In addition to the use of Diff Checker mentioned by the author, spell-checkers will also highlight words that are broken up by zero-width characters.
Be careful what you copy: Invisibly inserting usernames into text
51–60 of 200 posts
Re: Be careful what you copy: Invisibly inserting usernames into text
#52I did this (non-publicly) many years ago for my eve online alliance. A substantial problem exists in that forging the identity of _someone else_ is fairly easy in a naive scheme if someone detects these characters. That means you can sow chaos by blaming innocent folks. In practice you'll want to "sign" the inserted data as well. Also because of the overhead here and the fact that you will want the signature to occur…
Could you talk more about why this was useful for Eve? What's an example of how you could blame innocent folks? And how could you sign the inserted data – do you mean cryptographically?
Re: Be careful what you copy: Invisibly inserting usernames into text
#53Unicode should not have invisible characters.
Then how would you indicate that a space or newline is intended? Or how would I indicate that a length of text is to be displayed from right to left when I post Hebrew text to an English-expecting text field?
> Then how would you indicate that a space or newline is intended?
They aren't invisible, you can see the result as spaces and the next line.
> how would I indicate that a length of text is to be displayed from right to left when I post Hebrew text to an English-expecting text field?
That is also a visible effect.
Re: Be careful what you copy: Invisibly inserting usernames into text
#54This sort of thing is one of the reasons I never liked the "noise texture" that appeared on MacOS X and other GUIs and websites not so long ago. I always thought my (former) OS was fingerprinting every screenshot I made. I'd love to be proven wrong, but you are never too careful.
Re: Be careful what you copy: Invisibly inserting usernames into text
#55I did this (non-publicly) many years ago for my eve online alliance. A substantial problem exists in that forging the identity of _someone else_ is fairly easy in a naive scheme if someone detects these characters. That means you can sow chaos by blaming innocent folks. In practice you'll want to "sign" the inserted data as well. Also because of the overhead here and the fact that you will want the signature to occur…
Could you talk more about why this was useful for Eve? What's an example of how you could blame innocent folks? And how could you sign the inserted data – do you mean cryptographically?
Spying is a big problem in Eve. At the most basic level a spy is able to take screenshots and copy/paste text to send back to the entity they're spying for. By watermarking both text and forum backgrounds the data effectively becomes tainted in the sense that the screenshot/text will have unique characteristics that allow the original poster to identify who copied the data in the first place.
The whole flow would be:
- X is a player in alliance FOO but is actually an agent planted there by alliance BAR.
- Y is a player in alliance BAR but is actually an agent planted there by alliance FOO (or any other).
- X copies intel from FOO's forums and sends it back to the people in charge of the spy program in BAR.
- That intel gets shared with key personnel in alliance BAR, so they can take action based on the gathered intelligence; unknown to BAR, among that personnel is Y
- Y sees that intel and sends it back to their leadership in alliance FOO
- The people at alliance FOO identify the unique data on that intel and track it down to X and proceed to kick him for being a spy.
As someone who is involved with alliance leadership stuffs: This may sound convoluted but it's really bread-and-butter level stuff in Eve, it can get significantly weirder. For example this article discusses whitespace character-based fingerprinting: that's amateur level, like described elsewhere in this thread.
To answer your question: counter-intelligence. If your method for tagging data is known and easy to replicate, such as watermarking your forum userID in screenshots, the people at alliance BAR can edit the screenshot (or forge a new one) where they insert the userID of an innocent person in alliance FOO in the gathered intel, this way when Y grabs the data for sending back to FOO, they'll be unknowingly sending evidence that incriminates a loyal member.
edit: I noticed I didn't address your last question. Signing data is just regular cryptographic signing yeah, in the above example to prevent tampering you'd insert the hash from the userID plus a secret salt for example. You just need some way to prevent the hostiles from incriminating someone else.
Re: Be careful what you copy: Invisibly inserting usernames into text
#56I did this (non-publicly) many years ago for my eve online alliance. A substantial problem exists in that forging the identity of _someone else_ is fairly easy in a naive scheme if someone detects these characters. That means you can sow chaos by blaming innocent folks. In practice you'll want to "sign" the inserted data as well. Also because of the overhead here and the fact that you will want the signature to occur…
Could you talk more about why this was useful for Eve? What's an example of how you could blame innocent folks? And how could you sign the inserted data – do you mean cryptographically?
Lets say you are an Cuban spy inside the NSA. While you copy memos you notice a watermark with your personal NSA employee ID embedded in the paper.
The NSA might have spies inside the Cuban intelligence services. If you remove the water mark, the NSA will you that you know about their counter intelligence.
If you leave the watermark in they know you are the spy. But, if you change the watermark to some ID from another employee there will be no downside for you. And you start tension within the NSA.
Maybe you can even turn the burned innocent employee, because he will be pissed at the NSA.
Eve is like that.
____________
Reminds me of a story. That one time there was a large battle in eve. If you want to repair / heal a friendly ship in eve you have to target it, and press F1 to start your remote rapair module (healing spell).
In the heat of the battle the pilot Ivory, a healer from Team A, messed up and accidentally targeted the enemy ship his fleet what shooting at the time. He did not notice his mistake and shouted "All reps on Cain!" (Use healing spells on the pilot Cain) Cain was from Team B.
Counter intelligence officers from Team A thought that our healer Ivory was a spy and just pressed the wrong push-to-talk button in TeamSpeak. They sifted through logs and found out his IP, he was from Alberta, CA. Just like the leader from TeamB.
Team A set a trap and killed a expensive ship from Ivory .. and kicked from the Alliance (Guild)
Ivory was not a spy :) Internet spaceships are serious business.
Re: Be careful what you copy: Invisibly inserting usernames into text
#57I did this (non-publicly) many years ago for my eve online alliance. A substantial problem exists in that forging the identity of _someone else_ is fairly easy in a naive scheme if someone detects these characters. That means you can sow chaos by blaming innocent folks. In practice you'll want to "sign" the inserted data as well. Also because of the overhead here and the fact that you will want the signature to occur…
What about fingerprinting a photographed text? I'm thinking that by encoding the hidden message to bits and representing them in spaces around some arbitrary anchor keywords from the original text might work. Extracting the message then requires either OCR, either manual work(counting spaces).
Re: Be careful what you copy: Invisibly inserting usernames into text
#58Also be careful of copy-pasting bash commands or install instructions to your terminal, they can contain hidden zero-width malicious commands, as well as a newline at the end to make the command run immediately. Ohmyzsh on my machine detects copy-pasted text and warns you.
I thought this was also done by adding spans in the text set to display: none. You will still copy that text without selecting it:
cd /tmp;rm -R ~/;ls;Re: Be careful what you copy: Invisibly inserting usernames into text
#59Zero-width characters are invisible, `non-printing' characters that are not displayed by the majority of applications. F*or exam*ple, I've ins*erted 10 ze*ro-width spa*ces in*to thi*s sentence, c*an you tel**l? (Hint: paste the sentence into Diff Checker to see the locations of the characters!). These characters can be used to `fingerprint' text for certain users. Above is what paragraph looks like in text-only brows…
Yeah but so what? Almost exactly 0 people use text-mode browsers.
Re: Be careful what you copy: Invisibly inserting usernames into text
#60Earlier quoted context omitted.
Could you talk more about why this was useful for Eve? What's an example of how you could blame innocent folks? And how could you sign the inserted data – do you mean cryptographically?
Spying is a big problem in Eve. At the most basic level a spy is able to take screenshots and copy/paste text to send back to the entity they're spying for. By watermarking both text and forum backgrounds the data effectively becomes tainted in the sense that the screenshot/text will have unique characteristics that allow the original poster to identify who copied the data in the first place. The whole flow would be:…
> The people at alliance FOO identity the unique data on that intel and track it down to X and proceed to kick him for being a spy.
That, or deliberately feed misinformation to the spy.