Hacker News Reader

Comment by matte_black | Hacker News Reader

Why do people keep bringing up screenshots as some kind of evidence of something that was said? I can easily go into an email, bring up the source code, edit the email body to have some racist tirade, then screenshot the edited email and use that as “evidence” against a person.

View on HN

Nobody is actually doing that. You are confusing evidence against someone versus "I better make a copy of this for myself before it stops working".

Then why not just copy and paste the text....

You'd have to go to some special measure to copy and paste the text because they disable the standard, easy copy/paste functionality.

But taking a photo is always doable. This is a standard argument. If you can't trust the recipient to preserve privacy then there isn't a technological way to defeat this kind of information leak.

You should be able to copy by disabling JavaScript

The typical way to avoid this particular problem is only to load the content via JavaScript while copy/paste are presumed disabled.

What's to stop you from removing the event listeners disabling copy and paste through the console/dev tools?

You could use that CSS rendered font someone made a while ago to make it into an uncopyable text.

This whole argument about copying is rather silly, at some point the text must be transmitted in a human readable form. At which point it can be recorded either electronically, or in the most difficult case by writing down manually what must be copied. Everything else is a question of degrees.

If you happen to be on corporate computer, access to developer tools can be disabled via group policies.

Screenshot to an OCR reader defeats that really quickly.

You can just use a browser dev tool like the chrome inspector to copy the text. I don't know what the big deal is.

The same holds for forwarding or storing email. Both can be forged, but both give some form of preserving email.

Actual authentication is really difficult for anything.

email often has DKIM headers, which are fantastic for non-repudiation

Why? You can rotate your DKIM keys daily and there is nothing that'd prove that you used any particular key at a given time.

To some extend, the fact that gmail accepted a message indicates the email passed DKIM inspection.

Only if it had strict DMARC policy (reject) at the time of sending. But it's not possible to reliably check old values from the past. No policy or quarantine policy makes the email go to spam, that's all.

Gmail stores the DKIM check result in the header of the email.

For a more exhaustive system, one might store a DNSSEC result proving the key was valid. Though from my limited search, it seems DNSSEC does not sign a time-stamp.

> Gmail stores the DKIM check result in the header of the email.

That's an interesting idea. Unfortunately it makes Google a trusted third party. And a printout of that email would be easy to fake.

It would be nice if the report was signed by Google and timestamped (e.g. RFC 3161).

Reply on news.ycombinator.com