A Clever (but not so good) Scraper Protection

Here is an interesting anti scraping measure that was pointed out to me by a reddit post recently.

Take a look at this displayed text and then the HTML content for that exact same text.

The HTML appears to be a random mess of characters, this must be some JavaScript trickery right? Nope! Even when disabling JavaScript on the web page the text still renders as readable content and the HTML remains jumbled!

So how does this protection work? Well if you take a closer look you might notice

This class must be doing something to the text that causes the seemingly random letters to appear readable, and yep, the class "jum" is applying the font "OpenSans-Jmbld" to the text.

If we download this font file and open it up in FontForge we can see that all of the letters have been re mapped to other letters!

This is how they are displaying the correct text!

Now it becomes more interesting if you think about how you would go about bypassing this. You'd just need to manually go through and create a map for every letter right?

But what if the website decided to start randomly generating a different jumbled font on every page load? Not as simple anymore is it? How can you programmatically determine what visual letter each character represents? Fonts aren't easily parsable, if we take a look at what the letter R has been mapped to, its in an SVG like format!

Now you could go about bypassing this new automatically randomized font by creating a mapping from letters to image representations of letters and then rebuild the character mapping that way.

But what if your target is even more clever? They realize you have a mapping and decide to add micro variations to their fonts. (ex: what if the top right of that N was 1 unit wider?) This ruins your mapping since you cant 1:1 match letters anymore, so what are you left with?

Your only other options are to give up and start wasting lots of resources rendering and using Optical Character Recognition (OCR) on the webpage, or if you think you have it in you, start making your character mapping builder even more complex by adding AI or fuzzy searching for characters within specific bounds.

I have to note though, the site that this was noted as being on removed it soon after, I assume their jumbled text, while interesting, did not do very well when fed to Googles web crawler for search ranking.