One does not simply redact amounts in a money app(try-simon.app)
try-simon.app
One does not simply redact amounts in a money app
https://try-simon.app/technical-blog/redacting-amounts-elegantly
4 comments
> i was thinking "You need to use the backend the info shouldn't be traveling to the client"....
If it leaves the server, it’s available to anyone who has access to the display device.
And if it’s meant to be displayed to the end user - as this content is - it needs to leave the server.
There is just no other way to have the user see that info.
That’s the same no matter what you want to serve up, be it dollar values or images. Nothing prevents a person who has full control of the display device from copying it or gaining access to it.
I’ve run into that problem before, most notably with a client who - back in the 90s, so the very early web - desperately wanted a website with large, stunning photographs of the product his company was making, but he wanted 100% assurances that no photo could ever be copied locally and “stolen” off of this website. In the end, I had to tell him that anything that is visible to an end user is fully copyable and “stealable”, and there is nothing that provides even a fractional assurance, much less a complete assurance against “theft”. Because that’s the fundamental nature of any website.
Even in today’s web environment, screenshotting the display utterly circumvents whatever display protections may exist against copying content, because screenshotting occurs outside of the web browser.
What OP’s solution is, however, is a protection against shoulder surfing, and nothing more. It’s the result of a flag that the user can enable so that others in the vicinity aren’t going to be able to visually snoop. And for that objective, this font is ideal, especially since the raw values still need to be summable by the client-side code. And client-side code that works with text values is utterly unaffected by font choice.
If it leaves the server, it’s available to anyone who has access to the display device.
And if it’s meant to be displayed to the end user - as this content is - it needs to leave the server.
There is just no other way to have the user see that info.
That’s the same no matter what you want to serve up, be it dollar values or images. Nothing prevents a person who has full control of the display device from copying it or gaining access to it.
I’ve run into that problem before, most notably with a client who - back in the 90s, so the very early web - desperately wanted a website with large, stunning photographs of the product his company was making, but he wanted 100% assurances that no photo could ever be copied locally and “stolen” off of this website. In the end, I had to tell him that anything that is visible to an end user is fully copyable and “stealable”, and there is nothing that provides even a fractional assurance, much less a complete assurance against “theft”. Because that’s the fundamental nature of any website.
Even in today’s web environment, screenshotting the display utterly circumvents whatever display protections may exist against copying content, because screenshotting occurs outside of the web browser.
What OP’s solution is, however, is a protection against shoulder surfing, and nothing more. It’s the result of a flag that the user can enable so that others in the vicinity aren’t going to be able to visually snoop. And for that objective, this font is ideal, especially since the raw values still need to be summable by the client-side code. And client-side code that works with text values is utterly unaffected by font choice.
This is to protect against shoulder-surfing. Having the information present on the client and accessible to the user while appearing redacted is very much the point.
Exactly. One can open the inspector and see the values.
And then they come up with a font to make it look redacted while clearly having the values there in the open.