebase/thisistheoneyouwant.jpg HTTP/1.1" 404
/thisistheoneyouwant.jpg HTTP/1.1" 404
/thisisthesmall.jpg HTTP/1.1" 404

Quote:

Here is a quick example with low security and no folder lockdown

I did say that, did I not?

Quote:

The fact Sir, is that it does NOT work

These are supposed to be constructive comments?
2 simple steps that will be in the final template would have stopped that. What would you have done if the files were named thisistheoneyouwant.wxyz and the folder they were in was server side access only?

Frank Lopes · #13 02-12-2006, 06:06 AM

It took me several steps because I made a mistake typing the URL.
I typed "thisistheoneyouwant.jp" instead of "thisistheoneyouwant.jpg"

Regarding the comments, they were just my opinion. I still think what you are doing is a valiant and creative effort but only from a coding perspective.

I did decompile the swf file and that is how I had access to the image name. I do realize 99% of the users would not be able to do it either because they don't know how or don't think the effort is worth it.

Regarding renaming the image "thisistheoneyouwant.wxyz", I don't think it will work. I will download the "wxyz " file and just rename it locally to "jpg".

If you still want to pursue this idea, look into the possibility, as you mentioned, of putting the big image outside the web server folder structure. I don't know if Flash allows for that but it is a possibility. This could be also be augmented with a simple check from the web server: if the request does not come from the local system, don't serve the image.

I think the idea of having a magnifier glass is an interesting idea. I just don't know how well that will work with someone that wants to see the overall picture. Sure, one gets to see all of the picture but not all at once, and, in my opinion that is a big problem. If you think your visitors will not mind, then, by all means, go at it.

One final point:

One of the reasons why I think this was a very creative approach is due to the fact that you allow users to see portions of "the big picture", even a VERY large hi res picture (that could be many Mb in size...), without having the picture transferred to the browser. All it comes to the browser is a tiny 6kb file. This "trick" is, I think, worth exploring more for other uses. Just not this one.

Having said all of that, remember: if there is a will there is a way and what I did, should not be seen as a statememt on your level of security but more a comment on Flash. It was a demonstration that, via the web, just about anything is possible. It was, from my perspective, simply an academic exercise.

Quote:

Originally Posted by chrishoggy

You did it via common folder name, thats after you got it
...
were in was server side access only?

chrishoggy · #14 02-12-2006, 06:58 AM

Yes decompiling is one of the easy ways round it, but that is yet another hole that will be blocked, by encrypting the swf scripts. As you will have seen there was no protection on this item at all (except standard import protection). It is just a flash effect that has been modified to show before and after on a roll over

But saying that, it has made life difficult for the 20+ people who have been trying like mad to guess/work out where the files are (404's all over my logs

). So a 1 in 20 success rate isn't bad for a method that has no security applied to it at all. Once the security is applied this should improve dramatically, making ripping of the image nearly impossible for the every day user/customer

Cameraken · #15 02-12-2006, 07:35 AM

Hi Chris.

Well I was one of the people who tried and gave up. I think you idea has potential. I would not have a clue how to decompile a swf file (I could do some reading and then it may be easy) But I think this would stop the vast majority of people.

I did find the magnifying glass a little annoying. It’s difficult to get a feel for the whole picture. Maybe if the magnifier was not so strong and a little bigger then it would have been better.

Ken