Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Be careful what you copy: Invisibly inserting usernames into text

medium.com

Post reply on HN
Print view View original

1–10 of 200 posts

Re: Be careful what you copy: Invisibly inserting usernames into text

#2

Post by fluxsauce »

That's a really interesting technique!

I'm trying to think of what else could be done with the encryption / description, but tracking is a really effective use case.

Could probably encode some other secret messages in there, make a blog post about cheese include a hash to a pastebin.

It also reminds me of the importance of having strong validation around things like usernames, because if I had a username that looked official but contained an invisible character... Related: ICANN explicitly forbids domain names from including zero-width space.

Re: Be careful what you copy: Invisibly inserting usernames into text

#5

Post by codedokode » 

    const zeroPad = num => ‘00000000’.slice(String(num).length) + num;
What a bad way to declare a function. Starting with the word 'function' will make the code much more readable. Arrow functions are supposed to be used as a small callbacks, not to obfuscate the meaning of the code.

Re: Be careful what you copy: Invisibly inserting usernames into text

#6

Post by jacobolus »

codedokode wrote: post #5

const zeroPad = num => ‘00000000’.slice(String(num).length) + num; What a bad way to declare a function. Starting with the word 'function' will make the code much more readable. Arrow functions are supposed to be used as a small callbacks, not to obfuscate the meaning of the code.

If you spend a few days reading code written in this style, you will quickly get used to it. This is not “obfuscated”, and there’s nothing wrong with using this syntax for general functions. (Personally, I would recommend putting the function body on the next line, but meh.) If you have any kind of reasonable text editor, you can add syntax highlighting or other visual call-outs for functions, if that is important to you.

Re: Be careful what you copy: Invisibly inserting usernames into text

#8

Post by mastazi »

The first time I met zero-width characters, (I suppose this was long before they became popular for "fingerprinting" text) it was in a weird bug where some javascript would fail due to a \u200b being present in a user-entered string (it was easily fixed by changing the method that we used to sanitise strings). I remember thinking "wow with these zero-width characters you could do steganography within text, even in a very short string". It looks like I wasn't the only one who had that idea.

Re: Be careful what you copy: Invisibly inserting usernames into text

#9

Post by zbobet2012 »

I did this (non-publicly) many years ago for my eve online alliance. A substantial problem exists in that forging the identity of _someone else_ is fairly easy in a naive scheme if someone detects these characters. That means you can sow chaos by blaming innocent folks. In practice you'll want to "sign" the inserted data as well.

Also because of the overhead here and the fact that you will want the signature to occur at regular intervals a better compression scheme than 0=>char1 1=>char2 is needed. Combining zero width chars and homoglyph substitution* can produce codings which hold signed usernames in only a few characters.

There are other, far more interesting ways, to watermark text than this that are both harder (to impossible) to detect that produce better results.

*https://www.researchgate.net/publication/308044170_Content-p...

P.S. It's nice to see people publish conference papers on this stuff. I always had to hide it because we actually used it.

Post reply on HN