Hacker News Reader

Comment by aqme28 | Hacker News Reader

Out of curiosity: How do you counter document fingerprinting?

If you have the chance to download documents from multiple accounts and IPs, then you can check if the documents are the same bit-for-bit.

If not then you can do some conversion routines, like pdf->(list of images)->merged to a single pdf again, and then you can compare the resulting documents from the different accounts.

Fingerprints can be visible, but not obvious, so printing and scanning back could leave them in.

>If you have the chance to download documents from multiple accounts and IPs, then you can check if the documents are the same bit-for-bit.

Now imagine fingerprinting is done on the fly by your corporate proxy server.

I worked for a company that made a device back in the day. Many engineers had been issued one well before it was announced so that they could develop the software. Each device was carefully labeled with a sticker identifying whose device it was.

A picture of one showed up on a blog as a leak. The leaker had sensibly put a black box over the sticker.

The thing that neither the leaker nor any of the rest of us knew was that each device also had a series of bumps on the top and bottom of the device which uniquely identified it just as effectively as the sticker. He was fired instantly.

In fact the sticker was probably there as a red herring, to give false confidence to the leaker that he had countered the fingerprinting!

I wonder if dazzle patterns[1] on pre-release Xbox Ones had a similar function. If each pattern was unique, you could only hide it by obfuscating most of the device.

[1] http://uk.businessinsider.com/microsoft-xbox-one-leaked-to-a...

I found analog loopholes are the most basic countermeasure to document fingerprinting.

Probably best if you recreate the document from scratch and "in your own words".

That's dangerous as well, because now your language can be analyzed and compared with other writings from you.

Just get hammered [0] before writing.

[0] - or sober, whatever is the opposite of your typical working state

Software like Anonymouth [1] can be used to counter attempts to perform stylometric analysis.

[1]: https://github.com/psal/anonymouth

Then you're sending a fake to the media.

The media will ask if the document is real and the organisation will correctly claim that the document is a fake (because you used your own words).

A lot of these techniques actually make verifying leaked documents very difficult.

In fact some of the faithfully rewritten "facts" may be small fictions designed to identify, couched in the real text. Rewording them still confers the fingerprinted meaning.

Use an automatic document processor written by someone else to paraphrase the text.

I imagine such a program already exists among top-shelf university student cheating service providers to defeat the academic plagiarism detectors.

(If not, write one, and sell it to leak sites and to cheating service providers. $$$)

AKA the "roll your own crypto" strategy.

I fail to see how using an existing tool if it exists, and writing it only if it does not qualifies as "roll your own crypto". Automatic paraphrasing would defeat the writing style analysis suggested by cousin post.

Printing and scanning would defeat fingerprint in the form of invisible Unicode whitespace and combining characters.

Retyping everything would be good.

How about maybe using a computer to extract all non-ASCII characters and output plain text instead of retyping everything?

No. No. NO.

That is only one type of fingerprinting used.

The actual process is inserting typos and slightly different phrasing in various places. So if someone leaks the entire document or copy/pastes from it or takes a picture or whatever, it's trackable.

And yes, I worked in that space for quite a while.

And how do you counter that?

Connect to google translate over tor and get them to translate it french and back again perhaps?

Then your evidence translates into gossip.

This strikes me as a clever idea :)

Some stuff will survive that, like a proper noun that doesn't translate in either direction and is given a characteristic misspelling, possibly combined with other hints. Sentence order will survive too, as well as higher-level structure. There are so many places in a document that is several dozen kilobytes large to hide bits that it probably impossible to ever be sure you've scrubbed them. Especially since it won't take that many bits to identify the source. Hiding the bits doesn't even have to be done via clever textual manipulation; it is a standard part of the intelligence game to make up entire facts with no basis in reality and then see where they leak out, then trace back. No amount of cleverness will save you from that.

The main thing is to realize that a communication may have been crafted to identify its recipient, and to take precautions against that.

There are technologies which are designed to survive print & scan. Specifically microdots[0].

Retyping is pretty good unless they sent everyone a slightly different version of the document or you retyped information which could identify you.

[0] https://en.wikipedia.org/wiki/Printer_steganography

Rewrite the document. Swap around chapters and sections, use your own words, TLDR some sections, remove/replace images, etc.

> use your own words

Not a good idea.

Reply on news.ycombinator.com