Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Be careful what you copy: Invisibly inserting usernames into text

medium.com

Post reply on HN
Print view View original

71–80 of 200 posts

Re: Be careful what you copy: Invisibly inserting usernames into text

#71

Post by sshagent »

zbobet2012 wrote: post #9

I did this (non-publicly) many years ago for my eve online alliance. A substantial problem exists in that forging the identity of _someone else_ is fairly easy in a naive scheme if someone detects these characters. That means you can sow chaos by blaming innocent folks. In practice you'll want to "sign" the inserted data as well. Also because of the overhead here and the fact that you will want the signature to occur…

I miss Eve so much, there isn't a mention of Eve on this site that doesn't get me pining for the game again. Sadly everyone i flew with no longer play :/ What the status of the game, last i looked i barely recognised any on the sov/influence map.

Re: Be careful what you copy: Invisibly inserting usernames into text

#73

Post by buro9 »

Interesting is how to defend against this.

If you are a journalist wishing to protect your source, what tool could be used to process content such that the essence is left intact but the unicode zero-width steganography is stripped... replaced instead by the common space character.

I know enough to say that you cannot just search and replace, as many of the zero-width characters have a meaning in different languages and produce a visual effect when combined with other runes. Just stripping them all will break text in those languages.

Is there a method for removing zero-width whitespace such that journalist sources could be protected?

Re: Be careful what you copy: Invisibly inserting usernames into text

#74

Post by hodl »

codedokode wrote: post #5

const zeroPad = num => ‘00000000’.slice(String(num).length) + num; What a bad way to declare a function. Starting with the word 'function' will make the code much more readable. Arrow functions are supposed to be used as a small callbacks, not to obfuscate the meaning of the code.

I'm from Haskell. I love it.

Re: Be careful what you copy: Invisibly inserting usernames into text

#75

Post by adrianN »

buro9 wrote: post #73

Interesting is how to defend against this. If you are a journalist wishing to protect your source, what tool could be used to process content such that the essence is left intact but the unicode zero-width steganography is stripped... replaced instead by the common space character. I know enough to say that you cannot just search and replace, as many of the zero-width characters have a meaning in different languages…

Print it and use OCR?

Re: Be careful what you copy: Invisibly inserting usernames into text

#76

Post by tim333 »

irrational wrote: post #20

How difficult would it be to write a browser extension to either remove all zero-width characters or somehow make it super obvious that they are being used on the page? I just searched for "zero-width" and "zero width" in Chrome and Firefox's extensions stores, but didn't come up with anything.

Probably not too hard. I've made a jsfiddle to identify and remove such stuff. Feel free to copy any of it to an extension. https://jsfiddle.net/tim333/np874wae/13/

Re: Be careful what you copy: Invisibly inserting usernames into text

#77

Post by tonyedgecombe »

adrianN wrote: post #75
buro9 wrote: post #73

Interesting is how to defend against this. If you are a journalist wishing to protect your source, what tool could be used to process content such that the essence is left intact but the unicode zero-width steganography is stripped... replaced instead by the common space character. I know enough to say that you cannot just search and replace, as many of the zero-width characters have a meaning in different languages…

Print it and use OCR?

Years ago I worked on some software that would adjust the kerning on text slightly to embed the name of the user who printed the document.

Re: Be careful what you copy: Invisibly inserting usernames into text

#78

Post by chatmasta »

zbobet2012 wrote: post #23
elaus wrote: post #17

Earlier quoted context omitted.

> There are other, far more interesting ways, to watermark text than this that are both harder (to impossible) to detect that produce better results. This sounds interesting, could you elaborate?

The post above mentions some. One good way is synonym replacement. In this method the actual _text_ is altered every time to produce a unique arrangement of synonyms used through out the text. For example I can replace "two" with "2" or "fast" with "quick" to obtain a bit to embed things in. See here for examples: http://failheap-challenge.com/showthread.php?16311-Taking-th... Another is to alter the _frequency_ of c…

I can see a lot of problems with showing different texts to different users in the same place. For example:

- on a forum, if the post reads slightly different to each user, and one user “quotes” it, the quote will be of what that user saw, and other users will be able to identify the fingerprint from the quote.

- if the fingerprinting script modifies all posts on the forum, then a poster will be alarmed to see his words change.

There are clever ways around both of these issues (rewriting the quotes on render, and hiding the fingerprinting from the OP). But eventually the system gets pretty complicated, and ultimately you’re visibly presenting different text to different users, so it’s no longer an invisible fingerprint.

Re: Be careful what you copy: Invisibly inserting usernames into text

#79

Post by chatmasta »

lagadu wrote: post #66
nzpopa wrote: post #57

Earlier quoted context omitted.

What about fingerprinting a photographed text? I'm thinking that by encoding the hidden message to bits and representing them in spaces around some arbitrary anchor keywords from the original text might work. Extracting the message then requires either OCR, either manual work(counting spaces).

Just have the background image have a pattern to it that changes by user: you can encode stuff in a uniform-looking background by making some squares be color (255,255,255) and others be (255,255,254) for example: it would appear to be uniform white but not really.

The classic image stegonography technique is embedding bits in the least-significant-bit of each pixel, such that the differences do not produce visual changes but the information is preserved in the raw bytes of the file. The problem with this technique is that the encoded information will not survive a screenshot (since it’s in the LSB, the colors don’t actually change, just the raw bits).

In order to survive a screenshot (or even some of the common processing steps run after uploading an image somewhere), you would need to visibly change the colors, as you say. This could work but could also produce identifiable artifacts.

(Actually, now I’ve typed this out, I’m not sure if a LSB stego image wouldn’t survive a screenshot. I guess it depends on how the screenshot function is implemented — actually would be curious if anyone has tested this.)

Re: Be careful what you copy: Invisibly inserting usernames into text

#80

Post by chatmasta »

buro9 wrote: post #73

Interesting is how to defend against this. If you are a journalist wishing to protect your source, what tool could be used to process content such that the essence is left intact but the unicode zero-width steganography is stripped... replaced instead by the common space character. I know enough to say that you cannot just search and replace, as many of the zero-width characters have a meaning in different languages…

The safest thing is to retype it. But that doesn’t cover the risk of synonym/frequency fingerprinting discussed elsewhere in this thread.
Post reply on HN