[thelist] Staving Off Photo Thieves

[Nicholas Dunham]

Matthew Garret advised:
> in all seriousness, go to the Alchemedia site and give it a try in their
> demo area. The demo requires downloading their plug-in, but if you're
> looking for a challenge...
>
> http://www.alchemedia.com/demo/demo.html
>
> good luck.
> matt

Interesting. I went to the demo page, installed the plugin, and tried some
screenshots. You're right, they didn't work. Where the images should have
been, I instead found the Clever Content logo.

So yeah, that will certainly stop most users. They can't right-click, they
can't take a screenshot, and the image isn't in the cache. Not bad. I was
particularly impressed when I fired up HyperSnap DX 4, which is supposed to
be able to take screenshots of even DVD overlays. Clever Content detected
the presence of HyperSnap and wouldn't display any protected images at all
until I closed it down.

Curious, I did a little digging.

Where the image would normally be in the HTML, there was now a big hunk of
JavaScript (all told, something like 50K of JavaScript is needed to make
Clever Content work within the page, but 44k of that is in an external
script). I first tried putting the value of the cs_image variable after the
value of the cs_server variable, and I did get the image, but with a
semitransparent Clever Content logo superimposed over it. There are some
other variables in the script; I'm not yet sure what some of them (like
cs_usctime) are for. Maybe I'll play with it some more over the weekend.

One of Alchemedia's competitors was interviewed by ZDNet (I think) a while
back and said his programmers had managed to get around Clever Content in
about an hour. Alchemedia responded to the effect that weren't worried about
complex hacks; fooling most of the people most of the time was sufficient
for them and their customers. That's fine, but if the Clever Content plugin
becomes more popular, you can bet some hacker will release software to do it
for you -- probably with a nice, skinnable GUI. A quick search online
revealed another way to do it: link two computers using software like
Timbuktu Pro (or a free online implementation thereof, such as
http://www.uk.research.att.com/vnc/ ). One machine is actually running the
Clever Content plugin while you view the output on another machine. Use the
one that isn't running the plugin to take the screenshot. Again, it's
convoluted and inconvenient, but it works.

This might be a cheap shot, but I also have my problems with the technology
itself: in my mind, forcing the user to install an uncommon plugin is not a
viable option in most cases -- especially when said plugin is unavailable to
users running *NIX, Mac OS X, or a browser without JavaScript enabled (or,
for that matter, behind a proxy that doesn't allow JavaScript).

Someone also corrected me regarding Digimarc. The reason I had thought the
screenshot trick killed Digimarc encoding is that when I tested it out on
one of my own images, I cropped a little bit of the original in the process
of cropping the screenshot, which ruined the digital watermark. That only
works some of the time. Resampling is a little more effective (the Genuine
Fractals plugin is famous for destroying digital watermarks), but again,
this doesn't always work. Still, if you want to get around it, it's not that
tough to do. For more information on the fragility of Digimarc digital
watermarks, go to the source:
http://www.digimarc.com/support/cswater03.htm

I think my point remains valid: traditional copyright procedures are still
the best way of protecting your intellectual property.

-- Nicholas