Web archive version: https://web.archive.org/web/20140714183916/http://dheera.net...
Why blurring sensitive information is a bad idea (2007)
41–50 of 131 posts
Re: Why blurring sensitive information is a bad idea (2007)
#42Earlier quoted context omitted.
Also, image formats like JPEG have a thumbnail stored in them, which may not be updated when you edit the image.
Do they? First I’ve heard of that…
The thumbnail is part of the EXIF metadata. It's reasonably well-known now, but it was not always the case... http://graphicssoft.about.com/b/2003/07/26/techtvs-cat-schwa...
Re: Why blurring sensitive information is a bad idea (2007)
#43Their answer is to "color over it", but BE CAREFUL if you do that. I'm sure that some of us remember the US government document(s) in the late 90s/early 2000s that were released in redacted form, but the person didn't realize/understand that people with the Acrobat editor program could remove the black bars.
You don't have to go all the way back to the early 2000s to find poorly redacted federal documents. Rachel Maddow had a great segment on botched redactions, like removing the black lines from a PDF. The best solution was to actually cut out the parts of the page you don't want seen and then scan in the result. All other methods are prone to mistakes. Edit: corrected link to segment http://www.msnbc.com/rachel-maddow-…
Would a screenshot work?
Re: Why blurring sensitive information is a bad idea (2007)
#44Earlier quoted context omitted.
I can imagine you can computationally unblur mosaic on video, if the object (e.g. face) is not changing, just the camera is moving around a little.
You can in fact do this, it is a technique known as Super-Resolution and has been around for at least a decade. http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=5...
That's really cool. I wonder if that could be used to get images of other planets.
Re: Why blurring sensitive information is a bad idea (2007)
#45I entered an underhanded contest one year where the challenge was recoverable-but-correct-looking redaction of jpegs. I used an insecure random seed based on the time (you could brute force an unredacted image based on the rough time it was generated). The winning solutions were more clever
Re: Why blurring sensitive information is a bad idea (2007)
#46In some cases even blurring faces might be a bad idea. Just because we are unable to unblur a face today doesn't mean we are unable in 10 years or 100 years. In many cases this might not be a problem but in some cases this might lead to trouble later on which can be avoided just as easily.
You cannot unblur mosaic blurring. It's the equivalent of a hash. The best you can do is brute force possible input vectors. There will be many collisions. This technique only works because digits/numbers limit the input space for a credit card or bank number. For faces, the best you can do is validate if someone you already suspect or someone you have in a database, is the origin of the mosaic. If you had a picture…
You can't use the brute force method to find any "person" you have in the database. You can only find any "photograph" that you have in the database.
If you have a photograph of me, and I just let my hair and beard grow for a month, then you won't match the mosaic version of my hairy version with the old photograph.
Perhaps you can add some filters to adapt the contrast, luminosity, hue, illumination, rotation, pixel shifts and noise. It would be more difficult to fix the head orientation, open/close mouth/eyes.
Re: Why blurring sensitive information is a bad idea (2007)
#47Most people want to blur because they think it makes their photo flow better than gaudy black highlights, but you can also use highlights that match the background color/image and make it blend it in, leaving a big white space on a white background instead of a big black space. Most people won't notice anything is missing at all.
If you want that pixel mosaic look for extra futuristic feel, remove the original content by making it fade into background, replace with new, irrelevant content, and then pixelize.
Re: Why blurring sensitive information is a bad idea (2007)
#48Earlier quoted context omitted.
Also, image formats like JPEG have a thumbnail stored in them, which may not be updated when you edit the image.
Do they? First I’ve heard of that…
A few years ago a TV presenter got caught out by this, she posted a cropped photo of herself online, but the original, uncropped version could be recovered from the file which showed her topless.
Re: Why blurring sensitive information is a bad idea (2007)
#49Earlier quoted context omitted.
I can imagine you can computationally unblur mosaic on video, if the object (e.g. face) is not changing, just the camera is moving around a little.
You can in fact do this, it is a technique known as Super-Resolution and has been around for at least a decade. http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=5...
The most precise maps of Pluto were made with a similar technique: http://www.boulder.swri.edu/~buie/pluto/mapstory.html
Re: Why blurring sensitive information is a bad idea (2007)
#50Has this attack actually been proved possible? He writes that he thinks it should work but doesn't have the time or inclination to prove it. If anyone wants to take a stab at it, I'll gladly submit a mosaiced photo of my credit card because I don't think the attack is practical. If you crack it, you're free to keep whatever you can get. :)
You have to know the original font the numbers were in, and the original algorithm or program used to do the blurring. Then it's just a matter of brute forcing it.
Using a 'smear' brush would be a more secure way to blur, there are various sizes and you introduce some randomness in the path of your mouse/stylus when blurring, and you can go over the numbers multiple times. Blurring to much higher factors is a better idea but it is simpler to just use black bars.