Web font copy protection

ian
ian Posts: 3
in Font Technology
I have been exploring ways to protect WOFF2 fonts from being harvested and stolen by agents and scrapers. 

The concept is simple, use a simple xor based encryption to scramble the bytes offline with a key. Then in the browser use a simple javascript to decrypt the encrypt font and registers it through the FontFace API via a Blob URL.

here is the code if anyone is interested: https://github.com/ianshk/font-scrambler

I will get around to exploring it a but more when I have some free time.

Comments

  • Thomas Phinney
    Thomas Phinney Posts: 3,183
    So, does this scheme work ok with screen readers and the like?

    And is that blob URL inaccessible to agents and scrapers?
  • ian
    ian Posts: 3
    edited September 15
    It would work with screen readers but for the decryption to work it depends on javascript.

    A Blob URL is created at runtime. It is not in the HTML, not in @font-face CSS. So will prevent a bot that wget’s the page, parses stylesheets for .woff2

  • Thomas Phinney
    Thomas Phinney Posts: 3,183
    Way Back Machine / Internet Archive?
    Other folks who want to archive a page for later offline reading/reference?
  • Roel Nieskens
    Roel Nieskens Posts: 219
    I know there can never be a solution where browsers can use the font but scrapers can't, but I love thinking about it as an excercise :-)

    There's always two levels to this: preventing "dumb" scraping, where bots simply parse CSS for links to fonts in @font-face rules, or watch network requests for font files. And the next level, "smart" scraping where you deliberately circumvent a specific "protection". Your experiment guards to the first, but not the second. A dev (or, these days, AI) will see what's going on, and request the font by jumping through the hoops you put in place.

    If your approach is to serve a broken font (signature okay, data scrambled) and you're processing the binary in JavaScript anyway, wouldn't it suffice to overwrite a few bytes after the signature (e.g. set 0x04-0xff to 0) on the server side, and restore these through JavaScript after load?

Categories