Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Be careful what you copy: Invisibly inserting usernames into text

medium.com

Post reply on HN
Print view View original

81–90 of 200 posts

Re: Be careful what you copy: Invisibly inserting usernames into text

#81

Post by Fnoord »

lagadu wrote: post #55
sillysaurus3 wrote: post #52

Earlier quoted context omitted.

Could you talk more about why this was useful for Eve? What's an example of how you could blame innocent folks? And how could you sign the inserted data – do you mean cryptographically?

Spying is a big problem in Eve. At the most basic level a spy is able to take screenshots and copy/paste text to send back to the entity they're spying for. By watermarking both text and forum backgrounds the data effectively becomes tainted in the sense that the screenshot/text will have unique characteristics that allow the original poster to identify who copied the data in the first place. The whole flow would be:…

Screenshots made in World of Warcraft contain a watermark which contains the account number of the player, as well as other info [1] [2]. This is used to find/combat cheaters (e.g. botters).

As for spying, I'm pretty sure this is a problem in high end raiding in WoW. But due to the nature of WoW (not being a king of the hill MMO to rule land) not nearly as much as EVE. Blizzard uses it to combat cheating.

[1] http://www.tomshardware.com/news/watermark-screenshots-World...

[2] https://eric-diehl.com/world-of-warcraft-and-watermarking/

Re: Be careful what you copy: Invisibly inserting usernames into text

#82

Post by chatmasta »

etatoby wrote: post #54

This sort of thing is one of the reasons I never liked the "noise texture" that appeared on MacOS X and other GUIs and websites not so long ago. I always thought my (former) OS was fingerprinting every screenshot I made. I'd love to be proven wrong, but you are never too careful.

This reminds me of a few years back when the internet identified a parody twitter account by analyzing iOS screenshots it posted.

I just tried googling for the story but I can’t remember what the account was about. I think it was some sort of parody silicon valley account. It was a great story, if anyone remembers and can find the link.

Re: Be careful what you copy: Invisibly inserting usernames into text

#83

Post by adrianN »

tonyedgecombe wrote: post #77
adrianN wrote: post #75

Earlier quoted context omitted.

Print it and use OCR?

Years ago I worked on some software that would adjust the kerning on text slightly to embed the name of the user who printed the document.

Kerning probably doesn't survive OCR though.

Re: Be careful what you copy: Invisibly inserting usernames into text

#84

Post by [deleted] »

nzpopa wrote: post #57
zbobet2012 wrote: post #9

I did this (non-publicly) many years ago for my eve online alliance. A substantial problem exists in that forging the identity of _someone else_ is fairly easy in a naive scheme if someone detects these characters. That means you can sow chaos by blaming innocent folks. In practice you'll want to "sign" the inserted data as well. Also because of the overhead here and the fact that you will want the signature to occur…

What about fingerprinting a photographed text? I'm thinking that by encoding the hidden message to bits and representing them in spaces around some arbitrary anchor keywords from the original text might work. Extracting the message then requires either OCR, either manual work(counting spaces).

[deleted]

Re: Be careful what you copy: Invisibly inserting usernames into text

#85

Post by nzpopa »

Mashimo wrote: post #69
nzpopa wrote: post #57

Earlier quoted context omitted.

What about fingerprinting a photographed text? I'm thinking that by encoding the hidden message to bits and representing them in spaces around some arbitrary anchor keywords from the original text might work. Extracting the message then requires either OCR, either manual work(counting spaces).

Has been done, see my comment above. http://failheap-challenge.com/showthread.php?12731-Once-upon... The images are 404, but they used a background with slightly different color and something similar to a QR code.

The background trick is cool, but what happens if the user removes it entirely? Lexical Steganography might be a more suitable approach: http://web.mit.edu/keithw/tlex/

Re: Be careful what you copy: Invisibly inserting usernames into text

#88

Post by Mashimo »

nzpopa wrote: post #85
Mashimo wrote: post #69

Earlier quoted context omitted.

Has been done, see my comment above. http://failheap-challenge.com/showthread.php?12731-Once-upon... The images are 404, but they used a background with slightly different color and something similar to a QR code.

The background trick is cool, but what happens if the user removes it entirely? Lexical Steganography might be a more suitable approach: http://web.mit.edu/keithw/tlex/

Just skimmed it, but is that not close to method #2 the same Alliance used: http://failheap-challenge.com/showthread.php?16311-Taking-th...

Re: Be careful what you copy: Invisibly inserting usernames into text

#89

Post by userbinator »

joosters wrote: post #62
feelin_googley wrote: post #33

Zero-width characters are invisible, `non-printing' characters that are not displayed by the majority of applications. F*or exam*ple, I've ins*erted 10 ze*ro-width spa*ces in*to thi*s sentence, c*an you tel**l? (Hint: paste the sentence into Diff Checker to see the locations of the characters!). These characters can be used to `fingerprint' text for certain users. Above is what paragraph looks like in text-only brows…

That's just because the browser doesn't handle unicode well. The 'text-only', 'VGA' and 'textmode' are actually irrelevant. The behaviour you are seeing is down to programmer choice/laziness/missing support.

If you're only expecting ASCII text, then not being able to show anything else could even be considered a feature to reduce attack area, since any sort of Unicode trickery then becomes impossible.

Re: Be careful what you copy: Invisibly inserting usernames into text

#90

Post by chii »

sshagent wrote: post #71
zbobet2012 wrote: post #9

I did this (non-publicly) many years ago for my eve online alliance. A substantial problem exists in that forging the identity of _someone else_ is fairly easy in a naive scheme if someone detects these characters. That means you can sow chaos by blaming innocent folks. In practice you'll want to "sign" the inserted data as well. Also because of the overhead here and the fact that you will want the signature to occur…

I miss Eve so much, there isn't a mention of Eve on this site that doesn't get me pining for the game again. Sadly everyone i flew with no longer play :/ What the status of the game, last i looked i barely recognised any on the sov/influence map.

I think they were bleeding subscribers for a while, and had to go to a form of limited free-to-play to keep the numbers up. I m a bit sad that the EVE legacy is eventually going to end, since i think the game is still the most unique MMO out there.

But i don't feel the game has the same dynamic as it had in 2008-2010. But i also quit at that time too, so who knows...

Post reply on HN