Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

paultendo.github.io

Post reply on HN
Print view View original

51–60 of 60 posts

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#51

Post by roywiggins »

doctorpangloss wrote: post #6

well, you didn't really do anything, did you? Claude Code rendered these things and wrote the blog post haha > "This is not theoretical. It is a measured property of the font files shipping on every Mac." some patterns of speech are so recognizably LLM, i am convinced that the AI detection startups have a very strong chance to succeed on text.

I don't know how people read this sort of LLM output without their eyes glazing over and tuning it out. Every blog post authored or substantially edited by Claude sounds the same sort of vaguely pompous and stilted, surely people are bored of it by now? But apparently not.

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#52

Post by sigwinch »

jonhohle wrote: post #46

About 20 years ago I used Cyrillic confusables to watermark internal documentation that was being leaked by a disgruntled customer service employee. The document would dynamically render and include the employee ID based encoded as bits in the text. It survived copy/paste to plain text well. I did run into some issues in early versions on when characters in Linux commands or visible web addresses were replaced. Fortu…

We did this with variations of white space characters.

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#53

Post by bawolff »

That's super interesting, but at the same time, i think the primary concern is not if they are literally the same but if a user is likely to confuse them in a small font you dont have control over in a place they are not likely to pay attention to (e.g. addeess bar).

Like even if the two characters look quite different, if they both look like the same letter in different fonts that is a problem. It doesn't mattter if you can tell the difference between the glyphs in a side by side comparision. What matters is what letter the user interprets the glyph as.

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#54

Post by keeda »

I'm not an expert, I've just been "vibe-R&D"-ing computer vision for a bit now, but I'll guarantee you SSIM is not suitable for this purpose. I've been dabbling in basically this area (comparing small, potentially low-resolution images) and SSIM produces a lot of false negatives and some false positives.

I would recommend template matching using normalized cross-correlation (TM_CCOEFF_NORMED in opencv.)

Also this paper from Nvidia critically scrutinizing SSIM may be relevant: https://research.nvidia.com/publication/2020-07_Understandin...

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#55

Post by keeda »

nnevatie wrote: post #43

Hmm, is SSIM a good metric for comparing fonts? I'd imagine it isn't ideal, as fonts are mostly textureless and SSIM has no concept of glyph identity or typographic intent.

You're right, it's not. I just posted this comment: https://news.ycombinator.com/item?id=47182655

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#56

Post by q0uaur »

lallysingh wrote: post #50

I think we'll have to start configuring our client tools (e.g. browser, email client, etc) to render domain names with annotations for different character classes. E.g. our native character set is a standard color (blue/black) and then other character sets would have to stand out (purple background?).

i'm pretty sure Mox (email server with included webui written in Go) does that - at least the Umlauts in mails i get from Hetzner seem to always stand out.

it also defaults to not loading HTML in emails, which i love. really opened my eyes to how dumb it really is to just accept all kinds of dynamic content in unknown messages. (kinda same as how the modern web relies on remote code execution to work)

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#57

Post by schiffern »

Terr_ wrote: post #26
vivid242 wrote: post #23

Thanks for the effort! I'm always intrigued by the German FE-Schrift ("fälschungserschwerende Schrift", "more-difficult-to-forge font") chooses shapes for characters that makes it hard for them to be turned into one another (like a 3 into an 8 or so): https://en.wikipedia.org/wiki/FE-Schrift

As a youth in the DOS era, I was always enamored of fonts like OCR-A, there is some overlap between the problems of "make it easy to distinguish" and "make it hard to maliciously corrupt", although I can imagine some cases where they might be in conflict, especially if adding ink is asymmetrically easier than removing or covering it. https://en.wikipedia.org/wiki/OCR-A

See also: Chinese banking (anti-fraud) numerals.

https://en.wikipedia.org/wiki/Chinese_numerals#Financial_num...

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#58

Post by LorenPechtel »

apothegm wrote: post #2

Maybe not at super large font sizes. But even lowercase i and l are easy enough to confuse at a glance mid-word in most sans-serif fonts, not to mention uppercase I and lowercase l. You don’t even need “confusable” glyphs to create a domain name that will stand up to a casual visual confirmation from a busy user in a phishing context.

I recently spent way too much time on a bug that only showed up in a large data set. (Turned out a walker had a problem with certain leaf patterns.) Put a trap on a string that looked unique--even after I had actually found the problem and fixed it it still couldn't find the offending text. Sans serif, l vs I.

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#59

Post by Bratmon »

hinkley wrote: post #4
apothegm wrote: post #2

Maybe not at super large font sizes. But even lowercase i and l are easy enough to confuse at a glance mid-word in most sans-serif fonts, not to mention uppercase I and lowercase l. You don’t even need “confusable” glyphs to create a domain name that will stand up to a casual visual confirmation from a busy user in a phishing context.

Every Albert, Alfred, or Alphonso who goes by “Al” getting confused with bots right now…

Fun fact: Weird Al has spent the last 2 years finding comments on videos of his songs that say "Is this AI-generated?" and responding "It's Al-generated!"

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#60

Post by apothegm »

LorenPechtel wrote: post #58
apothegm wrote: post #2

Maybe not at super large font sizes. But even lowercase i and l are easy enough to confuse at a glance mid-word in most sans-serif fonts, not to mention uppercase I and lowercase l. You don’t even need “confusable” glyphs to create a domain name that will stand up to a casual visual confirmation from a busy user in a phishing context.

I recently spent way too much time on a bug that only showed up in a large data set. (Turned out a walker had a problem with certain leaf patterns.) Put a trap on a string that looked unique--even after I had actually found the problem and fixed it it still couldn't find the offending text. Sans serif, l vs I.

Relatable!
Post reply on HN