Hacker News Reader

Comment by mlissner | Hacker News Reader

My organization built a similar tool that can find bad redactions caused when people just use a black rectangle on top of text in PDFs: https://free.law/projects/x-ray

Very fun project. Lots of problems out there.

View on HN

Seems like even the size of the rectangle would give hints on what it is redacting. For example "Yes" has a bigger box vs "No".

Yes, it's been that way long before PDFs. Simply knowing the potential words, often names, that could appear in a document, gives those with the redacted documents a chance at determining what has been hidden based on size. This might be part of the reason why when declassifying documents, the redactions end up being more of a sentence than is needed. The extra buffer of hidden words gives some additional protection to what needs to be redacted.

This reminds me of one of my proudest moments in high school.

For a test in German class (my worst class), the teacher had just used tippex to remove some words and put them next to the text, and we had to fill them back in. I grabbed my ruler and measured all the sizes. There was 1 very long word, many medium sizes and a few smaller ones, but with this information and the context of the text for the first and last time I was able to get my first and last 10/10 in this class.

A malicious "redacting" algorithm submitted to the underhanded C contest used a similar idea, just on lower level.

PNG allows ASCII numbers, so flipping all digits to 0 creates a pixel which is graphically "masked" but leaks information about the original pixel: "000" means the value was larger than 99.

That’s PPM format, not PNG.

http://underhanded-c.org/_page_id_17.html

http://netpbm.sourceforge.net/doc/ppm.html

Am I the only one who redacts info, prints it out, then scans it back in? Or redacts, then takes a screenshot before sending out?

For some reason I just never trust the PDF tool (or human error on my end) actually redacting the info, even if I were to do a print to PDF.

Nope. That's called rebroadcast. It's also used to try to "launder" photo manipulations, like compositing. I helped work on some algorithms which could pick up artifacts even after rebroadcast.

I would absolutely not trust pdf not to leak metadata. Although now you risk metadata leak from the printer or scanner, which may or may not affect your threat model.

Careful what printer you use to print it out, some of them add patterns of dots that can uniquely identify the print: https://en.wikipedia.org/wiki/Machine_Identification_Code

When a coworker asked me for my recommended method of creating and publicly sharing redacted copies of documents which (in their unredacted forms) contained PII for children, I told them to do this, in no uncertain terms.

> Am I the only one who redacts info, prints it out, then scans it back in?

if you have the source document, redacting from the source (by actually removing and replacing with an appropriate placeholder, not obscuring, the content) and regenerate the static (e.g., PDF) version.

If you are working from print, I think scan and redact by digital replacement (not overlay or otherwise obscure) would be sufficient. Redact->print->scan probably helps somewhat (especially if the scan is low quality) if you are using a bad redaction method to start with, but why do that?

I do same, except scanning, why not just print it to PDF?

Because some tools might still put a text-layer under the printed so you can select text and copy.

Not if there is a rasterization step in the process. That's essentially what printing and scanning achieves, rasterization, and we can do that without the printer and scanner.

Of course, the artifacts introduced by printing and scanning (especially with contrast turned way up) gives it an air of legitimacy, although these can also be simulated.

If you print to paper and scan you are mostly safe, but if you do a software print to a pdf document you might use a tool that saves the actual content as invisible text or the whole word document as an attachment to the pdf. I would print and scan physically if it was something important. Or just edit the word document to remove the stuff and then print and scan to avoid saving the edit history since I don't know if that will be saved somewhere.

Usually I'm in full control of the software myself so I just output X instead of the secret data.

> I would print and scan physically

This degrades quality and wastes paper and toner. There are software tools to convert PDF to raster graphics.

Interesting. They have the right idea (using a black rectangle) but in the wrong program. I can see how this could trip up non-technical people.

On MacOS, preview makes a clear distinction between 'drawing on' and 'redacting' PDFs. It is an important part of UX that shooting yourself in the foot should _not_ be the default.

That's why you always Print to PDF the document and not just save it, I'm amazed people save documents instead printing them.

You're amazed that people use the conventional "save" method instead of a weird option in the print menu?

If they go lengths to protect some information, then yes I'm amazed they forget about such simple precaution.

Wanting to redact information is not a subset of PDF knowledge. Understanding how PDFs work is not a prerequisite of desire to redact information. Lots of people have only the most basic rudimentary understand of how PDFs work, how Adobe works, and the limits or capabilities.

A lot of people don't even know you can print to a file instead of paper. Not sure why you're surprised about that, after all the standard method for all formats is "save as" or "export" and it's reasonable to assume those two options include all possible ways to save a file. It's a UI quirk that goes against user expectations.

Doesn't help if the output type is wrong.

Recently discovered a manual forr some home appliance with a clear Word comment along with username, seems like slipped in when the manual was translated.

Reply on news.ycombinator.com