Embedding information in text documents using glyph perturbation (2018) [pdf] | Hacker News Reader

Embedding information in text documents using glyph perturbation (2018) [pdf]

dl.acm.org

56 pointsepilys25 comments

Take the letters "a" from the page 3, top right, and combine all them in your Gimp [0]. It's amazing how it's hard to distinguish those letters without the help of some tool.

I always thought about it when some people question, for example, the secrecy of the vote. When you're given the ballot, there's no way to know if all them are the same or if each one has some codified information without extensive audit. Even scanning all the ballots will introduce small imperfections that will make it hard to audit everything.

[0] Letters 0 and 1, letters 2 and 3: https://imgur.com/a/9v5W7Ib

In France when I voted with papers, the ballots were in stacks and you picked the ballots then went to an isoloir(doesn't know the English word sorry) to fill your envelope: they weren't given to you. So this wouldn't work.

Voting booth, I believe. That's indeed really a good idea that one can readily implement without a huge cost. Was there any incident that prompted such a voting protocol?

If there was one, I'm not aware, sorry. It may just be an easy way to handle the 'distribution' of ballots. Obviously they gave you the envelope.

Unfortunately now they use electronic voting, a clear regression for transparency :-(

I'm not sure to get your reply right, but just in case: we don't vote electronically in France. Some companies are lobbying for it, of course, but they propose "solutions" for a non-existing issue.

Some very few cases of fraud are spotted but that is rather a good sign, imo. It means that the process is scrutinized and there will always be people dumb enough to think they are more clever.

The voting booth was historically a way to ensure that one individual is voting in total freedom. So only one person is allowed is the booth (except young children so parents can vote). So the husband can not tell his wife how to vote.

The law forces you to take at least 3 bulletins (or 4 maybe, I'd have to check) among all the candidates, and you are invited to take one of each.

At the second round, you must take one bulletin of each finalist. Well, at least in the presidential election. For the House, there may be more than two finalists, since the threshold to access the final stage is at 12.5% of the votes. So 3 or 4 finalists are common. There again, you have to take several bulletins before going into the booth.

All the political parties are invited to send a scrutinizer to the votes' counting process, and common voters are asked randomly to participate if they want to. Anyone can ask to witness the process (without being part of the process of counting). Very few do in practice, but I like seeing parents showing their children how democracy works.

The only but very real drawback to the paper process: the cost. Not to the State: the candidates are supposed to provide themselves the bulletins, meeting super specific criteria: exact size, font, colors, as well as a specific weight per bulletin (with a small margin of error). That costs a lot of money for a small party to provide enough bulletins. If your new hence still small party can hope for 10% of the votes... you need in theory to provide at least one bulletin for each voter, since they must in all cases take several as mentioned.

At a national scale, this amounts easily to $500 000, with all the deliveries etc.

So the larger parties are not at all inclined to make the vote electronic: it would make things too easy for spring-ups parties too compete. But if the State pays for it, there will probably be 30 candidates in the House elections rather than 5 to 10.

French traditionally vote in a much larger proportion than Americans. It used to be the case anyway, since the abstention is growing in France and decreasing in the US. Almost 74% of people on the electoral lists voted for the first round of the presidential election ten days ago. Which is a low rate by the French standards. It used to be far beyond 80%. Bad sign for our democracy, with a far-right candidate among the finalists and the other... Well, opinions vary greatly about Macron.

Note that there is absolutely no barrier to the inscription as a voter. It is super easy. So no racial or other legal obstructions. You can not vote by mail (since someone may influence your vote) but you can entrust someone to vote in your name. But that person can therefore vote for whoever they want, respecting your choice or not. That's not perfect, obviously, but the lesser evil, maybe.

Modernity is to vote by paper, in a one-person both. Modernity is efficiency, not technology. Low-tech is always better if it fits the requirements.

I'm an IT guy, therefore an evangelist of the anti-electronic vote. Aren't we all?

<!- insert here your blockchain solution to yet another non-existing problem ->

;-)

I though in a scenario where the ballots are in a stockpile and you pick up the top one. If they are secretly numbered, it doesn't matter which one you did pick up: it's just necessary to register who was the first to vote and so on.

This can de done by anyone. Example: the person that is checking your ID before you pick the ballot.

It wouldn't work: in theory you were indeed supposed to take one ballot for each candidate, but in practice some made a show to not pick some candidate, other took several papers..

I remember opening envelopes where several ballots for the same candidate were put together in the same envelope, a very bad idea as this meant that this envelope wasn't considered a valid vote..

Are you given a ballot which could be customized for you, or do you simply pick one from a pile?

Reminds me of this similar technique using zero-width characters:

https://medium.com/@umpox/be-careful-what-you-copy-invisibly...

https://news.ycombinator.com/item?id=16749422

Video and demonstration: https://www.youtube.com/watch?v=dejrBf9jW24

Talk: https://youtu.be/2DAlv8aw34Y

I remember there was a shareware x86 assembler called A86 back in the 90s. It was easier to use than Microsoft's. In the documentation, it said it would encode a fingerprint in the output opcodes so they could go after anyone using it for commercial purposes without a license.

This would be possible (according to them) because there are instructions that could be encoded in multiple ways without affecting the operation of the code.

I wonder now if they actually bothered, or if it was just there in the docs to make cheapskates think twice.

Meh, this wont even survive a xerox :) [0]

[0] http://www.dkriesel.com/en/blog/2013/0802_xerox-workcentres_...

TLDR: xeroxes try to compress documents by replacing _similar_ glyphs with the _same_ glyph.

A long time ago I thought about a similar method but applied to music. What if you injected in every sold or streamed version of a song some kind of slightly different version of an instrument? Maybe if the piece has a cowbell it could ring at imperceptibly different times and frequencies, thus generating a unique fingerprint.

They already do audio watermarking like this and it can be annoyingly audible, it sounds kind of like a warbling or volume variation noticeable on sustained notes. At first I thought it was Youtube compression and then I started noticing the same thing in other streaming services. I switched to listening through subscription services offering HD audio which is watermarked differently in a way I can't hear.

Makes you wonder if the linked pdf itself incorporates this method and there's a secret message hidden in it.

Bad time to be a whistler blower

Haven't printers for a long time embedded uniquely identifying codes into printed pages?

I thought it was standard practice so that FBI would be able to match ransom notes and threatening letters with the printers they originated from.

Color printers, yes. https://www.eff.org/issues/printers

disturbing, if true...

Well, goodness. They appear to have reinvented the Baconian cipher. Only what, 417 years late?

"Provided a text document with specific fonts" is doing a lot of heavy lifting here.

Pretty much by definition, text documents don't supply fonts. So, reading text documents is still fine, unless your OS "helpfully" opens text documents using rich text viewers, in which case: please talk to your OS vendor.

For rich text documents, say PDF, the risk of personalized-and-or-remote embedded fonts is not exactly new. Maybe this variant is, but the general idea definitely isn't.

So, this, to me, is at best a possibly-novel "how to do DRM with PDF" technique. Which is interesting, but not exactly earth-shattering.

Or am I missing something here?

Well, if you print it out then it's all kind of embedded on a piece of paper.

> "how to do DRM with PDF" technique

Not DRM, but fingerprinting? Sure. This gives me the idea to write a PDF sanitizer that resets glyph rotation and kerning to prevent this.

What’s your definition? Here’s theirs:

> Our FontCode system embeds in a text document any type of in- formation as a bit string. For example, an arbitrary text message can be coded into a bit string using the standard ASCII code or Unicode. We refer to such a bit string as a plain message. In a text document, the basic elements of embedding a plain message are the letters appearing in a particular font

I think you’re talking about the plain message. There’s nothing wrong with their definition of text document.

> There’s nothing wrong with their definition of text document.

I think we can agree that it could be more specific. Me and OP read "text document" and hear "plain-text file".

The article talks about using Word. If someone sent me a Word document and called it a "text document" I'd look at them cross.

Reply on news.ycombinator.com