Live data from Hacker News

A tool for recovering passwords from pixelized screenshots

github.com

51–60 of 130 posts

Re: A tool for recovering passwords from pixelized screenshots

#51
post #40

Earlier quoted context omitted.

Yep, just replace the original password for "password" and pixelate that, if it really must look like a real password. And make sure to never use "password" as a real password, but that's a different level of shooting oneself in the foot.

Or better yet, embed easter-eggs. Possibly insults to the people prying into your secrets, or possibly alternative announcements.

Or better yet, put "Itriedtodepixelizeyourpassword".

Re: A tool for recovering passwords from pixelized screenshots

#52

Earlier quoted context omitted.

A similar method was used to uncover the name of a game mode in a teaser video from nintendo. Since it was a video the pixels would change as things moved and you could reverse the pixelation fairly well.

Any source for this? That sounds interesting.

It looks like this may be more due to a mistake in the censor area than a general pattern you can use but here it is https://twitter.com/Lattie9001/status/1027204063811850240

These kinds of mistakes show up constantly. Another one that often works is when people draw black bars over words they are often no 100% opaque and you can chuck them in to gimp, drag the levels around until the original word is exposed.

Re: A tool for recovering passwords from pixelized screenshots

#53
post #51

Earlier quoted context omitted.

Or better yet, embed easter-eggs. Possibly insults to the people prying into your secrets, or possibly alternative announcements.

Or better yet, put "Itriedtodepixelizeyourpassword".

"Depix Error: Please report on GitHub"

Re: A tool for recovering passwords from pixelized screenshots

#54
post #6

Why is pixelation preferable to a big black obliterating box? To me, it seems like a lot of wasted time and effort and potential arms race between encoders and decoders and the risk of being exposed when you could just put a big black box over whatever you wish to obscure.

Only reason I can think of: Pixelation has a more elegant touch than covering everything with a box (be it black, or some better suited color). Took a while to convince people to not use a bit of gaussian blur, because it's insecure. Well, ready for round 2...

For elegance, it's a bit artificial, being tied to the technology of things that use pixels and popular software that zooms in on pixelated images as a grid of single-color squares. Maybe some unintelligible character-like symbols would look more elegant?

Re: A tool for recovering passwords from pixelized screenshots

#55
post #9

Why is pixelation preferable to a big black obliterating box? To me, it seems like a lot of wasted time and effort and potential arms race between encoders and decoders and the risk of being exposed when you could just put a big black box over whatever you wish to obscure.

Even big black boxes require some amount of skill. https://twitter.com/Phthalaldehyde/status/133471474074092748...

Can't facepalm enough. Just, amazing incompetence.

Re: A tool for recovering passwords from pixelized screenshots

#56
post #12
post #3

Earlier quoted context omitted.

It's not. There's never going to be a tool that does this with black bars. The only benefit I can think of is legitimacy. Having something blurred there suggests that there was actually something there.

Black bars alone may still leak info. First, if you add black bars on your own and don't use professional redaction features of software, you might miss the OCR text layer of the PDF, or the bar might be added as a separate object entirely which means it can also be removed later on. Second, if you don't use monospace text, the width of the text you are redacting will reveal information about it. That's why monospace…

> First, if you add black bars on your own and don't use professional redaction features of software, you might miss the OCR text layer of the PDF, or the bar might be added as a separate object entirely which means it can also be removed later on.

Looking at you, Preview on macOS.

Re: A tool for recovering passwords from pixelized screenshots

#57
post #12
post #3

Earlier quoted context omitted.

It's not. There's never going to be a tool that does this with black bars. The only benefit I can think of is legitimacy. Having something blurred there suggests that there was actually something there.

Black bars alone may still leak info. First, if you add black bars on your own and don't use professional redaction features of software, you might miss the OCR text layer of the PDF, or the bar might be added as a separate object entirely which means it can also be removed later on. Second, if you don't use monospace text, the width of the text you are redacting will reveal information about it. That's why monospace…

> Second, if you don't use monospace text, the width of the text you are redacting will reveal information about it.

If you do use monospace text, width reveals the exact redacted character count. If you don't use monospace text, it constrains the possible contents in a more complicated way, but it leaks information either way.

Re: A tool for recovering passwords from pixelized screenshots

#58
post #55
post #9

Earlier quoted context omitted.

Even big black boxes require some amount of skill. https://twitter.com/Phthalaldehyde/status/133471474074092748...

Can't facepalm enough. Just, amazing incompetence.

People say the same thing about scans of printouts. But I guess there is a reason for those.

Re: A tool for recovering passwords from pixelized screenshots

#59
post #17

Earlier quoted context omitted.

There is still a risk to leak the length of the password. If the font is known and the size of the rendered text can be inferred that would limit the search space considerably.

Personal Snippet, if I want to hide/cross something I wrote on paper, I usually change letters to something else, like u to g, i to d, nothing preplanned, whatever comes in mind, before I cross line the text in forward slashes, backword slashes, & in horizontal lines.

I thought I was the only one!

Such a great trick. Just write random letters or even random sentences over your handwriting perhaps 2 or 3 times, then heavily cross it out and it's impossible to recover.

Re: A tool for recovering passwords from pixelized screenshots

#60
post #22

So as I understand it this technique rests on a number of assumptions: - You know the exact parameters used to render the text - You can render new text with the exact same parameters - The pixelated image hasn’t been ruined by color quantization or other destructive compression

I could see someone assembling a corpus of sample text images covering commonly available fonts across major operating systems and having a version of this tool that brute forces all of them to find the best match.

It would also be interesting to see how well it worked if there were differences in font rendering or compression as you say - I wonder if you it might still be close enough to make a partial match in some cases.

Post reply on HN