Why blurring sensitive information is a bad idea
1–10 of 43 posts
Re: Why blurring sensitive information is a bad idea
#2I'm wondering if the copyright and year are accurate...I recall reading something like this a few years ago, complete with pictures of sample checks.
Re: Why blurring sensitive information is a bad idea
#3I'm wondering if the copyright and year are accurate...I recall reading something like this a few years ago, complete with pictures of sample checks.
It looks like this is the original source, but it's from 2007, not 2010. This 2007 Slashdot article links to the same URL: http://it.slashdot.org/article.pl?sid=07/01/07/1352242. Maybe the current year gets auto-added by whatever CMS he's using? Either that or it's been updated.
Incidentally, while I was looking for that link, I found an implementation in the form of a Photoshop filter: http://tlrobinson.net/blog/2008/10/08/recovering-censored-te...
Re: Why blurring sensitive information is a bad idea
#4I dont think he is stressing the ease of doing this with credit card numbers. The sample space he is suggesting generating is far too large... You can usually identify the first several digits simply by the issuing organization, as they all use standardized numbers, the remaining digits must pass a certain checksum algorithm. So really generating a bunch of valid cc numbers is quite trivial. Matching exp dates with numbers and ccv numbers.. Different story.
But i wonder what the limits to effectiveness is on this attack. I usually randomly swirl around with a smear tool to blur out things...
Re: Why blurring sensitive information is a bad idea
#5I dont think he is stressing the ease of doing this with credit card numbers. The sample space he is suggesting generating is far too large... You can usually identify the first several digits simply by the issuing organization, as they all use standardized numbers, the remaining digits must pass a certain checksum algorithm. So really generating a bunch of valid cc numbers is quite trivial. Matching exp dates with n…
Bank of America uses a horrible method for generating debit card numbers. It's a standard prefix + account number + sequence number + check digit. If you have stolen someone's BofA debit card number then you can easily guess the replacement card's number (just increment the sequence number and recalculate the check digit). From there you just need to guess the expiration date (a comparatively trivial task).
Re: Why blurring sensitive information is a bad idea
#6Also be sure to strip EXIF data since it can contain an original thumbnail. Not all image editors update the thumbnail with changes.
Re: Why blurring sensitive information is a bad idea
#7You don't even have to color over, or blur, or do any of that hard stuff. Just select the region, and press "CTRL-X", save and quit. No reason to do it any other way.
Re: Why blurring sensitive information is a bad idea
#8You don't even have to color over, or blur, or do any of that hard stuff. Just select the region, and press "CTRL-X", save and quit. No reason to do it any other way.
People blur to maintain the general look of the original image. Having black boxes everywhere is jarring.
Honestly, I don't think the lesson has to be "don't blur"... it can just be "blur enough". If I blur something out, I just use a radius big enough to erase all of the information.
Re: Why blurring sensitive information is a bad idea
#9I dont think he is stressing the ease of doing this with credit card numbers. The sample space he is suggesting generating is far too large... You can usually identify the first several digits simply by the issuing organization, as they all use standardized numbers, the remaining digits must pass a certain checksum algorithm. So really generating a bunch of valid cc numbers is quite trivial. Matching exp dates with n…
Bank of America uses a horrible method for generating debit card numbers. It's a standard prefix + account number + sequence number + check digit. If you have stolen someone's BofA debit card number then you can easily guess the replacement card's number (just increment the sequence number and recalculate the check digit). From there you just need to guess the expiration date (a comparatively trivial task).
But that's for debit cards - I think most banks include the account number in a debit card number. You would still need the CCV number from the back of the card for the attack to work.
Re: Why blurring sensitive information is a bad idea
#10I dont think he is stressing the ease of doing this with credit card numbers. The sample space he is suggesting generating is far too large... You can usually identify the first several digits simply by the issuing organization, as they all use standardized numbers, the remaining digits must pass a certain checksum algorithm. So really generating a bunch of valid cc numbers is quite trivial. Matching exp dates with n…
Bank of America uses a horrible method for generating debit card numbers. It's a standard prefix + account number + sequence number + check digit. If you have stolen someone's BofA debit card number then you can easily guess the replacement card's number (just increment the sequence number and recalculate the check digit). From there you just need to guess the expiration date (a comparatively trivial task).
Either you're skipping over a lot of information in the process of how that number's generated, or that's not how they do it anymore (and not how they've done it for at least the last couple of years).