Hacker News Reader

Comment by buro9 | Hacker News Reader

Interesting is how to defend against this.

If you are a journalist wishing to protect your source, what tool could be used to process content such that the essence is left intact but the unicode zero-width steganography is stripped... replaced instead by the common space character.

I know enough to say that you cannot just search and replace, as many of the zero-width characters have a meaning in different languages and produce a visual effect when combined with other runes. Just stripping them all will break text in those languages.

Is there a method for removing zero-width whitespace such that journalist sources could be protected?

View on HN

The safest thing is to retype it. But that doesn’t cover the risk of synonym/frequency fingerprinting discussed elsewhere in this thread.

What if you also did a random synonym replacement throughout the piece to destroy the watermarking? If the source is anonymous and hidden, then authenticity cannot be checked by the reader anyway, and so replacement without changing meaning is an acceptable change to protect sources.

Welcome to the new age of computer-powered math where anonymity is not a guarantee.

Plenty of discussions in this thread show why. Anonymous screenshot or picture? Image watermarks -> anything from subtle color changes, to sans/serif font changes, to word replacement. Anonymous text or summary? Word replacement, letter biasing encoding, etc. Anonymous audio? Inaudible frequencies, audible waveform deformation encoding, etc.

Nothing's out of the realm of possibility for the paranoid.

You would have to change every word, since any could be a waterprinted synonym. A better way would be to read it, make a summary, then rewrite it from memory and only use the source data to correct factual differences.

You wouldn't necessarily have to change every word; just enough to break the decoding scheme. But even then it's totally random, so the longer the document, the more opportunities to be fingerprinted. It's like the old saying goes, "the police only need to be lucky once, but the criminals need to be lucky all the time." [0]

[0] I never bothered looking up where this came from until just now... interestingly it's from the IRA, and used in the total opposite way most people use it now... https://en.wikipedia.org/wiki/Brighton_hotel_bombing

Your saying illustrates what I'm saying perfectly: if you miss even a single fingerprinted word, it might uniquely identify you. So you need to change every single word, and even that isn't enough in case eg. adjectives were added or omitted.

So paraphrase it.

In my article that Tom[0] links to I mentioned a number or methods, but you may be interested in a followup piece I wrote as well:

https://www.zachaysan.com/writing/2018-01-01-fingerprinting-...

Essentially the best method against these fingerprinting techniques isn't technical—it's just not re-sharing the contents in the first place. Sorry, small differences are just too easy to embed and there are so many bits to work with.

[0] Thanks Tom, you the man!

Print it and use OCR?

Years ago I worked on some software that would adjust the kerning on text slightly to embed the name of the user who printed the document.

Kerning probably doesn't survive OCR though.

You can still embed a person's name by replacing words in the text by synonyms.

Reply on news.ycombinator.com