Hacker News Reader

Comment by mmastrac | Hacker News Reader

Is Google using some subtle permutation on every version of the email sent out?

All it would take would be swapping "--" for "...", "ie"/"i.e."/"eg"/"e.g." You should probably compare your local copy of an email with someone else before leaking it!

View on HN

"Hey Bob, I'm thinking about leaking my email... can I diff it with yours?"

The other problem I can see is that there's only 5 or 6 of those points, which would be enough to narrow down the leaker, but not ID them outright. Probably easier (if more evil) to check all the outgoing mail in gmail.

You can also use trailing spaces. I have done this on the past successfully

But when it's actually leaked and posted, it'll most definitely be trimmed.

You could use a pattern of one or two spaces after each sentence. Encode an id in that. If text is copy and pasted and not processed with a s/ / /g, that most likely won't be detected by the copy-and-paster (especially when it's all done in a variable width font).

Looks like HN does remove double spaces, what I meant was obviously s/[space][space]/[space]/g :)

It's not HN, it's a feature of HTML. All whitespace characters (including tabs and newlines) are condensed to a single space, and leading/trailing spaces are removed. So if you have a habit of double-spacing after sentences, HTML simply ignores you, unless you use <pre> or  .

Ah didn't know that. Well that would make the single/double space encoding of an id much harder.

Actually, it makes it more effective if anything. The browser displays it as a single whitespace, but the source isn't altered, (and therefore easily checkable).

Yeah but if a user copy/pastes it from his email client into his blog posting system, the double spaces are stripped, too (I checked it with Firefox, maybe other browsers work differently). It would only work I think if the single/doubles space pattern was preserved across copy/paste operations.

Or worse, the INcoming mail in gmail.

What is evil about checking corporate mail for corporate mail leaks?

i doubt it's that complicated, they have full control of the mailservers, I bet the person just didn't think leaking the information was that big of a deal.

Or, you know, run a giant grep on every mail sent to or from Gmail and internal mail over the last 12 hours...

I doubt there are 23,300 possible permutations. Moreover, I doubt a Googler wouldn't think of this classic before leaking his e-mail. Any other theory? Perhaps no one was fired and it's just link bait?

I heard from a Googler before the article came out that the leaker was fired. While one could imagine a second, as-yet unleaked email about the fake firing, isn't it much simpler just to assume that the leaker was fired?

Most likely somebody just forwarded it to their favorite blog, especially if they didn't think the email was confidential. Pretty easy to track outgoing email.

With "CONFIDENTIAL: INTERNAL ONLY GOOGLERS ONLY (FULL TIME AND PART TIME EMPLOYEES)" at the top it's hard to believe they might have thought it wasn't confidential.

Assuming a worst case of two possibilities for each difference, that comes out as ceil(log_2(23300)) = 15 differences necessary. You could easily get that by swapping out words for synonyms (especially if you use more than two synonyms per difference).

Don't forget unicode homoglyphs, as well.

And even if a journalist trimmed whitespace when formatting for publication, they might not have if forwarding back to a Google rep 'for comment'.

You'd need over 14 binary manipulation choices, but only about 9 if you had a choice of three. If you include word synonyms in the choices, with over 250 words in the memo, I don't think it's unreasonable.

How about summarizing a memo instead of copypasta? Then they'd have to diff the facts to mess you up.

A good news source, if there are any left, probably won't run a story based solely on an anonymous tip.

Well, what if the news source only published a summary, and not the original?

That's not journalism.

OK, it may be today's journalism, but who trusts news sources like that?

With 23,000 employee's that's alot of permutations for a 3 paragraph email.

Reply on news.ycombinator.com