Be careful what you copy: Invisibly inserting usernames into text • Hacker News Board

Re: Be careful what you copy: Invisibly inserting usernames into text

#161

Post by DyslexicAtheist » Wed, Apr 04, 2018, 4:53 PM UTC

this haphazard attempt at DRM seem like a perfect OpSec layer in case the purpose is to throw off the gullible media or any "experts" overly keen on cyber attribution. The method seems flawed unless you actually want your adversary to find it and make incorrect assumptions, it's probably not the right tool for the job.

EDIT/PS: the first one who finds the homoglyphs within this very status update and posts it in the comments wins an iPhone which has still not been patched against the జ్ఞ‌ా vulnerability ;)

Re: Be careful what you copy: Invisibly inserting usernames into text

#162

Post by zb3 » Wed, Apr 04, 2018, 5:02 PM UTC

dotancohen wrote: post #43

ken wrote: post #12

Earlier quoted context omitted.

It looks like there are just four: https://en.wikipedia.org/wiki/Zero_width

Not that the zero-width characters are not the only characters that one is unlikely to notice. I regularly use the RLE, LRE, and other non-printing characters [1] in my text. [1] http://dotancohen.com/howto/rtl_right_to_left.html

In addition to RTL/LTR mark characters, there are also TAG characters[1].

[1] https://en.wikipedia.org/wiki/Tags_(Unicode_block)

Re: Be careful what you copy: Invisibly inserting usernames into text

#163

Post by matthberg » Wed, Apr 04, 2018, 5:10 PM UTC

inetknght wrote: post #120

jessriedel wrote: post #108

Earlier quoted context omitted.

Would probably be better to do this at the OS level, no? Just ensure that shift-cmd-V/shift-ctrl-V strips zero-width characters in addition to formatting. I can't think of a situation where I'd want to keep one but not the other, and you could always do that manually if it came up.

If it'd also optionally (default=true) strip text formatting from copy/paste that'd be epic. No more copy-from-browser-then-paste-into-notepad-then-copy-from-notepad-then-paste-into-email-or-chat

In a good few applications that is exactly what Ctrl+Shift+V does. Try it in Chrome or Firefox, it pastes without formatting.

Re: Be careful what you copy: Invisibly inserting usernames into text

#164

Post by SubiculumCode » Wed, Apr 04, 2018, 5:12 PM UTC

Zero width characters don't seem to have a use case for most web browser users. It seems that they should be filtered out, and an option to display left in about::config

edit: Other have pointed out that there ARE legit uses of zero-length chars, especially for other languages. Still, I bet a solution does not have to be all or none.. I bet common legitimate use-cases can be segregated from others.

Re: Be careful what you copy: Invisibly inserting usernames into text

#165

Post by cryptonector » Wed, Apr 04, 2018, 5:17 PM UTC

chatmasta wrote: post #80

buro9 wrote: post #73

Interesting is how to defend against this. If you are a journalist wishing to protect your source, what tool could be used to process content such that the essence is left intact but the unicode zero-width steganography is stripped... replaced instead by the common space character. I know enough to say that you cannot just search and replace, as many of the zero-width characters have a meaning in different languages…

The safest thing is to retype it. But that doesn’t cover the risk of synonym/frequency fingerprinting discussed elsewhere in this thread.

So paraphrase it.

Re: Be careful what you copy: Invisibly inserting usernames into text

#166

Post by avree » Wed, Apr 04, 2018, 5:43 PM UTC

Ntrails wrote: post #129

Mashimo wrote: post #124

Earlier quoted context omitted.

Just last week we got a patch were they capped the jump fatigue significantly. I don't know how much as I don't use jump drive, but it should be better now. Also just sell your stuff and rebuy it. You don't need many ships to have some fun. Roaming is .. not that common any more. What we do is live in a Wormhole, jump into 0.0 and try to tackle something big and hope they form a defense fleet. Roll the hole to get a…

> Roaming is .. not that common any more. Nor is gatecamping because some genius decided that instawarping bubble immunity (with optional covops cloak functionality) was a good idea so people could move through null in virtually perfect safety. There have been so many changes which I find fundamentally stupid that it's hard for me to engage with the game these days. One day I'll probably play for a bit again though

Most people gate-camp to try to get actual kills, not empty capsules from people just trying to get from point A to point B. And there's plenty of counterplay for insta-warping bubble immunity (i.e. smart bombs). Gate camps are still very common.

Re: Be careful what you copy: Invisibly inserting usernames into text

#167

Post by avree » Wed, Apr 04, 2018, 5:46 PM UTC

criley2 wrote: post #123

Mashimo wrote: post #105

Earlier quoted context omitted.

Still a lot of people playing it. A bit less subscribers, but not too bad. In 0.0 it's captials everywhere. People mine in Rorquals, people do PvE in Carriers and Supers. If you tackle a small ships doing PvE it opens a cyno and Captials jump in. They now have fighters that have good applications against smaller ships. So the good old rock paper scissors for shipssize in eve is not more. Still a diverse game, from so…

I struggled to get in because character progression was based solely on account being active, not play time. And every guide for the game basically starts with "Subscribe, and don't log in for 3 months while you get your newbie pilot some basic skills, or if you do log in, don't do much because you're useless anyway" Three. Months. How can a game be basically unplayable for newbies for ninety days? Meh. Time gated ga…

Any guide that said that was wrong. In-game skills help, but actual ability and knowledge matters a lot more. There were guides like https://www.youtube.com/watch?v=de1hwoFYA_k where people used brand new trial accounts to go get good kills.

But yes, they've made it a lot easier to just hop in without the need to train for anything.

Re: Be careful what you copy: Invisibly inserting usernames into text

#168

Post by rtkwe » Wed, Apr 04, 2018, 5:48 PM UTC

nsgi wrote: post #119

ry_ry wrote: post #21

Earlier quoted context omitted.

Later, we just told select people we had implemented some crazy undetectable watermarking, and the leaks stopped - effectively identifying the culprits in the process.

The Death Note method. Reminds me of https://www.gwern.net/Death-Note-Anonymity

Whoa, does anyone else get huge memory usage on that page? I'm on Chrome 64.0.3282.186 and that page was using ~2GB.

More on topic it's always shocking how many things serve to deanonymize these days.

Re: Be careful what you copy: Invisibly inserting usernames into text

#169

Post by irrational » Wed, Apr 04, 2018, 5:58 PM UTC

kccqzy wrote: post #133

irrational wrote: post #20

How difficult would it be to write a browser extension to either remove all zero-width characters or somehow make it super obvious that they are being used on the page? I just searched for "zero-width" and "zero width" in Chrome and Firefox's extensions stores, but didn't come up with anything.

Zero width characters have legitimate uses such as family emojis and certain Indic scripts. You don't want to break these.

I'd rather be protected from tracking than worry about some emojis breaking or text in script I can't read formatting incorrectly. Of course, this should be an individual decision since some people do read those scripts and some people do care about emojis.

Re: Be careful what you copy: Invisibly inserting usernames into text

#170

Post by gnopgnip » Wed, Apr 04, 2018, 6:04 PM UTC

criley2 wrote: post #123

Mashimo wrote: post #105

Earlier quoted context omitted.

Still a lot of people playing it. A bit less subscribers, but not too bad. In 0.0 it's captials everywhere. People mine in Rorquals, people do PvE in Carriers and Supers. If you tackle a small ships doing PvE it opens a cyno and Captials jump in. They now have fighters that have good applications against smaller ships. So the good old rock paper scissors for shipssize in eve is not more. Still a diverse game, from so…

I struggled to get in because character progression was based solely on account being active, not play time. And every guide for the game basically starts with "Subscribe, and don't log in for 3 months while you get your newbie pilot some basic skills, or if you do log in, don't do much because you're useless anyway" Three. Months. How can a game be basically unplayable for newbies for ninety days? Meh. Time gated ga…

There were some pretty significant improvements to the new player experience. Within a few hours you have enough skills to participate in faction warfare or other small scale pvp as a tackler.