Show HN: I made a Chrome extension to reveal zero-width characters

Meaning, does it mess this up?

https://emojipedia.org/zero-width-joiner/

It's starting to seem like the universe has some fundamental order for things that we can escape temporarily, but that are inescapable in the long run.

1. Photo and video evidence was a game-changer for establishing facts and chronologies. As we've seen, it's becoming harder and harder to distinguish fake photos and videos from real. It's not a stretch to predict a time when we'll only be able to make probabilistic statements about the veracity of photos or videos. (E.g., "60% liklihood of being undoctored.") This is probably already true about photos, although the expense of making a perfect fake is still pretty high, in terms of expertise.

I'd argue the "natural state" is one where word-of-mouth and first-hand accounts are the most authoritative evidence we can have (other than physical evidence like DNA left behind). And even physical evidence left behind can't tell us what the person did while there or how an event transpired.

2. Tracking communications. In the digital age, we've some people have come to assume that all digital text is untrackable and anonymous. Your "11001110" is the same as mine. Historically, it was pretty difficult to transcribe information without leaving traces of the origin of that info. These zero-width characters plus all the other text fingerprinting methods, and ubiquitous tracking in communication logs make it nearly impossible, again, to communicate with others without leaving a trail. And then there's the writing style analysis which makes it tough to write anything without leaving telltale fingerprints.

So, I'm proposing that we are returning to the "natural state" of things. Probably overstating things a bit, but still an interesting thought to consider.

The project is clearly motivated by Be careful what you copy: Invisibly inserting usernames into text[0] (posted 12 hours ago on HN), and many people here might think zero-width characters (or rather, any esoteric Unicode characters) are the only (or the prominent) way to watermark texts, which is wrong. The whole topic -watermarking- is worth at the very least a lengthy blog post, and maybe even several articles, so keep in mind that this comment is just a very brief introduction to different methods (of watermarking)[x]:

(from trivial to more complex ones)

----

1. Using Invisible Characters

The linked[0] article basically talks about a very basic version of it, which should be enough to get the idea. Of course, more sophisticated techniques will use more than just two characters, and will take the position of each invisible character into consideration while encoding & decoding watermarks, ensure it's uniformly distributed throughout the paragraphs etc.

Can be defeated by simply removing invisible characters.

----

2. Using Unicode Characters That Look Alike

The same working mechanism as IDN homograph attack[1].

Can be defeated by simply removing "out-of-place" letters/characters, after determining the language of a given text/paragraph/sentence etc.

----

3. Using Unicode Equivalence

> Code point sequences that are defined as canonically equivalent are assumed to have the same appearance and meaning when printed or displayed. For example, the code point U+006E (the Latin lowercase "n") followed by U+0303 (the combining tilde "◌̃") is defined by Unicode to be canonically equivalent to the single code point U+00F1 (the lowercase letter "ñ" of the Spanish alphabet).

https://en.wikipedia.org/wiki/Unicode_equivalence

Can be defeated by simply normalising the text, and line endings!

----

(Now it's getting harder!)

4. Changing the Layout of Documents

You can change (the rendering of):

  (a) the margins
  (b) the ligatures
  (c) the space between
    (i)  specific characters [kerning]
    (ii) consequent words/lines/paragraphs

to embed fingerprints. This is especially dangerous as documents are often leaked by taking screenshots or photocopies, which is secure against Unicode attacks, but not of these.

Can be defeated by copying the plaintext, and pasting it to a text editor, and applying steps 1, 2, 3.

Also, bear in mind that if you can still -unintentionally- leak information:

(a) when you use a document editor (LibreOffice Writer, Microsoft Word) as the layout engines might act differently depending on your software version, platform, file format etc.

(b) paper size (A4, US Letter, ...)

----

5. Substituting with Synonyms

If characters can be replaced by their equivalents, why not replace words or sentences even? Words can be substituted by their synonyms based on an algorithm that can create fingerprints accordingly, and I presume even sentences can be rephrased with the latest advancements in AI/ML.

Also, some of the substitutions will be unintentional: a scribble on a piece of leaked document can also leak information about its leaker (different spellings in American and British English, ways of writing date & time, decimal separators etc).

Can be defeated by paraphrasing.

----

The list can probably extended even further but this was all I could remember on the top of my head. =)

[0]: https://news.ycombinator.com/item?id=16749422

[1]: https://en.wikipedia.org/wiki/IDN_homograph_attack

[x]: Not that I'm working in a related field, but I researched watermarking & fingerprinting techniques for a similar but much more extensive project for journalists/whistle-blowers to detect fingerprinting/watermarking in documents.

Let me know if you are interested and we can collaborate!

> ... the "natural state" is one where word-of-mouth and first-hand accounts are the most authoritative evidence we can have (other than physical evidence like DNA left behind)

First-hand accounts aren't always reliable.

https://en.wikipedia.org/wiki/Eyewitness_testimony

`hexdump` is part of util-linux, `xxd` is not. They do the same thing though, up to formatting differences.