Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Be careful what you copy: Invisibly inserting usernames into text

medium.com

Post reply on HN
Print view View original

111–120 of 200 posts

Re: Be careful what you copy: Invisibly inserting usernames into text

#111

Post by billysielu »

sshagent wrote: post #71
zbobet2012 wrote: post #9

I did this (non-publicly) many years ago for my eve online alliance. A substantial problem exists in that forging the identity of _someone else_ is fairly easy in a naive scheme if someone detects these characters. That means you can sow chaos by blaming innocent folks. In practice you'll want to "sign" the inserted data as well. Also because of the overhead here and the fact that you will want the signature to occur…

I miss Eve so much, there isn't a mention of Eve on this site that doesn't get me pining for the game again. Sadly everyone i flew with no longer play :/ What the status of the game, last i looked i barely recognised any on the sov/influence map.

I stopped playing EVE recently because of all the micro-transaction stuff. One of my favorite things about EVE was how the subscription model deterred kids and meant they didn't need to have micro-transactions. Check out BjornBee or ZarvoxToral on Twitch, they run public fleets you can join, and seeing as it's free-to-play that's probably the easiest way to decide for yourself. -Ex [IRON] Pilot.

Re: Be careful what you copy: Invisibly inserting usernames into text

#112

Post by sshagent »

Mashimo wrote: post #105
sshagent wrote: post #71

Earlier quoted context omitted.

I miss Eve so much, there isn't a mention of Eve on this site that doesn't get me pining for the game again. Sadly everyone i flew with no longer play :/ What the status of the game, last i looked i barely recognised any on the sov/influence map.

Still a lot of people playing it. A bit less subscribers, but not too bad. In 0.0 it's captials everywhere. People mine in Rorquals, people do PvE in Carriers and Supers. If you tackle a small ships doing PvE it opens a cyno and Captials jump in. They now have fighters that have good applications against smaller ships. So the good old rock paper scissors for shipssize in eve is not more. Still a diverse game, from so…

I started in 2004, and played semi seriously for big bouts until probably 2012 or so. Every year or news story would get me back in...and i'd recognise less and less. I stopped myself reading eve politics not that long ago, as that was the bit that most interested me really. After the glory days of roaming in small fleets.

The last time i logged in, a couple of years back. I contemplated moving my shit to somewhere else to where one of the few people i knew was still playing but the jump fatigued meant that would take half my life. I get the whole point of trying to limit force projection cos it was very daft with every encounter in 0.0 finishing with PL, NC or Goons dropping in their super fleets. But logistics for the common player is awkward :( It would likely take me many days of gathering and moving shit to get into a position to actually play the game again haha. not fun.

Re: Be careful what you copy: Invisibly inserting usernames into text

#113

Post by scottmf »

ksrm wrote: post #106
zbobet2012 wrote: post #9

I did this (non-publicly) many years ago for my eve online alliance. A substantial problem exists in that forging the identity of _someone else_ is fairly easy in a naive scheme if someone detects these characters. That means you can sow chaos by blaming innocent folks. In practice you'll want to "sign" the inserted data as well. Also because of the overhead here and the fact that you will want the signature to occur…

The advantage of putting the (signed) full username in there is that you can demonstrate to a third party (like a court?) who is to blame. Just encoding a number for each user, or giving each user a different number of Es is deniable to a certain extent.

But such a simple system would make it easy for one user to frame another.

You would need a way of signing the username. Perhaps you could hash the user ID with a secret salt, and hide that in the text along with the username.

Re: Be careful what you copy: Invisibly inserting usernames into text

#114

Post by sshagent »

chii wrote: post #90
sshagent wrote: post #71

Earlier quoted context omitted.

I miss Eve so much, there isn't a mention of Eve on this site that doesn't get me pining for the game again. Sadly everyone i flew with no longer play :/ What the status of the game, last i looked i barely recognised any on the sov/influence map.

I think they were bleeding subscribers for a while, and had to go to a form of limited free-to-play to keep the numbers up. I m a bit sad that the EVE legacy is eventually going to end, since i think the game is still the most unique MMO out there. But i don't feel the game has the same dynamic as it had in 2008-2010. But i also quit at that time too, so who knows...

indeed. I've played a lot of mmos, from UO and onwards. Nothing really compares to EVE in the slightest. Perhaps SWG to some extent but EVE is like the Dwarf Fortress of MMOs. lots of levels of details and harsh

Re: Be careful what you copy: Invisibly inserting usernames into text

#116

Post by scottmf »

vbezhenar wrote: post #38
irrational wrote: post #20

How difficult would it be to write a browser extension to either remove all zero-width characters or somehow make it super obvious that they are being used on the page? I just searched for "zero-width" and "zero width" in Chrome and Firefox's extensions stores, but didn't come up with anything.

I don't think that it's too difficult. Just check every tag's text for forbidden characters and replace them with something. I'm not sure about performance.

Besides performance concerns, if you did it on each page load it would miss any content added to the page after the initial load. It would be useless for SPAs.

The best way I can think to implement it would be listening for a copy event and replacing the text in the clipboard.

Something like:

  document.addEventListener('copy', sanitizeClipboardContent);

Re: Be careful what you copy: Invisibly inserting usernames into text

#117

Post by ubernostrum »

teolandon wrote: post #19

Also be careful of copy-pasting bash commands or install instructions to your terminal, they can contain hidden zero-width malicious commands, as well as a newline at the end to make the command run immediately. Ohmyzsh on my machine detects copy-pasted text and warns you.

Don't forget the fun you can have making JavaScript look innocuous:

https://www.stefanjudis.com/blog/hidden-messages-in-javascri...

Re: Be careful what you copy: Invisibly inserting usernames into text

#118

Post by Izkata »

plesn wrote: post #115

How do I see those invisible characters in emacs or vim ? In emacs I thought that whitespace-mode would do the trick but apparently it doesn't.

vim (7.4) seems to display them by default. With my whole vimrc commented out (just to be sure it wasn't a setting I changed), I get this:

    For example, I’ve inserted 10 zero-width spaces into this sentence, can you tell?
(The is also highlighted a different color than the rest of the text, and acts like a single character when moving the cursor through it. It's really, really obvious.)

Re: Be careful what you copy: Invisibly inserting usernames into text

#119

Post by nsgi »

ry_ry wrote: post #21
zbobet2012 wrote: post #9

I did this (non-publicly) many years ago for my eve online alliance. A substantial problem exists in that forging the identity of _someone else_ is fairly easy in a naive scheme if someone detects these characters. That means you can sow chaos by blaming innocent folks. In practice you'll want to "sign" the inserted data as well. Also because of the overhead here and the fact that you will want the signature to occur…

Later, we just told select people we had implemented some crazy undetectable watermarking, and the leaks stopped - effectively identifying the culprits in the process.

The Death Note method. Reminds me of https://www.gwern.net/Death-Note-Anonymity

Re: Be careful what you copy: Invisibly inserting usernames into text

#120

Post by inetknght »

jessriedel wrote: post #108
irrational wrote: post #20

How difficult would it be to write a browser extension to either remove all zero-width characters or somehow make it super obvious that they are being used on the page? I just searched for "zero-width" and "zero width" in Chrome and Firefox's extensions stores, but didn't come up with anything.

Would probably be better to do this at the OS level, no? Just ensure that shift-cmd-V/shift-ctrl-V strips zero-width characters in addition to formatting. I can't think of a situation where I'd want to keep one but not the other, and you could always do that manually if it came up.

If it'd also optionally (default=true) strip text formatting from copy/paste that'd be epic. No more copy-from-browser-then-paste-into-notepad-then-copy-from-notepad-then-paste-into-email-or-chat
Post reply on HN