Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why blurring sensitive information is a bad idea (2007)

dheera.net

Post reply on HN
Print view View original

31–40 of 131 posts

Re: Why blurring sensitive information is a bad idea (2007)

#31

Post by MichaelApproved »

nnnnni wrote: post #10

Their answer is to "color over it", but BE CAREFUL if you do that. I'm sure that some of us remember the US government document(s) in the late 90s/early 2000s that were released in redacted form, but the person didn't realize/understand that people with the Acrobat editor program could remove the black bars.

You don't have to go all the way back to the early 2000s to find poorly redacted federal documents. Rachel Maddow had a great segment on botched redactions, like removing the black lines from a PDF.

The best solution was to actually cut out the parts of the page you don't want seen and then scan in the result. All other methods are prone to mistakes.

Edit: corrected link to segment http://www.msnbc.com/rachel-maddow-show/watch/redaction-rule...

Re: Why blurring sensitive information is a bad idea (2007)

#32

Post by jamuraa »

asgard1024 wrote: post #24
goldenkey wrote: post #9

Earlier quoted context omitted.

You cannot unblur mosaic blurring. It's the equivalent of a hash. The best you can do is brute force possible input vectors. There will be many collisions. This technique only works because digits/numbers limit the input space for a credit card or bank number. For faces, the best you can do is validate if someone you already suspect or someone you have in a database, is the origin of the mosaic. If you had a picture…

I can imagine you can computationally unblur mosaic on video, if the object (e.g. face) is not changing, just the camera is moving around a little.

You can in fact do this, it is a technique known as Super-Resolution and has been around for at least a decade. http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=5...

Re: Why blurring sensitive information is a bad idea (2007)

#34

Post by bjourne »

Has this attack actually been proved possible? He writes that he thinks it should work but doesn't have the time or inclination to prove it. If anyone wants to take a stab at it, I'll gladly submit a mosaiced photo of my credit card because I don't think the attack is practical. If you crack it, you're free to keep whatever you can get. :)

Re: Why blurring sensitive information is a bad idea (2007)

#36

Post by shinigami »

nnnnni wrote: post #10

Their answer is to "color over it", but BE CAREFUL if you do that. I'm sure that some of us remember the US government document(s) in the late 90s/early 2000s that were released in redacted form, but the person didn't realize/understand that people with the Acrobat editor program could remove the black bars.

Also, image formats like JPEG have a thumbnail stored in them, which may not be updated when you edit the image.

Re: Why blurring sensitive information is a bad idea (2007)

#37

Post by jebus989 »

bithush wrote: post #22

I feel this is also very relevant http://en.wikipedia.org/wiki/Christopher_Paul_Neil Police took a photo with a "swirl" effect of a paedophiles face and reversed it to reveal a very usable picture. So good in fact he was found and arrested.

Police == 4chan?

Re: Why blurring sensitive information is a bad idea (2007)

#38

Post by userbinator »

nathell wrote: post #30

In some cases, coloring over parts of the image might still not be enough. Specifically, when all of the following are true: (i) the domain of possible entries is reasonably small (e.g., a number or a name and surname), (ii) the text is printed in a proportional (not fixed-width) typeface, and (iii) enough of the rest of the line is visible to infer the font size and kerning settings.

Actually, using fixed-width would be even easier since it reveals the length.

Re: Why blurring sensitive information is a bad idea (2007)

#39

Post by danielweber »

nnnnni wrote: post #10

Their answer is to "color over it", but BE CAREFUL if you do that. I'm sure that some of us remember the US government document(s) in the late 90s/early 2000s that were released in redacted form, but the person didn't realize/understand that people with the Acrobat editor program could remove the black bars.

There is also "Leaking Sensitive Information in Complex Document Files--and How to Prevent It" from IEEE Security & Privacy earlier this year. All copies might be behind paywalls, however.

Re: Why blurring sensitive information is a bad idea (2007)

#40

Post by robin_reala »

shinigami wrote: post #36
nnnnni wrote: post #10

Their answer is to "color over it", but BE CAREFUL if you do that. I'm sure that some of us remember the US government document(s) in the late 90s/early 2000s that were released in redacted form, but the person didn't realize/understand that people with the Acrobat editor program could remove the black bars.

Also, image formats like JPEG have a thumbnail stored in them, which may not be updated when you edit the image.

Do they? First I’ve heard of that…
Post reply on HN