Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Be careful what you copy: Invisibly inserting usernames into text

medium.com

Post reply on HN
Print view View original

171–180 of 200 posts

Re: Be careful what you copy: Invisibly inserting usernames into text

#171

Post by jessriedel »

inetknght wrote: post #120
jessriedel wrote: post #108

Earlier quoted context omitted.

Would probably be better to do this at the OS level, no? Just ensure that shift-cmd-V/shift-ctrl-V strips zero-width characters in addition to formatting. I can't think of a situation where I'd want to keep one but not the other, and you could always do that manually if it came up.

If it'd also optionally (default=true) strip text formatting from copy/paste that'd be epic. No more copy-from-browser-then-paste-into-notepad-then-copy-from-notepad-then-paste-into-email-or-chat

What matthberg said. I'm on a Mac and I use shift-cmd-V frequently (more often than cmd-V).

Unfortunately, there are a few apps that use cmd-opt-shift-V instead of cmd-shift-V. You can fix most of them using this:

https://apple.stackexchange.com/questions/182970/paste-to-ma...

After that, almost everything will use cmd-shift-V. However, Microsoft Word is still broken, apparently because it uses a slightly different command that does a similar thing, "Paste and Match Formatting". Haven't found a way to fix that yet.

Re: Be careful what you copy: Invisibly inserting usernames into text

#172

Post by specialist »

athenot wrote: post #146
tjoff wrote: post #50

Earlier quoted context omitted.

It sounds to me that it would be blatantly obvious that a human didn't write whatever result that may produce. And I don't quite get how you can encode that much information in a sentence without it being completely garbled.

It seems to me that it'd be very obvious that a human did not write whatever result that could produce. Here's 5 bits in that simple sentence. I'm sure others can do better.

It now occurs to me: inject common proofreading mistakes that often go unnoticed.

Re: Be careful what you copy: Invisibly inserting usernames into text

#173

Post by specialist »

cesarb wrote: post #104
nzpopa wrote: post #57

Earlier quoted context omitted.

What about fingerprinting a photographed text? I'm thinking that by encoding the hidden message to bits and representing them in spaces around some arbitrary anchor keywords from the original text might work. Extracting the message then requires either OCR, either manual work(counting spaces).

It could also be encoded in the choice of serif or sans-serif for each character: http://elonka.com/friedman/

That would have never occurred to me. So many tricks.

I wonder if round tripping texts could be an effective sanitizer. Text to speech and back. English to Chinese and back.

Re: Be careful what you copy: Invisibly inserting usernames into text

#174

Post by smogcutter »

criley2 wrote: post #123
Mashimo wrote: post #105

Earlier quoted context omitted.

Still a lot of people playing it. A bit less subscribers, but not too bad. In 0.0 it's captials everywhere. People mine in Rorquals, people do PvE in Carriers and Supers. If you tackle a small ships doing PvE it opens a cyno and Captials jump in. They now have fighters that have good applications against smaller ships. So the good old rock paper scissors for shipssize in eve is not more. Still a diverse game, from so…

I struggled to get in because character progression was based solely on account being active, not play time. And every guide for the game basically starts with "Subscribe, and don't log in for 3 months while you get your newbie pilot some basic skills, or if you do log in, don't do much because you're useless anyway" Three. Months. How can a game be basically unplayable for newbies for ninety days? Meh. Time gated ga…

>> And every guide for the game basically starts with "Subscribe, and don't log in for 3 months while you get your newbie pilot some basic skills, or if you do log in, don't do much because you're useless anyway"

This really isn't true (at least it wasn't some years ago when I last played). What's true though is that the game is complex and does a terrible job of explaining itself. Unless you already know experienced players, the activities immediately available to you as a new player have no resemblance to the "real" game.

It's up to you to explore, get yourself blown up (a lot, ideally), figure out what you're doing, and find a niche. There's plenty to do as a new player that doesn't require months of skill points.

If it winds up speaking to you, the game is absurdly fun and absorbing. I burned out on it years ago, and still remember specific fights and weird adventures I got into.

Edit: My experience as a new player is years out of date, hopefully it's better now. But the real learning curve is always going to be steep.

Re: Be careful what you copy: Invisibly inserting usernames into text

#175

Post by pasta »

teolandon wrote: post #154
pasta wrote: post #58

Earlier quoted context omitted.

I thought this was also done by adding spans in the text set to display: none. You will still copy that text without selecting it: cd /tmp; rm -R ~/; ls;

Yes, I actually confused the two concepts and my comment is a bit misleading. This exploit is only done using display tricks, NOT using zero-width characters. Zero-width characters are very limited and can't actually spell out commands (to my knowledge). It is though, still another reason to be careful when copy pasting. Now I'm thinking if you can somehow put an ESC character in text so that when you copy-paste it i…

Wel I think you can just insert the escape 'character' into the text.

Re: Be careful what you copy: Invisibly inserting usernames into text

#176

Post by masonicb00m »

chatmasta wrote: post #130
pbhjpbhj wrote: post #127

Earlier quoted context omitted.

LSB alterations would be in lossless encoded images, like PNG (of the bit-depth was sufficient); but not in lossy image formats like JPEG.

Right, and since most screenshots are jpeg, that means LSB would likely be lost.

At least on macOS, screenshots are PNG. Does Windows make JPEGs?

Re: Be careful what you copy: Invisibly inserting usernames into text

#178

Post by eikenberry »

yzmtf2008 wrote: post #160

A good utility to use to combat all clipboard-related exploits is one of Apple's example code: ClipboardViewer[0]. You can see a screenshot of it displaying the copied code from the demo in the article here[1]. Besides being able to see the hidden characters, you can also see the internal "layers" of clipboard, e.g., how can a rich-text sentence be pasted to both a plain-text editor and a rich-text one. [0]: https://…

You can also see the unprintable characters at the command prompt by piping the data through `cat -v`.

Re: Be careful what you copy: Invisibly inserting usernames into text

#179

Post by skookumchuck »

megaremote wrote: post #63
skookumchuck wrote: post #53

Earlier quoted context omitted.

> Then how would you indicate that a space or newline is intended? They aren't invisible, you can see the result as spaces and the next line. > how would I indicate that a length of text is to be displayed from right to left when I post Hebrew text to an English-expecting text field? That is also a visible effect.

Nope, not always. Try putting a newline in HTML, it is ignored.

> ignored

Not exactly, it still serves as a word separator. Like the newline (not a space) I put between "word" and "separator".

Re: Be careful what you copy: Invisibly inserting usernames into text

#180

Post by gfo »

EspadaV9 wrote: post #7

Although the demo works, if you just copied part of the text your username isn't taken with it. I think a better way would be to insert the zero-width characters in between the letters and repeat it throughout the text.

Was just thinking this. This would be especially useful with plagiarism detection.
Post reply on HN