This reminds me of the times I've had to help beginning students debug very confusing errors because one of these characters somehow found their way into someone's source code (likely because a word processor was used to edit it at some point.)
Be careful what you copy: Invisibly inserting usernames into text
91–100 of 200 posts
Re: Be careful what you copy: Invisibly inserting usernames into text
#92Interesting is how to defend against this. If you are a journalist wishing to protect your source, what tool could be used to process content such that the essence is left intact but the unicode zero-width steganography is stripped... replaced instead by the common space character. I know enough to say that you cannot just search and replace, as many of the zero-width characters have a meaning in different languages…
In my article that Tom[0] links to I mentioned a number or methods, but you may be interested in a followup piece I wrote as well:
https://www.zachaysan.com/writing/2018-01-01-fingerprinting-...
Essentially the best method against these fingerprinting techniques isn't technical—it's just not re-sharing the contents in the first place. Sorry, small differences are just too easy to embed and there are so many bits to work with.
[0] Thanks Tom, you the man!
Re: Be careful what you copy: Invisibly inserting usernames into text
#93Earlier quoted context omitted.
Years ago I worked on some software that would adjust the kerning on text slightly to embed the name of the user who printed the document.
Kerning probably doesn't survive OCR though.
You can still embed a person's name by replacing words in the text by synonyms.
Re: Be careful what you copy: Invisibly inserting usernames into text
#94Interesting is how to defend against this. If you are a journalist wishing to protect your source, what tool could be used to process content such that the essence is left intact but the unicode zero-width steganography is stripped... replaced instead by the common space character. I know enough to say that you cannot just search and replace, as many of the zero-width characters have a meaning in different languages…
The safest thing is to retype it. But that doesn’t cover the risk of synonym/frequency fingerprinting discussed elsewhere in this thread.
What if you also did a random synonym replacement throughout the piece to destroy the watermarking? If the source is anonymous and hidden, then authenticity cannot be checked by the reader anyway, and so replacement without changing meaning is an acceptable change to protect sources.
Re: Be careful what you copy: Invisibly inserting usernames into text
#95Earlier quoted context omitted.
Just have the background image have a pattern to it that changes by user: you can encode stuff in a uniform-looking background by making some squares be color (255,255,255) and others be (255,255,254) for example: it would appear to be uniform white but not really.
The classic image stegonography technique is embedding bits in the least-significant-bit of each pixel, such that the differences do not produce visual changes but the information is preserved in the raw bytes of the file. The problem with this technique is that the encoded information will not survive a screenshot (since it’s in the LSB, the colors don’t actually change, just the raw bits). In order to survive a scr…
[deleted]
Re: Be careful what you copy: Invisibly inserting usernames into text
#96Earlier quoted context omitted.
The post above mentions some. One good way is synonym replacement. In this method the actual _text_ is altered every time to produce a unique arrangement of synonyms used through out the text. For example I can replace "two" with "2" or "fast" with "quick" to obtain a bit to embed things in. See here for examples: http://failheap-challenge.com/showthread.php?16311-Taking-th... Another is to alter the _frequency_ of c…
I can see a lot of problems with showing different texts to different users in the same place. For example: - on a forum, if the post reads slightly different to each user, and one user “quotes” it, the quote will be of what that user saw, and other users will be able to identify the fingerprint from the quote. - if the fingerprinting script modifies all posts on the forum, then a poster will be alarmed to see his wo…
> on a forum, if the post reads slightly different to each user, and one user “quotes” it, the quote will be of what that user saw, and other users will be able to identify the fingerprint from the quote.
Not if the forum intelligently changes the quoted text :)
Re: Be careful what you copy: Invisibly inserting usernames into text
#97I did this (non-publicly) many years ago for my eve online alliance. A substantial problem exists in that forging the identity of _someone else_ is fairly easy in a naive scheme if someone detects these characters. That means you can sow chaos by blaming innocent folks. In practice you'll want to "sign" the inserted data as well. Also because of the overhead here and the fact that you will want the signature to occur…
What about fingerprinting a photographed text? I'm thinking that by encoding the hidden message to bits and representing them in spaces around some arbitrary anchor keywords from the original text might work. Extracting the message then requires either OCR, either manual work(counting spaces).
See e.g. Spread Spectrum Image Steganography for embedding messages under the noise level.
http://www.lia.deis.unibo.it/Courses/RetiDiCalcolatori/Proge...
Re: Be careful what you copy: Invisibly inserting usernames into text
#98Earlier quoted context omitted.
Could you talk more about why this was useful for Eve? What's an example of how you could blame innocent folks? And how could you sign the inserted data – do you mean cryptographically?
Lets say you are an Cuban spy inside the NSA. While you copy memos you notice a watermark with your personal NSA employee ID embedded in the paper. The NSA might have spies inside the Cuban intelligence services. If you remove the water mark, the NSA will you that you know about their counter intelligence. If you leave the watermark in they know you are the spy. But, if you change the watermark to some ID from anothe…
How did you find out he wasn't a spy?
Re: Be careful what you copy: Invisibly inserting usernames into text
#99Chrome on Android put a line break in the middle of a word. I assume that was an "invisible" character?
Re: Be careful what you copy: Invisibly inserting usernames into text
#100Earlier quoted context omitted.
Lets say you are an Cuban spy inside the NSA. While you copy memos you notice a watermark with your personal NSA employee ID embedded in the paper. The NSA might have spies inside the Cuban intelligence services. If you remove the water mark, the NSA will you that you know about their counter intelligence. If you leave the watermark in they know you are the spy. But, if you change the watermark to some ID from anothe…
How did you find out he wasn't a spy?
I think a week later Team A apologized, replaced his ship and took him back.
But the accusation was stupid to begin with. He was a loyal member for years, living in the same Canadian state as another eve player is not really uncommon any shouting on TeamSpeak who is currently getting shot would not have been helpful.
Diplomats from Team B said he was not a spy.