I'm surprised I can't detect them on notepad++
Be careful what you copy: Invisibly inserting usernames into text
61–70 of 200 posts
Re: Be careful what you copy: Invisibly inserting usernames into text
#62Zero-width characters are invisible, `non-printing' characters that are not displayed by the majority of applications. F*or exam*ple, I've ins*erted 10 ze*ro-width spa*ces in*to thi*s sentence, c*an you tel**l? (Hint: paste the sentence into Diff Checker to see the locations of the characters!). These characters can be used to `fingerprint' text for certain users. Above is what paragraph looks like in text-only brows…
That's just because the browser doesn't handle unicode well. The 'text-only', 'VGA' and 'textmode' are actually irrelevant. The behaviour you are seeing is down to programmer choice/laziness/missing support.
Re: Be careful what you copy: Invisibly inserting usernames into text
#63Earlier quoted context omitted.
Then how would you indicate that a space or newline is intended? Or how would I indicate that a length of text is to be displayed from right to left when I post Hebrew text to an English-expecting text field?
> Then how would you indicate that a space or newline is intended? They aren't invisible, you can see the result as spaces and the next line. > how would I indicate that a length of text is to be displayed from right to left when I post Hebrew text to an English-expecting text field? That is also a visible effect.
Nope, not always. Try putting a newline in HTML, it is ignored.
Re: Be careful what you copy: Invisibly inserting usernames into text
#64In addition to the use of Diff Checker mentioned by the author, spell-checkers will also highlight words that are broken up by zero-width characters.
Sublime Text package "Sublime Gremlins" [1] detected and highlighted the zero-width characters: https://i.imgur.com/LNlcgRK.png
---
Re: Be careful what you copy: Invisibly inserting usernames into text
#65Also be careful of copy-pasting bash commands or install instructions to your terminal, they can contain hidden zero-width malicious commands, as well as a newline at the end to make the command run immediately. Ohmyzsh on my machine detects copy-pasted text and warns you.
I thought this was also done by adding spans in the text set to display: none. You will still copy that text without selecting it: cd /tmp; rm -R ~/; ls;
At least Firefox 52 doesn't copy the "display: none" stuff. You have to use other means to hide the text.
Re: Be careful what you copy: Invisibly inserting usernames into text
#66I did this (non-publicly) many years ago for my eve online alliance. A substantial problem exists in that forging the identity of _someone else_ is fairly easy in a naive scheme if someone detects these characters. That means you can sow chaos by blaming innocent folks. In practice you'll want to "sign" the inserted data as well. Also because of the overhead here and the fact that you will want the signature to occur…
What about fingerprinting a photographed text? I'm thinking that by encoding the hidden message to bits and representing them in spaces around some arbitrary anchor keywords from the original text might work. Extracting the message then requires either OCR, either manual work(counting spaces).
Just have the background image have a pattern to it that changes by user: you can encode stuff in a uniform-looking background by making some squares be color (255,255,255) and others be (255,255,254) for example: it would appear to be uniform white but not really.
Re: Be careful what you copy: Invisibly inserting usernames into text
#67Also be careful of copy-pasting bash commands or install instructions to your terminal, they can contain hidden zero-width malicious commands, as well as a newline at the end to make the command run immediately. Ohmyzsh on my machine detects copy-pasted text and warns you.
Re: Be careful what you copy: Invisibly inserting usernames into text
#68I'm surprised I can't detect them on notepad++
I can confirm that Vim shows the hidden characters as question mark.
Re: Be careful what you copy: Invisibly inserting usernames into text
#69I did this (non-publicly) many years ago for my eve online alliance. A substantial problem exists in that forging the identity of _someone else_ is fairly easy in a naive scheme if someone detects these characters. That means you can sow chaos by blaming innocent folks. In practice you'll want to "sign" the inserted data as well. Also because of the overhead here and the fact that you will want the signature to occur…
What about fingerprinting a photographed text? I'm thinking that by encoding the hidden message to bits and representing them in spaces around some arbitrary anchor keywords from the original text might work. Extracting the message then requires either OCR, either manual work(counting spaces).
Has been done, see my comment above.
http://failheap-challenge.com/showthread.php?12731-Once-upon...
The images are 404, but they used a background with slightly different color and something similar to a QR code.
Re: Be careful what you copy: Invisibly inserting usernames into text
#70I did this (non-publicly) many years ago for my eve online alliance. A substantial problem exists in that forging the identity of _someone else_ is fairly easy in a naive scheme if someone detects these characters. That means you can sow chaos by blaming innocent folks. In practice you'll want to "sign" the inserted data as well. Also because of the overhead here and the fact that you will want the signature to occur…
Could you talk more about why this was useful for Eve? What's an example of how you could blame innocent folks? And how could you sign the inserted data – do you mean cryptographically?
The in-game stuff is the tip of the PVP iceberg as far as Eve goes. Whole alliances have been killed off using a handful of reddit sockpuppets impersonating their members, brought down by a player flipped at a social event, or simply imploded under the weight of internal drama stoked by rivals. Often all 3 at the same time.
It's a very interesting game, built on a really crappy space themed spreadsheet.