Hacker News Reader

Hacker News

Comment by markus_zhang | Hacker News Reader

Parent Full thread

markus_zhang

Those photos may still have embedded signatures that track.

View on HN

That would be next level corp spyware. Can you point to a enterprise offering that sells that?

Why, sure we can: https://www.xsecuritas.com/

https://zecurion.com/blog/screen-watermarks-and-screen-photo...

Spy v spy, It has a phone detector, but will it detect my smart glasses or my nest cam…or the camera secreted in my bookcase capturing my screen?

They could place nearly invisible watermarks that only a camera would notice. Probably your safest bet is to deep fry the image. Pictures of pictures with high compression turned on.

For a wavelet based stamp, you might have to stamp your own pattern on top so it no longer cleanly reads.

https://www.sciencedirect.com/science/article/pii/S187705091...

Lol it's literally just a giant watermark across the screen with the person's name and blocking the screen when the webcam identifies a smartphone...

Needless to say, both of these are trivially bypassable.

I think most of us are more concerned about the potential presence of invisible watermarks, obviously submitting a picture with "JOHN SMITH ACME CORP 2025-01-09" blatantly strewn across the screen will be trivially traced back to you

Conveniently, they also offer webcam-based smartphone detection, tied into screen blanking and reporting.

The fact we are discussing this is a damning indictment of late-stage capitalism.

Google used to watermark internal emails using non-visible Unicode. It would catch people copy-pasting things to the press. (This was circa 2010; I don't know if they still do it.)

Printers and copiers have hidden "tracking dots" that can ID the specific device used. Introduced by Xerox in the mid 80s and not known to the public until 2004. https://en.wikipedia.org/wiki/Printer_tracking_dots

Sorry but this wouldn't be "next level" spyware.

I do remember world of warcraft using some funny trickery for their screenshots too. embedding client info into the screenshots, to figure out who took it. (If the player was under NDA or similar)

https://www.ownedcore.com/forums/world-of-warcraft/world-of-...

difficult to spot if you didnt know what to look for

Invisible unicode and tracking dots probably won't be captured in a highly compressed jpeg photograph of a screen, though.

iPhones, Pixels, and Samsung phones have been defaulting to HEIC for around five years now, so it’s unlikely that compression alone would prevent tracking dots or other unique noise or patterns from being preserved. Steganography is a well-established technique that can definitely survive through photographs, even under compression. Variations in fonts or typography could be used for tracking too. There are plenty of creative ways this could be achieved.

> Google used to watermark internal emails using non-visible Unicode. It would catch people copy-pasting things to the press.

How does that even work? I assume the unique identifiers are generated along the lines of https://zws.im but do they send a different version of the same email to each unique recipient? Or does the watermark get inserted by some email client when copying text?

It was the former, a unique ID per recipient.

Neither of those things would be picked up by a camera taking a picture of the screen or printed document.

> That would be next level corp spyware

Would it be? I was implementing similar stuff for a crappy PHP forum 15+ years ago that wanted to track which users were sharing private posts outside their community. It started with screenshot-tracking by embedding small 1xN base64 images that were almost completely transparent except for some tinting on each pixel to represent a 1 or a 0 bit at the edges of several elements where they wouldn't be noticed. That didn't survive jpeg compression or photos, so I added text transforms that represented tracking bits as well. Things like one vs two spaces after a period or an expanded contraction would correspond to a bit of the ID of the user the text was served to.

That worked fine since the site was mostly prose, but I couldn't help but think about generalizing it to encode tracking bits as page styling information as well. Never ended up finishing that implementation because I got too in the weeds trying to account for rendering differences in customized user agents by adding error correction bits to the IDs. That way it wouldn't matter if a few styles were overridden or obscured.

I don't think any of these ideas were particularly novel or difficult to think of, so I'd expect plenty of independent implementations over the years. If they do their job right you'd never know about them, so there's likely more than you expect.

It is actually pretty common among Chinese companies. At least in Tiktok, where all software are internally developed (as explained in the article they use Lark, something similar to Slack).

This gives them flexibility and usability as different softwares can interact seamlessly. For example you can click open a link to the document that other people are screen sharing during a meeting. But it also embeds your name on the screen so you probably don't want to take a screenshot or a photo.

I know many companies also use techniques that generate invisible watermarks that are difficult to remove without breaking the image. I don't know exactly what the technique is, but maybe this is close:

https://patents.google.com/patent/CN106384328A/zh

Microsoft did it on the XBOX (360? Or the original, not sure) to help track leaks. If you uploaded a video or took a picture, the background of the system menu embedded enough data to find the individual user. IIRC it had to do with a pattern of rings or drops or something. I can't find the article about it any more.

Yes, but as long as the journalists don't reshare the photos (or the content verbatim), they can't be traced back to you.

While its certainly possible, its also highly unlikely.

Reply on news.ycombinator.com