Reading · Heavydeck developer blog

This site does not allow itself to be embedded. You can still read it on the original site — the toolbar below keeps your place in the directory.

With the advent of LLMs everywhere it is interesting to have a way to prevent or at least make it costly for scrappers to obtain content from your site at places where you don’t want web scrappers to read it while people on a browser can. Here I provide yet another proof-of-work implementation using well known broken cryptographic primitives like RC4 and 40bit cryptography!

With a shell script given an HTML document, the script will keep the <head>...</head> block intact and encrypt the whole <body>...</body> with a random key. Then encrypt that document key with a per-build master key, generating a new HTML document with the encrypted content and a JS script to brute-force the purposefully weak master key.

The crypto system looks like this:

+------------+
| Encryption |
+------------+
Original content      Encrypted document
----------------      ------------------
(MASTER KEY)-----+
     |           !
     +-------->[RC4]-->(ENC. MASTER KEY)
     |
     +-----------+
                 !
               [XOR]<----------(HTML IV)
                 !
(HTML KEY)---->[RC4]---->(ENC. HTML KEY)
    |
    +------------+
                 !
(HTML DATA)--->[RC4]--->(ENC. HTML DATA)
+------------+
| Decryption |
+------------+
(ENC. MASTER KEY)--------->[BRUTE FORCE]
                                 !
                            (MASTER KEY)
                                 !
(HTML IV)--------------------->[XOR]
                                 !
(ENC. HTML KEY)--------------->[RC4]
                                 !
(ENC. HTML DATA)-------------->[RC4]
                                 !
                            (HTML DATA)

The encrypted HTML document will contain all the required material to decrypt the content, provided it can crack the master key which is quite weak on purpose, around 20bit of effective key length. The cryptographic info embedded on the final HTML would be:

Encrypted master key (40bit and weak, shared across many documents, brute-forced by client)
HTML key IV (40bit, unique per document)
Encrypted HTML key (128bit unique on a per document basis)
Encrypted HTML content

<!DOCTYPE html>
<html lang="en">
<head>
  <!-- Head would remain intact -->
</head>
<body>
  <input id="key-master" type="hidden" value="hbAZKe8=" />
  <input id="iv-master" type="hidden" value="+wKTSn4=" />
  <input id="key-document" type="hidden" value="a3A8Lv0jkV4DnVyAg932Pg==" />
  <input id="encrypted-html" type="hidden" value="DA...vcJQ==" />
  <p id="status">Decrypting page, please wait...</p>
  <script src="/static/norobots.js"></script>
</body>
</html>

This post is “protected” with this schema. Yes, I know the content is on the RSS feed, but on non-feed pages the content would be “protected” until scrappers decide to run CPU intensive JS code just to extract the musings of a random developer.

Why RC4? Why 40bit?

Because I don’t need real security, it only needs to be a nuissance for would be scrappers and also, RC4 was alongside ChaCha20, the only stream cipher available on the openssl command line tool, and RC4 has plenty of small JS implementations that fit on a handful of lines, ready to be copy-pasted on the decryption script. And 40bit crypto is a nice throwback to the times where “export” and “non-US” versions of software existed.

Weak crypto and a total lack of privacy is necessary to keep us safe! /s

Not for scrappers

Why RC4? Why 40bit?

Comments