HN Debrief

Anti-AI fonts are useless and harmful

  • AI
  • Accessibility
  • Web
  • Privacy

The post takes aim at a growing class of “anti-AI” fonts and text obfuscation tricks that try to keep bots from reading web pages while leaving the text legible to humans. The core claim is simple: if a person can read it, a determined scraper can eventually read it too, so the practical result is usually degraded accessibility, worse usability, and false confidence. That landed hard with most readers. The strongest point was not just that these fonts are beatable, but that they break the good kinds of machine reading first: screen readers, browser reader modes, translation, copy-paste, indexing, and other assistive or routine tools. Several people compared the pattern to DRM and old CAPTCHA design. It punishes legitimate users immediately while only slowing determined scrapers until OCR or font-specific decoding catches up.

If you publish on the web, assume visible text can be extracted. Do not ship anti-scraping tricks that break screen readers, reader mode, translation, search, or basic usability unless you are in a narrow, high-value workflow where the friction is intentional and acceptable.

Discussion mood

Mostly negative and dismissive. People saw anti-AI fonts as DRM-like theater that harms accessibility and normal web use right away, while offering only temporary friction before scrapers switch to OCR or build custom decoders.

Key insights

  1. 01

    Accessibility tools take the hit first

    The practical damage lands on screen readers, reader view, and other assistive tools long before it lands on AI companies. That flips the usual justification on its head. The people blocked hardest are legitimate readers who rely on machine mediation to use the web at all. Treating that as acceptable collateral makes the defense look less like protection and more like deliberate exclusion.

    Audit any anti-bot idea against screen readers, reader mode, translation, and copy-paste before you ship it. If those fail, you are not adding a speed bump. You are cutting off part of your audience.

      Attribution:
    • danudey #1
    • jimmaswell #1
  2. 02

    Search and discovery can collapse

    Poisoning the machine-readable layer does not just confuse model trainers. It can also poison search indexing and make your site less discoverable. ShieldFont’s own approach drew criticism for serving decoy text to bots and forcing an expensive uncover step for humans and tools, which means you may hide yourself from the systems that help readers find you in the first place.

    If traffic or discoverability matters, test how your pages are indexed before adopting obfuscation. A defense that cuts off search can cost more than any scraping it deters.

      Attribution:
    • kstenerud #1
    • gs17 #1 #2
  3. 03

    Accessibility bypasses double as scraper APIs

    Once a system includes a button or workflow to reveal the real text for accessibility, translation, or copy, that reveal path becomes the obvious target for automation. The expensive puzzle or extra click may deter the cheapest scrapers, but it also concentrates the attack surface into one clean mechanism that can be scripted. That makes the protection self-defeating at web scale.

    Assume any recovery path you add for humans will be used by bots too. If your scheme depends on that path staying manual, it will not hold up once anyone cares enough to automate it.

      Attribution:
    • kstenerud #1
    • evnp #1 #2
  4. 04

    Cost increases only matter while adoption is small

    The argument for these fonts is not that they are unbreakable. It is that they make extraction more expensive. The catch is that cost only stays high while each implementation is rare. As soon as one scheme spreads, someone writes a tuned decoder or efficient OCR pipeline and the marginal cost drops fast. Then you are left with the usability penalty and little defensive value.

    Do not confuse today's awkward workaround with a durable moat. Model the defense after it becomes popular, not while it is still a novelty.

      Attribution:
    • gizmo686 #1
    • bawolff #1
    • pixl97 #1
  5. 05

    We already ran this playbook with CAPTCHAs

    People pointed out that distorted text defenses have been losing to machines for years. CAPTCHA history matters here because it shows the asymmetry clearly. Generated text only needs to stay barely legible to humans, but machines get to train on unlimited examples and specialize. In practice, specialized OCR often beat humans on garbled text long before modern multimodal models arrived.

    Treat text distortion as a studied failure mode, not a fresh invention. If your plan looks like CAPTCHA for training data, expect the same outcome.

      Attribution:
    • hk1337 #1
    • mister_mort #1
    • Xirdus #1
    • strangecasts #1

Against the grain

  1. 01

    A scraping tax can still be worthwhile

    Even if obfuscation is not encryption, making extraction expensive can still change scraper economics. Rotating schemes per site or per page could force bot operators into headless Chrome, screenshots, OCR, or LLM-assisted reverse engineering. That will not stop a determined target, but it can price out casual scraping and reduce bulk harvesting.

    If you only need to deter low-effort scraping, a cost-raising layer may be enough. Be explicit that you are buying friction, not protection, and measure the user harm against that narrower goal.

      Attribution:
    • palmotea #1
  2. 02

    Niche document workflows may accept the tradeoff

    There was one concrete use case where intentional obfuscation may be defensible: legal or private document exchange between known parties who want to slow automated review or leakage. In that setting, reduced convenience and separate accessibility handling may be tolerable because the audience is small, authenticated, and already operating under custom terms. That is a very different problem from publishing on the open web.

    Reserve this kind of technique for closed, high-value workflows where friction is part of the policy. Do not generalize a private document control into a public website pattern.

  3. 03

    Temporary friction may be enough for some publishers

    A few people argued that stopping AI completely is the wrong bar. For personal sites or low-stakes publishing, delaying extraction and making mass scraping more annoying may be good enough, even if the scheme would fail against a motivated attacker. That view treats anti-AI fonts as a nuisance tool, not a robust security control.

    Decide what success means before dismissing or adopting these tools. If your goal is only to add hassle and you do not depend on search or accessibility-heavy usage, the tradeoff may look different.

      Attribution:
    • Varelion #1 #2

In plain english

CAPTCHA ↩
A test used on websites to distinguish humans from bots, often by asking users to solve a visual or logic challenge.
DRM ↩
Digital Rights Management, technical controls used by media companies to restrict copying and playback of digital content.
headless Chrome ↩
A version of the Chrome browser that runs without a visible user interface and is often used for automation or scraping.
OCR ↩
Optical Character Recognition, software that tries to read text from images or pixels.

Reference links

Anti-AI font examples and references

  • ShieldFont
    Referenced as a more developed anti-AI font approach that claims to preserve screen reader access through an uncover workflow.
  • ShieldFont demo
    Used to inspect how the accessibility and uncover flow behaves in practice.
  • NoRoboto
    Example of a legal-sector text obfuscation approach using faulty or fake Unicode mappings.

OCR tools and technical references

  • PaddleOCR
    Mentioned as a newer vision-language OCR option compared with older OCR pipelines.

Background and side references

  • Turbo Vision
    Linked to explain the retro terminal-style visual design discussed in the comments.
  • Generative adversarial network
    Cited while arguing that attempts to confuse models often become training material that makes them better.