136

I'm working on a website on which the client wants to disable copy-paste.

It's not to do with security or passwords, but that the data on display is valuable if taken en masse (and almost no value if taken singly), though the user can only access the data one at a time. (There is no page a user can access with multiple items.)

I have advised that this is probably bad UX, and that it won't block screenscrapers or similar, but at the end of the day it's his decision.

How much of an impact does blocking this functionality have on a website? Is it likely to turn off users from engaging, or is it a non-entity and I am putting too much value in this?

If it's a big deal, do you have any recommendations on how to advise the client?

The client knows it won't stop even semi-skilled or determined individuals but wants to stop any casual attempts to retrieve data. I'm minded to just show him some of these answers in response.

  • 54
    You've answered your own question. – DarrylGodden Aug 11 '17 at 15:21
  • 121
    Anyone who wants to take the data en masse will use some kind of automation, not copy/paste. So it will only inconvenience the people who want to copy it singly. – Barmar Aug 11 '17 at 17:55
  • 78
    Disabling copy/paste is pointless. You can literally just save the webpage to your local machine and do whatever you want with it. – MikeTheLiar Aug 11 '17 at 18:21
  • 227
    Whenever I am on a website with blocked copypasting I know that I am dealing with idiots. – courteouselk Aug 12 '17 at 9:31
  • 5
    Any content on a website should be deemed to be public information, and as such it's not secure no matter what. Anyone determined to get the data are not likely to use standard copy and paste, and if they wanted to they can save the web page and copy/paste out of that anyway. Your client will spend more time and money "preventing" the content being copied than it's likely worth, and there's always a way round it. Advise them as such, and be sure to bill them for all the time spent trying to prevent it – gabe3886 Aug 14 '17 at 15:44

14 Answers 14

189

Ask your client what he's actually trying to accomplish.

Copy-paste restrictions are about as effective as a toddler gate preventing access to an unmonitored garden in a remote area.

Perhaps you could ask the client where he saw copy-paste restrictions being used. Then, while he's there (or via screen share) show him how you'd defeat it.

When the client says:

"Yeah, but you're a professional hacker/coder/computer/nerd"

Then search the internet for:

"Why can't I copy text on a website"

If the goal is to inconvenience people, or if the information isn't extremely valuable... blocking copy-paste may be useful.

You may think that there's no legitimate reason to copy a piece of content, but then you forget use-cases like people using translators. They will copy a word or a phrase and pop it into their translator program... and no, not always Google translate.

I wouldn't rule out copy-blocking, but point out that it a copy-hurdle, not a copy-block and if someone wants the information, it's relatively easy to get access to it.

  • 186
    Another goal that blocking C&P can accomplish is to make legitimate users think your site is broken. This in turn can help minimize your bandwidth and hosting expenses. – Tim Grant Aug 13 '17 at 16:03
  • 22
    It's not just translators. If I want to tell you about an error on your site, or ask you a question about what some text means, it's easier to copy-paste the text than type it out again. Or if I want to quote the website to answer a question from a friend -- or on Stack Exchange! – David Richerby Aug 14 '17 at 8:40
  • 36
    @Zaibis. そうですね!どうして書けない?<= That's why. – Nolonar Aug 14 '17 at 15:38
  • 16
    @DamianYerrick As someone who has lived as an expat in a country that's basically linguistically homogenous, I hate people who arrive at this conclusion. I will prefer English whether I'm in Canada, Brazil, Korea, or Hungary. If the website I'm using can't facilitate using my native language, I'll try to find another website. – Myles Aug 14 '17 at 16:08
  • 7
    @DamianYerrick: Those are good examples for country-specific services that some users may legitimately want to translate nonetheless. – O. R. Mapper Aug 14 '17 at 22:53
149

Disabling copy/paste likely won't stop many people that really want the data, but it may cause inconvenience to users that have a legitimate reason to copy/paste from the site.

Given that users will have to navigate page by page to get the data (I assume the complete dataset is fairly large), I'd be more concerned about people scraping your content than people manually copy-pasting. I highly recommend reading this great article outlining how to prevent scraping. In it, when talking about copy-paste, the author states:

Human copy - and - paste: People will copy and paste your content in order to use it elsewhere. Unfortunately, there's not much you can do about this.

Indeed, a simple google search shows that disabling copy-paste has many work arounds.

When talking to your client, I would try showing them how disabling copy/paste can be worked around, and talking to them about web scraping (and ways to prevent it) as it's the more likely avenue for acquiring the data.

  • 10
    +1 for addressing copy+paste block circumvention. If the data's valuable en mass, it'll be pulled en mass in a way that disabling copy+paste will be irrelevant. – Harris Aug 11 '17 at 18:20
  • 1
    Given the lack of context (e.g., we don't know what the site does, how users will be interacting with it, if copy and paste would make completing tasks easier, etc.), we can't say if blocking copy-paste is a big deal, but I can imagine it being inconvenient. His client seems to be concerned with protecting the data, and I was pointing out that disabling copy/paste won't really address the issue and that his client needs to be made aware of this. – Jonathan Aug 11 '17 at 19:34
  • I understand where you're coming form, and I really do appreciate the well-researched and supported information on copy/paste circumvention. I didn't think it addressed the basic question of "How much of an impact does blocking this functionality have on a website? Is it likely to turn off users from engaging, or is it a non-entity and I am putting too much value in this?" I did not see, however, the final question asked "If its a big deal, any recommendations on how to advise the client?" Your answer does a great job of that. I'll edit my comment above. Apologies! – denveruxer Aug 11 '17 at 20:08
56

These commands are part of the bedrock of user experience. They are some of the very few commands that work across nearly all applications and contexts, and removing them is far more likely to have a negative impact on user experience and task abandonment.

In his article on generic commands (IE commands that stay consistent across multiple contexts), Jakob Nielsen has this to say about cut/copy/paste:

The cut-copy-paste triad offers the most famous example of generic commands. These 3 basic commands suffice to let users do everything from move text to edit movies. In fact, because they work across so many applications, I view them as " super-generic commands."

The first guidelines for generic commands are:

  • If at all applicable to your domain, your application should support the super-generic commands that people expect and know from other applications.
  • In particular, provide cut-copy-paste commands for moving stuff around.
51

As a security professional, I disagree that

It's not to do with security

You are trying to prevent sensitive information from leaving its intended context (the web browser). By definition, this is an information security issue and should be treated as such.


Putting on my security hat, let's frame this as a security problem.

Asset to protect: content of the web pages.

Threat model: user extracting the data from the browser, perhaps to a file on disk.

Mitigation: disable copy&paste.

But does that really mitigate the threat? The usual rule-of-thumb for this is that if a user has read access in one context, then they copy the information into a different context - almost regardless of what type of read access or what type of context. For example, if they can load the web page, then they can write a script to fetch all pages and dump them to a file.

In practice the game of restricting the copy of information is a spectrum, from weakest security model to strongest:

  • Free to make digital copies.
  • Digital copies are possible, but tricky to do.
  • Digital copies restricted (usually because it's a non-internet closed network), but cell phone photos can be taken of the screen.
  • Cell phones are not permitted in the building, but pencil&paper copies can be made.
  • Paper is not permitted to leave the building, employees are searched on their way out. You better have a good memory.

Basically this is a game of making the information harder to acquire than it's worth - a deterrent at best. At some point it's more cost-effective to do extra screening on who's allowed to access the information and rely on good ol' fashion trust & loyalty.


Bottom line: disabling copy&paste raises the bar for copying the information, but certainly does not prevent it. Your client needs to view this as a security issue, and apply a security mindset. IMO disabling copy&paste is one of those security theatre things that management can feel smug about, causes a great deal of inconvenience to users, yet does absolutely nothing to prevent skilled hackers.

There's also a running joke over at security.stackexchange called AviD's law of security:

Security at the expense of usability comes at the expense of security.

since users who find your security too onerous will always find dumb workarounds.

  • 37
    "IMO disabling copy&paste is one of those security theatre things that management can feel smug about, causes a great deal of inconvenience to users, yet does absolutely nothing to prevent skilled hackers." I couldn't agree more. Even unskilled hackers wouldn't have much problem getting around it. "Security at the expense of usability comes at the expense of security." I hadn't heard this phrase before, but it's absolutely perfect. I'll have to keep it in my back pocket. – denveruxer Aug 11 '17 at 19:07
  • 6
    @denveruxer :D If you use it, credit goes to one of the security.SE moderators AviD. – Mike Ounsworth Aug 11 '17 at 19:15
  • 7
    @SinanÜnür The mere act of disabling JS is not hacking. But using this to ingeniously circumvent copy-paste protections of a web page clearly is. I mean, most hacks are doing semi-ordinary things to achieve extraordinary results. /tongueincheek – hyde Aug 14 '17 at 11:59
  • 13
    Sounds similar to a popular definition of software copy protection: "A class of methods for preventing incompetent pirates from stealing software and legitimate customers from using it. Considered silly." – bye Aug 15 '17 at 16:11
  • 7
    In fact, a security-conscious user may not even be aware that you're trying to block copy-pasting. They may be running a script blocker. It's even easier if the copy-blocker is served by a different domain from your content – Chris H Aug 16 '17 at 9:06
27

Your goal is to block bulk copying of text. To do this, you need to throttle scrapers, not remove accessibility elements from humans.

Blocking copy/paste means disabling the context menu.

That means you lose all contextual control, including accessibility ones like "google this", "translate this", etc; and social media options like "share this" and "copy link URL".

Options like "open in new tab/window" become unavailable unless they know the hotkey.

Accessibility extensions which use rightclick as part of their key-combo (image zoom, etc) are also affected.

I dunno about you, but I always hate websites like this because they conflict with how I use the web. I have to turn off JS just to use them properly, and then the sites often rely on JS just to function, because the kind of knuckledragging mouthbreather who uses copy/paste blocking to prevent bulk theft by scrapers, usually doesn't get the importance of graceful degradation.

Most importantly though: Google is a disabled reader. If you harm accessibility, you risk harming SEO.

Now, I don't know of any evidence that this particular accessibility problem gets you dinged by Google... but simply bringing up the possibility is enough for most clients back down on this issue.

  • 3
    "Your goal is to block bulk copy pasting" I disagree, that is the proposed method. The goal is to stop users copying the data in bulk. It may sound like a subtle difference, but it's not – Darren H Aug 13 '17 at 7:53
  • 3
    Though "Google is a disabled reader", Google lacks the credentials (password, email, OpenID, etc.) of a valid subscription. – Damian Yerrick Aug 13 '17 at 15:55
  • 3
    Killing the context menu effectively kills my back button, in Firefox: Right-click, move the mouse down and right a fraction, left-click. – Ed Daniel Aug 14 '17 at 12:12
  • @DarrenH Very good call, it's an important distinction: I've changed "block bulk copy-pasting" to "block bulk copying of text." – Dewi Morgan Aug 14 '17 at 23:23
  • 1
    Google aside, you may have accessibility requirements that this conflicts with. I've known naive users with poor vision paste small text into Word because zooming the page enough to read it doesn't handle the layout properly. If your layout is complex, copy-pasting into a clean window (e.g. Word again) is good for screenreader software – Chris H Aug 16 '17 at 9:09
14

tl;dr

Don't bother


This doesn't solve the problem

The usability aspect is irrelevant.
Does a user accessing your data want to copy and paste it to gain value? Rarely.

The security aspect is irrelevant.
Does a data thief want to show up with a mouse, click, drag, copy, and paste to steal your value. Never.

I understand how your product owner came to this position: navel gazing. There is probably zero real data behind the decision. Just fear and insecurity.
Maybe because InfoSec / Engineering didn't adequately address the implications.
Maybe because this person is arrogant and irrational.

In either case, it is wasted engineering that leads to slightly frustrating experience and zero real world security.

9

The company, in which I used to work, disallowed cut&paste from "across the bubble" between our vnc based working environment, and our public email, documentation, QA and diagnostics environments -- for so called "security" reasons. The key words here are "used to work". I think our productivity took a 90% drop the first month, and was still down by 30% half a year later.

Result was that that it took away a standard simple way we worked for years, required people to adopt less successful working procedures, and pissed off the entire staff. Migration out of the company to a sharp rise. Product was delayed and eventually flushed, and entire team is working elsewhere. One question that often gets asked when we run into another these days is "does you current management enforce those crazy policies like we had back in the good old days" The answer us universally no.

In my opinion, the management adopted a set of policies that they did not understand for reasons that were totally wrong, and thus upsetting the entire balance and trust in their leadership skills.

I know this sounds like a long winded answer to you question, but either get your managers heads screwed on right, or it's time to start looking at for another job.

If I ever run into a site that inhibits basic features like cut&paste, I will move to another site.

  • 1
    Can you be more clear in your answer? I have trouble reading the real answer here... Thanks. – Benny Skogberg Aug 12 '17 at 15:23
  • 3
    @BennySkogberg he's exceedingly clear: the restrictions are so irritating that people will leave their job to get away from them. Guess what your customers would do? – jwenting Aug 14 '17 at 9:51
6

There are two minor (or not so minor) other annoyances to users that you will create, due to breaking the principle of least astonishment.

Especially on "noisy" webpages, some people use double clicking and thus marking of non-link text as a reading aid, similar to keeping track of your current line with your finger in a dead-tree book.

Many people use the "google search for..." right-click feature found in multiple modern browsers to further research things found in the text.

Also, evidence of intrusive and clumsy javascript (anything that blocks browser features or pops up dialogs when such is not expected) tends to make people feel unsafe with your page open (too much experience with sloppily written pages that suddenly blare autoplay into your headphones, sabotage your back button or overload your browser into unresponsiveness) - minimizing the visit length.

5

Plenty of other answers here have covered in depth as to why blocking copy/paste is generally frowned upon, so I'm not going to bother reiterating. Instead I'm going to make a suggestion, and try to deconstruct why your client is intent on pursuing this Sisyphean task.

If your client wants to prevent the user from performing a single copy/paste operation to copy all the data... then have them paginate the data (which it sounds like they're already doing?). Make the user click "Next" a couple of times to see it all, and if they're paranoid about crawlers collecting it all anyways, a simple CAPTCHA for each page or every couple of pages will put a stop to that. This still imposes an inconvenience on legitimate users, but is at least not blocking the context menu and its various legitimate uses.

The crux of the issue boils down to your client's perception of the data's value. You say it's "very valuable" en masse, but of almost no value when taken singly. If there actually is non-trivial financial gain to be had from collecting all the data, someone determined enough will copy it, even if it means copy/pasting individually (including from source code, scraper, etc) and aggregating it on their side. If, as your client seems to believe, copy/pasting individually makes it no longer worth the effort, then the aggregate data really can't be that valuable; the data is the sum of its parts, nothing more, nothing less.

At the end of the day, once that data arrives on a user's computer, there's nothing your client can do to stop them from copying it; if it can be rendered on the screen, it can be copied -- even if that means having someone sit in front of a computer displaying the data and manually transcribing it onto a laptop or tablet. Pretty much any barrier you put up to raise the difficulty of copying will also hinder legitimate users to some degree as well -- including pagination.

4

A determined thief would never use Copy / Paste, they would use a scraping tool to crawl the site and extract content in an automated way directly into their database.

If it's the organised theft of huge swathes of content your client wishes to prevent, this measure will therefore be totally pointless.

Disabling Copy / Paste will prevent isolated end-users from grabbing snippets of content in a helpful way, although it won't prevent screen-grabbing. It also won't prevent them from simply clicking "view source" in their browser and copying from there.

A simple and perhaps slightly more effective measure might be to edit an open source font, randomly cycling the characters and applying the same transformation to the characters of text so it displays correctly but is gobbledygook if copied or scraped. This would of course be circumvented by a determined individual, and it would impair your appearance in the search engines.

  • 6
    Multiple fonts and css nth-character styling! Use lots and lots of prime numbers and vary the order of rules in the stylesheet of different pages. Obfuscate it as much as possible. Then, for good measure, disable copy and paste, download the actual content from the web page using JavaScript (causing total page failure when JavaScript is disabled) and put animated squiggly lines over it to prevent a single screenshot from having enough visible text for OCR to work with. Obviously you'd serve unobfuscated content to GoogleBot though, for SEO purposes. – wizzwizz4 Aug 12 '17 at 12:28
  • Needless to say, such obfuscation would also break screen readers for visually impaired users. – 200_success Aug 16 '17 at 20:47
3

Blocking copy/paste on a website is a very big deal. What your client is trying to achieve is protect digital content from unauthorized redistribution, and falls into a category of data protection called digital rights management (DRM). I am not aware of any DRM solutions to protect text that is rendered in a browser.

Ideally, and one day we might have this, a website would encode text that shouldn't be copied to tell the browser, and the browser AND the underlying operating system would honor preventing a copy action. As it stands today, the OS's and browsers are designed to facilitate using data between apps so that is why copy/paste is a core feature in the OS UI.

All the ways that web sites attempt to prevent copy, or text selection, can be circumvented and there is no 100% solution. This article shows all the ways to work around website attempts at DRM'ing text content:

http://www.manjemedia.com/7-ways-to-copy-content-from-a-website-with-disabled-text-selection-and-right-clicking/

As the article shows, one way or another there is always a way -- if nothing else works, take a picture of the screen and OCR the picture to get the text.

  • 11
    Second paragraph: I'm not sure that is ideal. Anyway, if it wowed happens, it will rapidly be followed by a variation of the browser and OS that omit that "feature" – WGroleau Aug 12 '17 at 0:00
1

It seems like a business decision.

If disabling the copy paste operation helps the business model of your client then you should disable it.

However, from a purely UX standpoint disabling copy/paste operations will definitely provide worse UX for the users as they have to do manual work (typing) instead of automated (copy-pasting).

Try to come up with use cases where copy-pasting is good for the business model of your employer.

  • 4
    Is there any business model that could possibly depend on disabling copy-paste on a website? – 200_success Aug 11 '17 at 17:54
  • 1
    @200_success Rather, any business model that would be successful? I'd imagine not, since you can always pull the pure html with dev tools and just strip out all the html (leaving the pure text). It doesn't protect the data, you're serving it to clients and you must assume all served data is permanently available to any client. – Delioth Aug 11 '17 at 18:25
1

Wow, lots of answers here.

What is the reasoning behind this? I'd ask your client that question. That's the important thing missing here. If it's a question of data security, there are much better ways to enable that rather than blocking copy & paste.

Ultimately it is the client's decision, BUT you should do your due diligence and identify what their underlying concern is and proposing a better solution.

At the end of the day, something as basic as logging IPs is a better solution here. But you can come up with something better than that, I don't know what environment you're working in so I can't suggest anything based on that.

0

It really depends on your audience. Unlike the other answers, I'd argue that at least in some cases, it isn't a problem anymore.

There are too many smartphone apps that don't support copy-pasting in the first place, and the users don't seem to have too much problems about that. Many users already get used to this situation.

On the other hand, for the advanced users that could bypass the blocking, it might be just slightly more difficult to write a userscript that does this automatically. It isn't too inconvenient to them. It is slightly inconvenient, and more importantly, it leaves the impression that you are ignorant about their feelings. But firstly, it might not change the fact that they are indeed ignorant by not doing this. Secondly, there are many websites that do annoying things such as requiring registration after you have read a certain number of pages, and / or sending you nonsensical emails that cannot be unsubscribed without unsubscribing all the emails from this website, which may contain important informations. And they require slightly more efforts to workaround. Blocking from copying isn't much worse than these things.

Users like me may still feel it bad and making no sense, by the common sense of internet built from maybe 10 years ago. But modern smartphones weren't that common, and people didn't quite understand the need of copyright protection. More importantly, it is one of the few annoying thing they could do 10 years ago and still works today. With the more possibilities of being annoying, I doubt new internet users would perceive it in the same way as I would. With the growth of internet users and the fraction of advanced users, it might be really not that important, depending on what business you are doing there. Even these users may feel that there are much more troublesome DRM systems in the world and they really don't need to hate a website that they know the workaround.

There are also users being just that advanced, who can copy the text, but cannot automate it. But there might not be many of them. But you have to check that there isn't a huge fraction of them in your audiences.

But you have to be sure, that they want to block the normal users who find it helpful to spread the information in your website, and none of the automatic crawlers to copy your website completely. Yes, it does make some sense in some cases. It also makes keyword search more difficult, but you may accommodate that by adding the similarly annoying keyword links.

  • 'people didn't quite understand the need of copyright protection'? I still don't see ant value in digital restrictions management. – hildred Aug 16 '17 at 15:20
  • @hildred Someone needs it. You only don't believe it actually works and is really beneficial, while someone does. So you'll only try to argue about it, and not consider it strange and too unexpected. In that case you'll be more likely to argue about the cases that do real damages, and not merely a website that has slight inconvenience. – user23013 Aug 19 '17 at 9:11
  • DRM at a best case is an inconvenience, when it is not an active harm. Businesses make money by providing value like reducing inconvenience. A slight inconvenience is real damage resulting in loss of profit or reputation. If it was not why study usability and why have EX? And then there is the slippery slope argument. – hildred Aug 19 '17 at 12:53
  • @hildred I don't disagree with your opinion about DRM. But it doesn't matter. My point is while there are many websites doing much worse, most people (that either haven't used the internet for many years, or are not advanced users) won't take the slippery slope argument seriously. – user23013 Aug 19 '17 at 13:05
  • @hildred Or I could say the really bad DRM systems are so harmful, that the new generation has less chance to know something using them, and there is even less chance that they really want to buy them that much. In other words, it is becoming not so harmful to most people, but more harmful to the business. It was once quite harmful to the people, but had unmeasurable effect to the business. So the people had a strong opinion. But now as this effect becomes clearer, most people really don't need to be too sensitive about that. And no slippery slopes anymore as worst possible cases are removed. – user23013 Aug 19 '17 at 13:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.