New information extracted from Snowden PDFs through metadata version analysis • Hacker News Board

Re: New information extracted from Snowden PDFs through metadata version analysis

#41

Post by everdrive » Sat, Jan 10, 2026, 4:07 PM UTC

cookiengineer wrote: post #37

password4321 wrote: post #16

The "print and scan physical papers back to a PDF of images" technique for final release is looking better and better from an information protection perspective.

> The "print and scan physical papers back to a PDF of images" technique for final release is looking better and better from an information protection perspective. Note that all (edit: color-/ink-) printers have "invisible to the human eye" yellow dotcodes, which contain their serial number, and in some cases even the public IP address when they've already connected to the internet (looking at you, HP and Canon). So…

>Note that all printers have "invisible to the human eye" yellow dotcodes, which contain their serial number, and in some cases even the public IP address when they've already connected to the internet (looking at you, HP and Canon).

I've got a black and white brother printer which uses toner. Is there something similar for this printer?

Re: New information extracted from Snowden PDFs through metadata version analysis

#42

Post by soared » Sat, Jan 10, 2026, 4:09 PM UTC

alhirzel wrote: post #3

There needs to be better tooling for inspecting PDF documents. Right now, my needs are met by using `qpdf` to export QDF [1], but it is just begging for a GUI to wrap around it... [1] https://qpdf.readthedocs.io/en/stable/qdf.html

In what contest do you use that tool? Looks like that page is primarily about editing pdfs using that format rather than inspecting.

Very tempting to fool around with the ideas especially after the Epstein pdf debacle.

Re: New information extracted from Snowden PDFs through metadata version analysis

#43

Post by jfengel » Sat, Jan 10, 2026, 4:10 PM UTC

anticodon wrote: post #34

dfreel wrote: post #21

Earlier quoted context omitted.

[flagged]

What Russia and China has in common? Why would somebody work for both countries? Do you know, for example, that China willingly sells huge amounts of drones to Ukraine?

Here in 2026 China is supplying Russia with weapons in exchange for oil under global sanctions.

Russia is in no position to reject China for selling to both sides. They may not be allies but each is the enemy of their enemies.

Re: New information extracted from Snowden PDFs through metadata version analysis

#44

Post by plagiarist » Sat, Jan 10, 2026, 4:10 PM UTC

dfreel wrote: post #20

Andrex wrote: post #14

Earlier quoted context omitted.

The best way to fix a problem is to bring it into the light, not pretend it doesn't exist. "Security by obscurity" has been debunked for decades. If our system is so flawed Snowden's leaks would have blown everything up, maybe the system deserves to be blown up. Otherwise we're just papering over flaws which likely will be discovered and exploited eventually.

[flagged]

There is a non-zero number of documents that are classified as Top Secret not for national security but because corrupt shitheads are in control of classifying documents.

Re: New information extracted from Snowden PDFs through metadata version analysis

#45

Post by paulryanrogers » Sat, Jan 10, 2026, 4:11 PM UTC

dfreel wrote: post #28

jibal wrote: post #26

Earlier quoted context omitted.

Your comment is indeed very telling. He ended up in Russia because the U.S. revoked his visa while en route to Ecuador so he was forced to live in a Russian airport for 6 weeks.

[flagged]

> One can join the dots and have a good idea of exactly what was the purpose of doing this.

The purpose was to avoid rendition to and torture within black sites of ambiguous jurisdiction.

If classified material is so precious then why not lock up the guy who showed off and stored stolen classified material in his golf course bathroom?

Re: New information extracted from Snowden PDFs through metadata version analysis

#46

Post by clord » Sat, Jan 10, 2026, 4:16 PM UTC

pfisherman wrote: post #24

aidos wrote: post #6

Earlier quoted context omitted.

You can replace objects in PDF documents. A PDF is mostly just a bunch of objects of different types so the readers know what to do with them. Each object has a numbered ID. I recommend mutool for decompressing the PDF so you can read it in a text editor: mutool clean -d in.pdf out.pdf If you look below you can see a Pages list (1 0 obj) that references (2 0 R) a Page (2 0 obj). 1 0 obj > endobj 2 0 obj > endobj Rath…

Thanks for the technical explanation! This is pretty fascinating. So it works kind of like a soft delete — dereference instead of scrubbing the bits. Is this behavior generally explicitly defined in PDF editors (i.e. an intended feature)? Is it defined in some standard or set of best practices? Or is it a hack (or half baked feature) someone implemented years ago that has just kind of stuck around and propagated?

The intention is to make editing easy and quick on slow and memory deficient computers. This is how for example editing a pdf with form field values can be so fast. It’s just appending new values for those nodes. If you need to omit edits you’d have to regenerate a fresh pdf from the root.

Re: New information extracted from Snowden PDFs through metadata version analysis

#47

Post by gramie » Sat, Jan 10, 2026, 4:17 PM UTC

everdrive wrote: post #41

cookiengineer wrote: post #37

Earlier quoted context omitted.

> The "print and scan physical papers back to a PDF of images" technique for final release is looking better and better from an information protection perspective. Note that all (edit: color-/ink-) printers have "invisible to the human eye" yellow dotcodes, which contain their serial number, and in some cases even the public IP address when they've already connected to the internet (looking at you, HP and Canon). So…

>Note that all printers have "invisible to the human eye" yellow dotcodes, which contain their serial number, and in some cases even the public IP address when they've already connected to the internet (looking at you, HP and Canon). I've got a black and white brother printer which uses toner. Is there something similar for this printer?

I believe that this only exists for colour printers. The official reasoning was to trace people counterfeiting money.

Re: New information extracted from Snowden PDFs through metadata version analysis

#48

Post by sroussey » Sat, Jan 10, 2026, 4:18 PM UTC

dfreel wrote: post #20

Andrex wrote: post #14

Earlier quoted context omitted.

The best way to fix a problem is to bring it into the light, not pretend it doesn't exist. "Security by obscurity" has been debunked for decades. If our system is so flawed Snowden's leaks would have blown everything up, maybe the system deserves to be blown up. Otherwise we're just papering over flaws which likely will be discovered and exploited eventually.

[flagged]

I call BS. The Snowden files completely rewrote the rules of security inside Google and everywhere and led to zero-trust. These companies are now protected against this unlawful hacking of the government on their local companies and thus also better protected from governments around the world. Ironically, the leaks made the US more secure.

Re: New information extracted from Snowden PDFs through metadata version analysis

#49

Post by jeffbee » Sat, Jan 10, 2026, 4:18 PM UTC

tester756 wrote: post #38

password4321 wrote: post #16

The "print and scan physical papers back to a PDF of images" technique for final release is looking better and better from an information protection perspective.

Why not just make screenshoot of every PDF page?

It could still be identifiable, for example if the document has been prepared such that the intended recipient's identity is encoded into subtle modulation of the widths of spaces.

Re: New information extracted from Snowden PDFs through metadata version analysis

#50

Post by layer8 » Sat, Jan 10, 2026, 4:18 PM UTC

These PDFs apparently used the “incremental update” feature of PDF, where edits to the document are merely appended to the original file.

It’s easy to extract the earlier versions, for example with a plain text editor. Just search for lines starting with “%%EOF”, and truncate the file after that line. Voila, the resulting file is the respective earlier PDF version.

(One exception is the first %%EOF in a so-called linearized PDF, which marks a pseudo-revision that is only there for technical reasons and isn’t a valid PDF file by itself.)