Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A tool for recovering passwords from pixelized screenshots

github.com

Post reply on HN
Print view View original

91–100 of 130 posts

Re: A tool for recovering passwords from pixelized screenshots

#91

Post by Macuyiko »

Hamuko wrote: post #9
MattGaiser wrote: post #2

Why is pixelation preferable to a big black obliterating box? To me, it seems like a lot of wasted time and effort and potential arms race between encoders and decoders and the risk of being exposed when you could just put a big black box over whatever you wish to obscure.

Even big black boxes require some amount of skill. https://twitter.com/Phthalaldehyde/status/133471474074092748...

Other fun things I've seen (e.g. when double-blind reviewing):

- Someone makes the background color black in Word and saves as PDF. Text is still selectable - Someone draws a black rectangle over the text in Word, text is still searchable / rectangle can be removed with any simple PDF editor

Re: A tool for recovering passwords from pixelized screenshots

#93

Post by zinekeller »

ciarannolan wrote: post #15
sly010 wrote: post #13

Relatedly (and this is probably not surprising to anyone here) if you draw a black box on a PDF file to cover sensitive information, chances are a simple screen reader will still able to extract the information just fine.

Redact ---> print ---> scan ---> distribute. I think US courts and lawyers are finally starting to learn this.

Paperless edition: Redact ---> convert to image ---> convert to PDF ---> distribute.

Re: A tool for recovering passwords from pixelized screenshots

#94

Post by huhtenberg »

MattGaiser wrote: post #2

Why is pixelation preferable to a big black obliterating box? To me, it seems like a lot of wasted time and effort and potential arms race between encoders and decoders and the risk of being exposed when you could just put a big black box over whatever you wish to obscure.

For stylistic reasons.

It looks less jarring when pixelated compared to being blackened out.

Re: A tool for recovering passwords from pixelized screenshots

#95

Post by buran77 »

mleonhard wrote: post #69
xoa wrote: post #7

Earlier quoted context omitted.

> Why is pixelation preferable to a big black obliterating box? From a security perspective it has zero advantages, but I guess some people like the aesthetics? > To me, it seems like a lot of wasted time and effort and potential arms race between encoders and decoders and the risk of being exposed when you could just put a big black box over whatever you wish to obscure. There doesn't need to be an arms race, one ca…

> take a selection, apply average solid color and random text over it, then pixelate the result Averaging the color leaks information. To avoid leaking info, destroy the pixels as the first step. Get colors from outside the selection.

What useful information could solid color and random text leak even if depixelized? I assume the average solid color is just so the new pixelized region doesn't stand out against the rest of the non-pixelized ones, being an average color.

Applying it to an HN comment the result would be a solid average of #F6F6EF (beige background) and #290027 (text), so a solid darker beige with some random black text over, all pixelized. How can any of this be used to recover the original text?

Re: A tool for recovering passwords from pixelized screenshots

#96

Post by Scoundreller »

pabs3 wrote: post #70
MattGaiser wrote: post #63

Earlier quoted context omitted.

Those at least destroy any non-visible data.

I feel like contrast enhancement or similar would be able to bring that back.

That’s also why they scan in b&w with a potato. Also has the side-effect of making many graphs/charts impossible to interpret.

Re: A tool for recovering passwords from pixelized screenshots

#97

Post by [deleted] »

spoonjim wrote: post #89
est31 wrote: post #12

Earlier quoted context omitted.

Black bars alone may still leak info. First, if you add black bars on your own and don't use professional redaction features of software, you might miss the OCR text layer of the PDF, or the bar might be added as a separate object entirely which means it can also be removed later on. Second, if you don't use monospace text, the width of the text you are redacting will reveal information about it. That's why monospace…

This is why the real professionals use the same mechanism they always have: cut the offending text out of the paper with an x-Acto knife and make a photocopy.

[deleted]

Re: A tool for recovering passwords from pixelized screenshots

#98

Post by txmachinery »

buran77 wrote: post #95
mleonhard wrote: post #69

Earlier quoted context omitted.

> take a selection, apply average solid color and random text over it, then pixelate the result Averaging the color leaks information. To avoid leaking info, destroy the pixels as the first step. Get colors from outside the selection.

What useful information could solid color and random text leak even if depixelized? I assume the average solid color is just so the new pixelized region doesn't stand out against the rest of the non-pixelized ones, being an average color. Applying it to an HN comment the result would be a solid average of #F6F6EF (beige background) and #290027 (text), so a solid darker beige with some random black text over, all pixe…

In principle it leaks information, so is always worse practice than not leaking. For example, one could imagine an edge-case where given a set of average-colour password images collected over time, for a password field that has a dynamic in its presentation that is exposed in the averaging, useful information could be discerned and used to supplement other attack vectors.

Say for example, the password field had one of those password strength colour indicators that subtly changed the background or font colour to indicate password strength, and the images were captured and obfuscated at that point. Information useful to an attacker would now be embedded in the colour average.

Re: A tool for recovering passwords from pixelized screenshots

#99

Post by Scoundreller »

spoonjim wrote: post #89
est31 wrote: post #12

Earlier quoted context omitted.

Black bars alone may still leak info. First, if you add black bars on your own and don't use professional redaction features of software, you might miss the OCR text layer of the PDF, or the bar might be added as a separate object entirely which means it can also be removed later on. Second, if you don't use monospace text, the width of the text you are redacting will reveal information about it. That's why monospace…

This is why the real professionals use the same mechanism they always have: cut the offending text out of the paper with an x-Acto knife and make a photocopy.

Also helps prevent any issues related to double sided printing and bleedthrough.

Re: A tool for recovering passwords from pixelized screenshots

#100

Post by Scoundreller »

nyanpasu64 wrote: post #85
manceraio wrote: post #47

Earlier quoted context omitted.

What about that bitcoin wallet that was blurred on TV and they managed to reverse engineer it? Cannot find source.

https://www.bbc.com/news/technology-41737248 > Two French hackers used their computer skills to reconstruct a blurred-out code on TV and claim bitcoins worth $1,000 (£760).

It was Bitcoin cash, so the 3 are worth, today, ~$1320.

I think the hackers could have made more money if they got real jobs doing valuable work.

Post reply on HN