Live data from Hacker News

A tool for recovering passwords from pixelized screenshots

github.com

31–40 of 130 posts

Re: A tool for recovering passwords from pixelized screenshots

#31
Why is this advertised for passwords only? It should work for any pixelated text. Just because cracking passwords sounds like a cool use case? This project is shooting itself in the foot. Plus it's not like passwords are ever pixelated on-screen, they're generally stylized as asterisks. But sweet leet hacking skills bro

Re: A tool for recovering passwords from pixelized screenshots

#33

would a neural network be able to do something like this?

From the article - "Since the linear box filter is a deterministic algorithm, pizelizing the same values will always result in the same pixelated block."

The author used this property to create the de-pixelizing algorithm. A neural network could do it, but it would be overkill.

Re: A tool for recovering passwords from pixelized screenshots

#34
post #12

Earlier quoted context omitted.

Black bars alone may still leak info. First, if you add black bars on your own and don't use professional redaction features of software, you might miss the OCR text layer of the PDF, or the bar might be added as a separate object entirely which means it can also be removed later on. Second, if you don't use monospace text, the width of the text you are redacting will reveal information about it. That's why monospace…

Yes, in pdf, add bars, & then print it again as pdf, but as image.

Even black bars all leak the face that there’s something hidden

Re: A tool for recovering passwords from pixelized screenshots

#35
post #17
post #3

Earlier quoted context omitted.

It's not. There's never going to be a tool that does this with black bars. The only benefit I can think of is legitimacy. Having something blurred there suggests that there was actually something there.

There is still a risk to leak the length of the password. If the font is known and the size of the rendered text can be inferred that would limit the search space considerably.

> There is still a risk to leak the length of the password. If the font is known and the size of the rendered text can be inferred that would limit the search space considerably.

I do a lot of screencast videos and what I typically do is put a black rectangle well past the point where my secret text really ends.

If my secret is:

    mysupersecretpassword
You might end up seeing a black bar of:

    ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||

What I'm most afraid of is accidentally having literally 1 frame of video where the bar isn't present. This is super easy to do if you're just scrolling through a timeline while editing. You need to really dive in and move frame by frame to ensure you get everything. I usually extend it a few frames in either direction just to be safe too.

Re: A tool for recovering passwords from pixelized screenshots

#36

Why is pixelation preferable to a big black obliterating box? To me, it seems like a lot of wasted time and effort and potential arms race between encoders and decoders and the risk of being exposed when you could just put a big black box over whatever you wish to obscure.

Because pixelation doesn't attract attention as much as black box and is therefore a better placeholder. A black box with sharp edges has much more contrast than all the legit elements in the image and becomes visually dominant whereas typically you want to attract attention to something else on the page.

For a similar reason, designers use "lorem ipsum" placeholder text rather than all-white or all-black placeholders when mocking up a layout

Re: A tool for recovering passwords from pixelized screenshots

#37

Why is this advertised for passwords only? It should work for any pixelated text. Just because cracking passwords sounds like a cool use case? This project is shooting itself in the foot. Plus it's not like passwords are ever pixelated on-screen, they're generally stylized as asterisks. But sweet leet hacking skills bro

A similar method was used to uncover the name of a game mode in a teaser video from nintendo. Since it was a video the pixels would change as things moved and you could reverse the pixelation fairly well.

Re: A tool for recovering passwords from pixelized screenshots

#39
post #36

Why is pixelation preferable to a big black obliterating box? To me, it seems like a lot of wasted time and effort and potential arms race between encoders and decoders and the risk of being exposed when you could just put a big black box over whatever you wish to obscure.

Because pixelation doesn't attract attention as much as black box and is therefore a better placeholder. A black box with sharp edges has much more contrast than all the legit elements in the image and becomes visually dominant whereas typically you want to attract attention to something else on the page. For a similar reason, designers use "lorem ipsum" placeholder text rather than all-white or all-black placeholder…

The clear answer is to use pixelated lorem ipsum for obfuscation. :)

Re: A tool for recovering passwords from pixelized screenshots

#40
post #7

Why is pixelation preferable to a big black obliterating box? To me, it seems like a lot of wasted time and effort and potential arms race between encoders and decoders and the risk of being exposed when you could just put a big black box over whatever you wish to obscure.

> Why is pixelation preferable to a big black obliterating box? From a security perspective it has zero advantages, but I guess some people like the aesthetics? > To me, it seems like a lot of wasted time and effort and potential arms race between encoders and decoders and the risk of being exposed when you could just put a big black box over whatever you wish to obscure. There doesn't need to be an arms race, one ca…

Yep, just replace the original password for "password" and pixelate that, if it really must look like a real password. And make sure to never use "password" as a real password, but that's a different level of shooting oneself in the foot.
Post reply on HN