11–20 of 43 posts
You don't even have to color over, or blur, or do any of that hard stuff. Just select the region, and press "CTRL-X", save and quit. No reason to do it any other way.
People blur to maintain the general look of the original image. Having black boxes everywhere is jarring. Honestly, I don't think the lesson has to be "don't blur"... it can just be "blur enough". If I blur something out, I just use a radius big enough to erase all of the information.
I dont think he is stressing the ease of doing this with credit card numbers. The sample space he is suggesting generating is far too large... You can usually identify the first several digits simply by the issuing organization, as they all use standardized numbers, the remaining digits must pass a certain checksum algorithm. So really generating a bunch of valid cc numbers is quite trivial. Matching exp dates with n…
Earlier quoted context omitted.
Bank of America uses a horrible method for generating debit card numbers. It's a standard prefix + account number + sequence number + check digit. If you have stolen someone's BofA debit card number then you can easily guess the replacement card's number (just increment the sequence number and recalculate the check digit). From there you just need to guess the expiration date (a comparatively trivial task).
But that's for debit cards - I think most banks include the account number in a debit card number. You would still need the CCV number from the back of the card for the attack to work.
Earlier quoted context omitted.
Bank of America uses a horrible method for generating debit card numbers. It's a standard prefix + account number + sequence number + check digit. If you have stolen someone's BofA debit card number then you can easily guess the replacement card's number (just increment the sequence number and recalculate the check digit). From there you just need to guess the expiration date (a comparatively trivial task).
But that's for debit cards - I think most banks include the account number in a debit card number. You would still need the CCV number from the back of the card for the attack to work.
Also, not all online merchants use CCV. Also consider the risk of creating fake physical CCs, no address or CCV necessary.
I dont think he is stressing the ease of doing this with credit card numbers. The sample space he is suggesting generating is far too large... You can usually identify the first several digits simply by the issuing organization, as they all use standardized numbers, the remaining digits must pass a certain checksum algorithm. So really generating a bunch of valid cc numbers is quite trivial. Matching exp dates with n…
I'd expect random swirls to be reliable, or any obfuscation that introduces a reasonable amount of entropy. This whole attack relies on an almost-exact replication of the original blurred image. If you do something a computer can't easily reproduce over and over again, or something that looks the same no matter what the obfuscated content is (like blacking out), this attack cannot work.
You're definitely right about adding entropy though, but why bother? Just blacking it out guarantees how much information is available - zero.
You don't even have to color over, or blur, or do any of that hard stuff. Just select the region, and press "CTRL-X", save and quit. No reason to do it any other way.
People blur to maintain the general look of the original image. Having black boxes everywhere is jarring. Honestly, I don't think the lesson has to be "don't blur"... it can just be "blur enough". If I blur something out, I just use a radius big enough to erase all of the information.
In that case, why not erase the numbers and replace them with random digits?
Earlier quoted context omitted.
I'd expect random swirls to be reliable, or any obfuscation that introduces a reasonable amount of entropy. This whole attack relies on an almost-exact replication of the original blurred image. If you do something a computer can't easily reproduce over and over again, or something that looks the same no matter what the obfuscated content is (like blacking out), this attack cannot work.
Actually swirls are very reversible - http://news.bbc.co.uk/1/hi/7384834.stm (Paedophile caught from video with swirled obfuscation of his face.) You're definitely right about adding entropy though, but why bother? Just blacking it out guarantees how much information is available - zero.