Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A tool for recovering passwords from pixelized screenshots

github.com

Post reply on HN
Print view View original

41–50 of 130 posts

Re: A tool for recovering passwords from pixelized screenshots

#41

Post by TheAdamAndChe »

SulfurHexaFluri wrote: post #37
johnnyfived wrote: post #31

Why is this advertised for passwords only? It should work for any pixelated text. Just because cracking passwords sounds like a cool use case? This project is shooting itself in the foot. Plus it's not like passwords are ever pixelated on-screen, they're generally stylized as asterisks. But sweet leet hacking skills bro

A similar method was used to uncover the name of a game mode in a teaser video from nintendo. Since it was a video the pixels would change as things moved and you could reverse the pixelation fairly well.

Any source for this? That sounds interesting.

Re: A tool for recovering passwords from pixelized screenshots

#42

Post by davchana »

jbverschoor wrote: post #34
davchana wrote: post #21

Earlier quoted context omitted.

Yes, in pdf, add bars, & then print it again as pdf, but as image.

Even black bars all leak the face that there’s something hidden

Do you mean the typeface/font? If it is just a word we are hiding in a sentence/paragraph; it would be like fill in a blank task for reader; much more chance to guess from context. There, the leaking length will not matter.

Re: A tool for recovering passwords from pixelized screenshots

#43

Post by bee_rider »

pvorb wrote: post #40
xoa wrote: post #7

Earlier quoted context omitted.

> Why is pixelation preferable to a big black obliterating box? From a security perspective it has zero advantages, but I guess some people like the aesthetics? > To me, it seems like a lot of wasted time and effort and potential arms race between encoders and decoders and the risk of being exposed when you could just put a big black box over whatever you wish to obscure. There doesn't need to be an arms race, one ca…

Yep, just replace the original password for "password" and pixelate that, if it really must look like a real password. And make sure to never use "password" as a real password, but that's a different level of shooting oneself in the foot.

Or better yet, embed easter-eggs. Possibly insults to the people prying into your secrets, or possibly alternative announcements.

Re: A tool for recovering passwords from pixelized screenshots

#44

Post by riidom »

Vaslo wrote: post #32

Where are passwords even pixelized? I always see them as dots.

Let's say, a software manual, where you show some screenshots or make a screencast, but for some reason it's not possible to use dummy data and you need to hide the real data (because it's customer's names, or alike)

Re: A tool for recovering passwords from pixelized screenshots

#45

Post by riidom »

seltzered_ wrote: post #24
riidom wrote: post #6

Earlier quoted context omitted.

Only reason I can think of: Pixelation has a more elegant touch than covering everything with a box (be it black, or some better suited color). Took a while to convince people to not use a bit of gaussian blur, because it's insecure. Well, ready for round 2...

What stops one from making a more secure pixelation algorithm? One that will shuffle around or maybe just randomly derive the pixelated blocks if they're within a certain color threshold of similarity? I still generally like pixelation over drawing a box for aesthetic purposes.

Well you can increase the size of the blocks, maybe to full font-height. But at some point in future, some ML-guy will even decipher that probably.

Re: A tool for recovering passwords from pixelized screenshots

#46

Post by rebane2001 »

nickjj wrote: post #35
xorcist wrote: post #17

Earlier quoted context omitted.

There is still a risk to leak the length of the password. If the font is known and the size of the rendered text can be inferred that would limit the search space considerably.

> There is still a risk to leak the length of the password. If the font is known and the size of the rendered text can be inferred that would limit the search space considerably. I do a lot of screencast videos and what I typically do is put a black rectangle well past the point where my secret text really ends. If my secret is: mysupersecretpassword You might end up seeing a black bar of: |||||||||||||||||||||||||||…

Your fear is one of the reasons I have z/x bound to 1 frame backwards/forwards in my editing software, it lets me quickly look for such issues.

However, glitches in editing software can still rarely occur, so for very confidential footage I first censor it, render it out in an intermediary format, check the render to make sure it's 100% correctly censored and then use that rendered footage to continute editing.

Also, mixing/messing with frame rates is an easy way to shoot yourself in the foot.

Re: A tool for recovering passwords from pixelized screenshots

#47

Post by manceraio »

SulfurHexaFluri wrote: post #37
johnnyfived wrote: post #31

Why is this advertised for passwords only? It should work for any pixelated text. Just because cracking passwords sounds like a cool use case? This project is shooting itself in the foot. Plus it's not like passwords are ever pixelated on-screen, they're generally stylized as asterisks. But sweet leet hacking skills bro

A similar method was used to uncover the name of a game mode in a teaser video from nintendo. Since it was a video the pixels would change as things moved and you could reverse the pixelation fairly well.

What about that bitcoin wallet that was blurred on TV and they managed to reverse engineer it?

Cannot find source.

Re: A tool for recovering passwords from pixelized screenshots

#48

Post by gxqoz »

sly010 wrote: post #13

Relatedly (and this is probably not surprising to anyone here) if you draw a black box on a PDF file to cover sensitive information, chances are a simple screen reader will still able to extract the information just fine.

Even if you do black box -> separate screenshot? Is that because the OCR is encoded in white pixels you didn't redact?

Re: A tool for recovering passwords from pixelized screenshots

#49

Post by evan_ »

MattGaiser wrote: post #2

Why is pixelation preferable to a big black obliterating box? To me, it seems like a lot of wasted time and effort and potential arms race between encoders and decoders and the risk of being exposed when you could just put a big black box over whatever you wish to obscure.

A pixelated area communicates more clearly that there’s information present that is hidden from you- but not from others. It also can’t be mistaken for a design element.

Re: A tool for recovering passwords from pixelized screenshots

#50

Post by tpoacher »

diebeforei485 wrote: post #10
MattGaiser wrote: post #2

Why is pixelation preferable to a big black obliterating box? To me, it seems like a lot of wasted time and effort and potential arms race between encoders and decoders and the risk of being exposed when you could just put a big black box over whatever you wish to obscure.

This reminds of the Markup tool[1] on iPhone. People use it to redact from screenshots, but it was (is?) actually slightly transparent by default. [1] https://9to5mac.com/2018/03/13/ios-markup-reveal-redact-sens...

one of the "underhanded c" contest winners many years ago was an entry for a redaction tool, which drew black boxes on an image in such a way that the software developer could later effectively recover the redacted information easily, while still being able to claim plausible deniability. The trick was that it worked by producing a ppm file where pixels with single digits would become zeros, but double digits would become 00, and three digit ints would become 000 (all valid values for black in ppm).
Post reply on HN