Hacker News Reader

Comment by mimsee | Hacker News Reader

This reminds me of old websites blocking right clicking on a webpage since that's how you viewed the source code, yet there's always a way to get the source. Same in this case, there's always a way to capture the "protected" content.

Edit: granted, not only old websites do this. Instagram lays a full width/height transparent div atop the picture to prevent right-click copying of the image.

View on HN

Except the platforms are getting better at it. Android has an API which allows apps to completely block the screenshot functionality. For the average android user, there is no way to get around this. Computers are getting locked down more and more to the point where these kinds of restrictions actually start working.

> these kinds of restrictions actually start working.

This - it didn't use to be true because most computer users were literate enough to bypass simple restrictions, and if a platform was restricted, others were available.

With the latest changes in Windows, Android, and demographics, now a vast majority of users cannot easily bypass restrictions; the war on general computing has been won. Yes, a small number of highly skilled people can easily dump binary data through hacked devices, but in the grand scheme of economics, that doesn't matter.

Yeah, and it is pretty sad. :/

It’s not just demographics. With the hardware attestation/safety net and locked bootloaders today. I don’t even know how to bypass these restrictions.

How DO you get around this screenshot block? I never figured it out and I am probably not average.

Xposed modules (can even be targetted at specific apps in a root-less way using Taichi), patching system libraries with smalipatcher to disable the "secure flag" system wide or root screen capture tools like scrcpy.

Do you know how Tai Chi compares to VirtualXposed?

With another device that takes pictures

I’m glad I’m privileged enough to have multiple devices with cameras

Its a low bar, but I was told to check my privilege and I do love doing that now

One trick is to use scrcpy then make the screenshot with your computer instead

iOS has the same bug. That feature should be removed out of respect for the users.

Windows has that API to. If you try to screenshot the Netflix app or video on some websites you get a black rectangle where the video is.

Yeah, it's so tiresome. It's my device, I should be able to do anything if I want to. Then Android comes up with some API to let apps subvert my will. Who cares if the app doesn't want to be screenshotted? I'm the user. What the app wants doesn't matter, it's never mattered. I could fight this by rooting my phone and using custom implementations that lie to the apps and only pretend to be secure. Then Google comes up with hardware attestation and now there's no way to fake things anymore. It's like we're the enemy that the phone is being secured against. I barely have words to describe how much I hate these companies and the way they try to control me.

We have free software everywhere except phones. I wonder why organizations such as GNU aren't working on free software clients for these popular services like WhatsApp and Telegram. The potential for a positive impact is enormous.

All Telegram clients are already fully open. (The server side is not, but there are third party implementations).

https://github.com/telegramdesktop/tdesktop

https://github.com/DrKLO/Telegram

https://github.com/TelegramMessenger/Telegram-iOS

Plus a few web frontends, I am way too lazy to find them all.

https://github.com/zhukov/webogram

WhatsApp forbids third party clients IIRC.

> It's like we're the enemy that the phone is being secured against. I barely have words to describe how much I hate these companies and the way they try to control me.

I’ve had enough of it, too. Ordered a Librem 5 and can’t wait for the day it arrives – so I can finalize my divorce from the Apple ecosystem.

> I wonder why organizations such as GNU aren't working on free software clients for these popular services like WhatsApp and Telegram.

Regarding WhatsApp, it looks like it’s against their TOS, and Meta goes out of their way to detect usage of third-party apps and ban your account [1].

Regarding Telegram: not only do they allow third-party implementations, they even link to them [2]. Besides, Telegram’s own desktop client is FOSS under GPLv3 [3].

[1]: https://www.cultofmac.com/314343/use-a-third-party-whatsapp-...

[2]: https://telegram.org/apps#unofficial-apps

[3]: https://github.com/telegramdesktop/tdesktop

Nope. We have free software everywhere, except phones, heavy manufacturing systems (where a 3d control can and will be downgraded to reduced-precision on one axis in software just because you are in the wrong country, or disabled if GPS doesn't work), legally valid government interaction (I am disallowed by the contract to use my government-issued S/MIME certificate with anything else except CryptoPro), and many other places.

I recently came across a fairly modern looking website that blocked my right click and displayed an alert “you’re not allowed to view this sites source code”. I could not help but to laugh out loud

Chrome did introduce a configuration feature to block viewing source code recently.

Javascript hijacking right click is prevented by shift-right click in Firefox.

Note that this is an enterprise policy and not something a website can enable, only your computer's administrator (you on your personal device, a school admin or employer in the intended case)

For now

Seems pretty impossible to enforce otherwise with how the web currently works.

At some point the website is sending you HTML and JS to be interpreted on your computer.

Same as with the Telegram's DRM.

The difference between an enterprise device management feature and a web API are... pretty massive.

It doesn't seem particularly unreasonable that a company dealing with sensitive data would want to prevent their less computer-educated employees from falling for self-XSS attacks

https://en.wikipedia.org/wiki/Self-XSS

View source is completely disconnected from the developer tools, and poses no self-XSS danger.

The given reason to disable view source itself was "students are able to find Google Form Quiz answers in source code" which is pretty ridiculous.

Also something about getting past a really broken web filter.

Ah sorry, I was thinking it was the entire browser console.

Or maybe that was already an option to disable by admins before this

500px at some point started to use the right-click-blocker even on Creative Commons licensed images (!) — I quit the site over this. IIRC they eventually dropped the option to select a CC license entirely :/

Some legislations have pretty rubbery rules about "circumventing effective DRM" to tack extra charges onto you if you find a way to save content the content creator does not want saved. I would argue that a DRM that can be circumvented is no longer "effective", but lawyers and judges might think differently about that.

Haha yes. I think I first saw this on social media websites, so it's a very close comparison.

This introduced me to developer tools and the funny 3d view of html layers that Firefox had.

Reply on news.ycombinator.com