Earlier quoted context omitted.
Right, and since most screenshots are jpeg, that means LSB would likely be lost.
At least on macOS, screenshots are PNG. Does Windows make JPEGs?
The Snipping Tool included with Win 10 defaults to saving as PNG
Be careful what you copy: Invisibly inserting usernames into text
181–190 of 200 posts
Re: Be careful what you copy: Invisibly inserting usernames into text
#182How do I see those invisible characters in emacs or vim ? In emacs I thought that whitespace-mode would do the trick but apparently it doesn't.
In emacs those characters are by default visible as one-pixel wide spaces, to make them more apparent eval (update-glyphless-char-display 'glyphless-char-display-control '((format-control . empty-box) (no-font . hex-code))).
Re: Be careful what you copy: Invisibly inserting usernames into text
#183Re: Be careful what you copy: Invisibly inserting usernames into text
#184Earlier quoted context omitted.
I thought this was also done by adding spans in the text set to display: none. You will still copy that text without selecting it: cd /tmp; rm -R ~/; ls;
Yes, I actually confused the two concepts and my comment is a bit misleading. This exploit is only done using display tricks, NOT using zero-width characters. Zero-width characters are very limited and can't actually spell out commands (to my knowledge). It is though, still another reason to be careful when copy pasting. Now I'm thinking if you can somehow put an ESC character in text so that when you copy-paste it i…
Here are PoC exploits against various editors:
http://www.openwall.com/lists/oss-security/2018/03/05/2
Even pasting to cat(1) might be insecure. The paste can contain ^D, which will make cat quit; then the rest of the paste will be interpeted by shell.
Re: Be careful what you copy: Invisibly inserting usernames into text
#185How difficult would it be to write a browser extension to either remove all zero-width characters or somehow make it super obvious that they are being used on the page? I just searched for "zero-width" and "zero width" in Chrome and Firefox's extensions stores, but didn't come up with anything.
I just made a very basic one: https://chrome.google.com/webstore/detail/icibkhaehdofmcbfjf... Code here: https://github.com/roymckenzie/detect-zero-width-characters-... Submit a PR! I know it could be better! Needed features: * right-click selected text and "Sanitize and Copy" * toggle off and on ...
Re: Be careful what you copy: Invisibly inserting usernames into text
#186this haphazard attempt at DRM seem like a perfect OpSec layer in case the purpose is to throw off the gullible media or any "experts" overly keen on cyber attribution. The method seems flawed unless you actually want your adversary to find it and make incorrect assumptions, it's probably not the right tool for the job. EDIT/PS: the first one who finds the homoglyphs within this very status update and posts it in the…
in the post this apostrophe: [‘] is used instead if the standard ['] apostrophe or [`] grave. It's pretty trivial to check just by opening it in any non-Unicode supporting terminal. In fact the zero width characters show up explicitly as blue in vim.
People always throw around language compatibility when the unusual features of Unicode are thrown around, but stuff like zero width characters really don't need to be supported for language compatibility.
On another note, if Unicode is willing to butcher Chinese/Kanji orthography with Han unification then it ought to be willing to get rid of Latin homographs.
Re: Be careful what you copy: Invisibly inserting usernames into text
#187Would someone please share a quick image that shows a visual example?
Re: Be careful what you copy: Invisibly inserting usernames into text
#188Earlier quoted context omitted.
What if you also did a random synonym replacement throughout the piece to destroy the watermarking? If the source is anonymous and hidden, then authenticity cannot be checked by the reader anyway, and so replacement without changing meaning is an acceptable change to protect sources.
You would have to change every word, since any could be a waterprinted synonym. A better way would be to read it, make a summary, then rewrite it from memory and only use the source data to correct factual differences.
You wouldn't necessarily have to change every word; just enough to break the decoding scheme. But even then it's totally random, so the longer the document, the more opportunities to be fingerprinted. It's like the old saying goes, "the police only need to be lucky once, but the criminals need to be lucky all the time." [0]
[0] I never bothered looking up where this came from until just now... interestingly it's from the IRA, and used in the total opposite way most people use it now... https://en.wikipedia.org/wiki/Brighton_hotel_bombing
Re: Be careful what you copy: Invisibly inserting usernames into text
#189Zero-width characters are invisible, `non-printing' characters that are not displayed by the majority of applications. F*or exam*ple, I've ins*erted 10 ze*ro-width spa*ces in*to thi*s sentence, c*an you tel**l? (Hint: paste the sentence into Diff Checker to see the locations of the characters!). These characters can be used to `fingerprint' text for certain users. Above is what paragraph looks like in text-only brows…
That's just because the browser doesn't handle unicode well. The 'text-only', 'VGA' and 'textmode' are actually irrelevant. The behaviour you are seeing is down to programmer choice/laziness/missing support.
s/text-only/ASCII-only, no Javascript/
s/browser/& I use/
s/in VGA textmode//
I am in agreement with this programmers choices, for the most part. Certainly I agree with this one.
Re: Be careful what you copy: Invisibly inserting usernames into text
#190Earlier quoted context omitted.
Could you talk more about why this was useful for Eve? What's an example of how you could blame innocent folks? And how could you sign the inserted data – do you mean cryptographically?
Spying is a big problem in Eve. At the most basic level a spy is able to take screenshots and copy/paste text to send back to the entity they're spying for. By watermarking both text and forum backgrounds the data effectively becomes tainted in the sense that the screenshot/text will have unique characteristics that allow the original poster to identify who copied the data in the first place. The whole flow would be:…
Could "fingerprinting" a screenshot be foiled by running the screenshot through a lossy algorithm? Or doing something like converting to jpg->gif->jpg->gif->png->jpg... a few rounds? Enough to keep the picture viewable, but just barely?
Or hell, even simpler; taking a cameraphone picture of the screenshot?