Unicode should not have invisible characters.
Then how would you enter a ZWNJ - for example to correctly indicate that the ligatures should not cross the morpheme boundaries?
Be careful what you copy: Invisibly inserting usernames into text
141–150 of 200 posts
Re: Be careful what you copy: Invisibly inserting usernames into text
#142The so-called-better-way of doing this using Unicode substitution can be found at http://smartdata.cs.unibo.it/watermark/
I like the concept. Please correct me if I'm wrong: it looks like you'd need a lot more than "46 to 101 characters" in a message before you can apply this method reasonably.
An MD5 hash for any decent-length password is long, and this method only allows you to replace the subset of "confusable" latin chars in a text.
For instance: C = 0x0043 = 0x216d
When you reach one of these replaceable characters, you either replace it or you don't, which you mark as either 1 or 0.
So for the string "password", our binary MD5 hash is "01011111010011011100110000111011010110101010011101100101110101100001110110000011001001111101111010111000100000101100111110011001".
That 128 possible replacements needed in the original text.
I imagine the original text would have to be at least 10-20 times that length before we found enough "confusable" latin chars to replace.
I'm eager to hear what I'm missing, because I do like this method a lot.
Re: Be careful what you copy: Invisibly inserting usernames into text
#143How difficult would it be to write a browser extension to either remove all zero-width characters or somehow make it super obvious that they are being used on the page? I just searched for "zero-width" and "zero width" in Chrome and Firefox's extensions stores, but didn't come up with anything.
Whenever I paste, I use ctrl-shift-v. It solves this problem and a multitude of other pasting problems.
Re: Be careful what you copy: Invisibly inserting usernames into text
#144I'm surprised I can't detect them on notepad++
[deleted]
Re: Be careful what you copy: Invisibly inserting usernames into text
#145Earlier quoted context omitted.
The safest thing is to retype it. But that doesn’t cover the risk of synonym/frequency fingerprinting discussed elsewhere in this thread.
What if you also did a random synonym replacement throughout the piece to destroy the watermarking? If the source is anonymous and hidden, then authenticity cannot be checked by the reader anyway, and so replacement without changing meaning is an acceptable change to protect sources.
You would have to change every word, since any could be a waterprinted synonym. A better way would be to read it, make a summary, then rewrite it from memory and only use the source data to correct factual differences.
Re: Be careful what you copy: Invisibly inserting usernames into text
#146Earlier quoted context omitted.
The easiest is again to do synonym/word/punctuation replacement but with the intent of altering the letter frequency instead of embedding information directly. It's effectively a compression scheme built on-top of synonym replacement using "extra" available information to pack more bits in less words. This means even sentence long quotes in summary form are enough to compromise someone.
It sounds to me that it would be blatantly obvious that a human didn't write whatever result that may produce. And I don't quite get how you can encode that much information in a sentence without it being completely garbled.
It seems to me that it'd be very obvious that a human did not write whatever result that could produce.
Here's 5 bits in that simple sentence. I'm sure others can do better.
Re: Be careful what you copy: Invisibly inserting usernames into text
#147How difficult would it be to write a browser extension to either remove all zero-width characters or somehow make it super obvious that they are being used on the page? I just searched for "zero-width" and "zero width" in Chrome and Firefox's extensions stores, but didn't come up with anything.
I just made a very basic one: https://chrome.google.com/webstore/detail/icibkhaehdofmcbfjf...
Code here: https://github.com/roymckenzie/detect-zero-width-characters-...
Submit a PR! I know it could be better!
Needed features:
* right-click selected text and "Sanitize and Copy" * toggle off and on ...
Re: Be careful what you copy: Invisibly inserting usernames into text
#148How difficult would it be to write a browser extension to either remove all zero-width characters or somehow make it super obvious that they are being used on the page? I just searched for "zero-width" and "zero width" in Chrome and Firefox's extensions stores, but didn't come up with anything.
Whenever I paste, I use ctrl-shift-v. It solves this problem and a multitude of other pasting problems.
That just removes formatting, reducing the copied text to plain-text. If I paste the strings from the blog post into atom and then arrow right from the beginning, there are locations where the col number will increase and the cursor not move.
I don't think ctrl-shift-v will do what you think here because we're not talking about formatting at all. We're talking about regular unicode UTF-8 encoded text.
Re: Be careful what you copy: Invisibly inserting usernames into text
#149Earlier quoted context omitted.
That's just because the browser doesn't handle unicode well. The 'text-only', 'VGA' and 'textmode' are actually irrelevant. The behaviour you are seeing is down to programmer choice/laziness/missing support.
If you're only expecting ASCII text, then not being able to show anything else could even be considered a feature to reduce attack area, since any sort of Unicode trickery then becomes impossible.
So what happens when you try to display Chinese or Hindi text? You're just going to get a screen of stars, like you would with unicode square boxes.
Re: Be careful what you copy: Invisibly inserting usernames into text
#150How difficult would it be to write a browser extension to either remove all zero-width characters or somehow make it super obvious that they are being used on the page? I just searched for "zero-width" and "zero width" in Chrome and Firefox's extensions stores, but didn't come up with anything.
Probably not too hard. I've made a jsfiddle to identify and remove such stuff. Feel free to copy any of it to an extension. https://jsfiddle.net/tim333/np874wae/13/
I took your code and added to it. Removed jQuery and it now searches through ALL text nodes on a page and replaces the text in it with the hidden characters plus the original visible text. There's still lots of room for improvement but it's a start. For now I'm running it in the console to make it work but someone can build upon this and turn it into an extension (maybe I will if I have time)
I put it in a gist:
https://gist.github.com/FranciscoG/01732b606a35615891103ae8e...