Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New information extracted from Snowden PDFs through metadata version analysis

libroot.org

Post reply on HN
Print view View original

81–90 of 139 posts

Re: New information extracted from Snowden PDFs through metadata version analysis

#81

Post by emptybits »

cookiengineer wrote: post #37
password4321 wrote: post #16

The "print and scan physical papers back to a PDF of images" technique for final release is looking better and better from an information protection perspective.

> The "print and scan physical papers back to a PDF of images" technique for final release is looking better and better from an information protection perspective. Note that all (edit: color-/ink-) printers have "invisible to the human eye" yellow dotcodes, which contain their serial number, and in some cases even the public IP address when they've already connected to the internet (looking at you, HP and Canon). So…

Thanks for the links but can you share evidence for the "public IP address" claim? Each time I've read this concept (intriguing! possible!), I search for evidence and I can't find any.

The MIC and yellow dots have been studied and decoded by many and all I've ever seen, including at your links, are essentially date + time + serial#.

Don't get me wrong ... stamping our documents with a fingerprint back to our printers and adding date and time is nasty enough. I don't see a need to overstate the scope of what is shared though.

Re: New information extracted from Snowden PDFs through metadata version analysis

#82

Post by yyyk »

jeffbee wrote: post #49
tester756 wrote: post #38

Earlier quoted context omitted.

Why not just make screenshoot of every PDF page?

It could still be identifiable, for example if the document has been prepared such that the intended recipient's identity is encoded into subtle modulation of the widths of spaces.

That's outside this threat model? The idea here is trying to foil outside analysis, not limit the document authors (which are allowed to add/update and even write openly 'the intended recipient's identity').

Re: New information extracted from Snowden PDFs through metadata version analysis

#83

Post by IshKebab »

everdrive wrote: post #41
cookiengineer wrote: post #37

Earlier quoted context omitted.

> The "print and scan physical papers back to a PDF of images" technique for final release is looking better and better from an information protection perspective. Note that all (edit: color-/ink-) printers have "invisible to the human eye" yellow dotcodes, which contain their serial number, and in some cases even the public IP address when they've already connected to the internet (looking at you, HP and Canon). So…

>Note that all printers have "invisible to the human eye" yellow dotcodes, which contain their serial number, and in some cases even the public IP address when they've already connected to the internet (looking at you, HP and Canon). I've got a black and white brother printer which uses toner. Is there something similar for this printer?

Yes, the data can be embedded by modulating the laser.

But I've only seen research showing that it's possible. As far as I know nobody has demonstrated whether actual laser printers use that technique or not.

Re: New information extracted from Snowden PDFs through metadata version analysis

#84

Post by IshKebab »

dredmorbius wrote: post #79
JumpinJack_Cash wrote: post #59

Earlier quoted context omitted.

Is there a multifunction B&W printer which prints and then automatically positions the paper on the scanner and scans?

Far more straightforward to print a stack, then feed that stack through the copier/scanner.

You don't need to actually print and scan. Just convert to a raster format like PNG.

Re: New information extracted from Snowden PDFs through metadata version analysis

#85

Post by maximilianthe1 »

emeril wrote: post #55
password4321 wrote: post #16

The "print and scan physical papers back to a PDF of images" technique for final release is looking better and better from an information protection perspective.

I suppose I'd just save the pdf to tiff/png then remake back into a pdf from there to avoid printing and scanning? if really paranoid, I suppose one could run a filter on the image files to make them a bit fuzzy/noisy

I think "Print to PDF" would be easiest

Re: New information extracted from Snowden PDFs through metadata version analysis

#86

Post by formerly_proven »

cubefox wrote: post #72
mattzito wrote: post #70

Earlier quoted context omitted.

No, if you are going to change the structure of a structured document that has been saved to disk, your options are: 1) Rewrite the file to disk 2) Append the new data/metadata to the end of the existing file I suppose you could pre-pad documents with empty blocks and then go modify those in situ by binary editing the file, but that sounds like a nightmare.

Aren't there file systems that support data structures which allow editing just part of the data, like linked lists?

No. Well yes. On mainframes.

This is why “table of contents at the end” is such an exceedingly common design choice.

Re: New information extracted from Snowden PDFs through metadata version analysis

#87

Post by DANmode »

libroot wrote: post #31
londons_explore wrote: post #17

So this is almost certainly redaction by the journalists? It is disappointing they didn't mark those sections "redacted", with an explanation of why. It is also disappointing they didn't have enough technical knowhow to at least take a screenshot and publish that rather than the original PDF which presumably still contains all kinds of info in the metadata.

Yes, the journalists did the redactions. The metadata timestamps in one of the documents show that the versions were created three weeks before the publication. And to be honest, the journalists generally have done a great work on pretty much in all the other published PDFs. We've went through hundreds and hundreds of the published documents, and these two documents were pretty much the only ones which had metadata l…

Great work, great comment.

Thank you.

Re: New information extracted from Snowden PDFs through metadata version analysis

#88

Post by culi »

cookiengineer wrote: post #37
password4321 wrote: post #16

The "print and scan physical papers back to a PDF of images" technique for final release is looking better and better from an information protection perspective.

> The "print and scan physical papers back to a PDF of images" technique for final release is looking better and better from an information protection perspective. Note that all (edit: color-/ink-) printers have "invisible to the human eye" yellow dotcodes, which contain their serial number, and in some cases even the public IP address when they've already connected to the internet (looking at you, HP and Canon). So…

That's why I'm (still) waiting on this https://www.crowdsupply.com/open-tools/open-printer

It's mindboggling how much open-source 3d printing stuff is out there (and I'm grateful for it) but this is completely lacking in the 2d printing world

Re: New information extracted from Snowden PDFs through metadata version analysis

#89

Post by nacozarina »

echelon wrote: post #69
c-c-c-c-c wrote: post #51

> We contacted Ryan Gallagher, the journalist who led both investigations, to ask about the editorial decision to remove these sections. After more than a week, we have not received a response. Hopefully we'll hear something now that the Christmas holidays are over.

Why are the journalists redacting the docs? That's incredibly puzzling. Is there something in here so damaging that they refuse to publish it? Did the government tell them they'd be in trouble if they published it? Are the journalists the only ones with access to the raw files?

Traditionally an editor would be obligated to review the material and redact info that could be harmful to others. The publisher has distinct liability independent of govt opinion.

Re: New information extracted from Snowden PDFs through metadata version analysis

#90

Post by culi »

mmh0000 wrote: post #78
cookiengineer wrote: post #37

Earlier quoted context omitted.

> The "print and scan physical papers back to a PDF of images" technique for final release is looking better and better from an information protection perspective. Note that all (edit: color-/ink-) printers have "invisible to the human eye" yellow dotcodes, which contain their serial number, and in some cases even the public IP address when they've already connected to the internet (looking at you, HP and Canon). So…

If you have a UV flashlight, these dots are visible with decent vision. And of course we have to include the Wikipedia entry: https://en.wikipedia.org/wiki/Printer_tracking_dots

And also EFF's attempt to track all printers that do or do not display tracking dots which they eventually prepended with

> (Added 2015) Some of the documents that we previously received through FOIA suggested that all major manufacturers of color laser printers entered a secret agreement with governments to ensure that the output of those printers is forensically traceable.

> This list is no longer being updated.

https://www.eff.org/pages/list-printers-which-do-or-do-not-d...

Post reply on HN