Hacker News Reader

Comment by OneMorePerson | Hacker News Reader

It's funny seeing this play out because in my personal life anytime I'm sharing a sensitive document where someone needs to see part of it but I don't want them to see the rest that's not relevant, I'll first block out/redact the text I don't want them to see (covering it, using a redacting highlighter thing, etc.), and then I'll screenshot the page and make that image a PDF.

I always felt paranoid (without any real evidence, just a guess) that there would always be a chance that anything done in software could be reversed somehow.

View on HN

If it's not done properly, and you happen at any point in the chain to put black blocks on a compressed image (and PDF do compress internal images), you are leaking some bits of information in the shadow casted by the compression algorithm : (Self-plug : https://github.com/unrealwill/jpguncrop )

I was thinking I understand what's going on but then I came to the image showing the diff and I don't understand at all how that diff can unredact anything.

It's not that you can unredact them from scratch (you could never get the blue circle back from this software). It's that you can tell which of the redacted images is which of the origin images. Investigative teams often find themselves in a situation where they have all four images, but need to work out which redacted files are which of the origins. Take for example, where headed paper is otherwise entirely redacted.

So with this technique, you can definitively say "Redacted-file-A is definitely a redacted version of Origin-file-A". Super useful for identifying forgeries in a stack of otherwise legitimate files.

Also good for for saying "the date on origin-file-B is 1993, and the file you've presented as evidence is provable as origin-file-b, so you definitely know of [whatever event] in 1993".

Ok thanks. That sounds reasonable.

>... and therefore you can unredact them

from that readme is just not true then I guess?

I mean, even the "crop" isn't used at all correctly, is it?

I think the word should be "redact".

And that's just in the non-adversarial simple case.

If you don't know the provenance of images you are putting black box on (for example because of a rogue employee intentionally wanting to leak them, or if the image sensor of your target had been compromised to leak some info by another team), your redaction can be rendered ineffective, as some images can be made uncroppable by construction .

(Self-plug : https://github.com/unrealwill/uncroppable )

And also be aware that compression is hiding everywhere : https://en.wikipedia.org/wiki/Compressed_sensing

Right, using stenography to encode some parity bits into an image so that lost information can be reconstructed seems like an obvious approach - all sorts of approaches you could use, akin to FEC. Haven't looked at your site yet, will be interested to see what you've built :)

Edit: I checked it out, nice, I like the lower res stenography approach, can work very nicely with good upscaling filters - gave it a star :)

steganography — stenography is courtroom transcription

People protect their secrets from stenographers with steganography.

>Let's crop it anyway

That is not cropping.

https://en.wikipedia.org/wiki/Cropping_(image)

>Cropping is the removal of unwanted _outer_ areas from a photographic or illustrated image.

Please forgive my outside the box use of word.

I used it at the time as a reference to the "PNG aCropalypse" ( https://news.ycombinator.com/item?id=35208721 where I originally shared it in a comment).

The algorithm does also work if you remove the outer areas of the photo.

Somewhat related, I once sent a FOI request to a government agency that decided the most secure way to redact documents was to print them, use a permanent marker, and then scan them. Unfortunately they used dye based markers over laser print, so simply throwing the document into Photoshop and turning up the contrast made it readable.

I remember noticing that a teacher in high school had used white-out to hide the marks for the correct multiple choice answer on final exam practice questions before copying them. Then she literally cut-and-pasted questions from the practice questions for the final. I did mediocre on the essay, but got the highest score in the class on the multiple choice questions, because I could see little black dots where the white out was used.

I'm trying to understand this cause it sounds fascinating but I don't get it. I don't have an advanced understanding of compression so that might be part of why.

If you compare an image to another image, you could guess by compression what is under the blocked part, that makes some sense to me conceptually, what I don't get is for the PDF specifically why does it compressing the black boxes I put have any risk? It's compressing the internal image which is just the black box part? Or are you saying the whole screenshot is an internal image?

I'll just send an image and not bother with a PDF.

(Note there's also other metadata in a PDF, which you may not want your recipient to know either.)

There's also metadata in the image files. What specifically would be sensitive in the pdf with screenshots metadata that is also not present in the sceenshot image metadata?

PDF has something called an "info dictionary", which most mainstream PDF-writing software will fill out with various bits of info that you might not want known.

Image files usually have substantially less metadata by default, unless it's one taken by a camera.

Screenshots specifically tend to have very little metadata

it's absolutely bewildering how ridiculous everything has been so far in terms of competence and this really takes the cherry on the top near Christmas too.

how much lower can they go ?!

The really interesting bit is whether they can go another term.

They seem to be ahead of schedule abolishing a working democracy before the midterms.

Maybe it was always part of the plan. Plausible Deniability.

Good Soldier Svejk working at the FBI decided to follow an illegal order as badly as possible.

USA is still very high, so they can go much much lower, but I think they might go to some still lower places, finding them where we didn't even know such places could exist. Some ideas:

- Leave NATO

- Start openly supporting Russia and North Korea

- Arrest whole International Criminal Court

- Preventively invade China

I'm convinced slavery will be reintroduced before 2028

Slavery has never been illegal in the US. The 13th amendment leaves slavery legal as punishment for a crime. The US has the highest rate of crime punishment in the world (higher than places like North Korea), an industry that profits by selling slave labour of those punished criminals, and known ties between those who profit from selling slave labour and those who decide how many things should be crimes.

Oh also this isn't some quiet conspiracy or anything because the Union of correctional facility officers will openly say that things like legalizing recreational marijuana will hurt them, so they oppose it.

Same with cops.

They also oppose removing things like three strikes laws that haven't done a damn thing to make our country "safer" or better.

It never fully went away:

• https://www.hcn.org/articles/agriculture-farmers-turn-to-pri...

• https://www.law.georgetown.edu/environmental-law-review/blog...

It's not a slave if you just rent them from the cartels. /s

Fully enshrined in the constitution with massive support for the document. Just need to imprison them for something first.

I know you’re joking, but grievance over the loss of slavery after the civil war is privately one of the major drivers behind Trumps extremely loyal core supporters.

Reintroduce witch burning.

Reintroduce death penalties on public squares.

Taking Greenland and Venezuela is given, as they took most of Latin America already. Just the new Mexican president looks like the next thorn in their eyes. Too competent, too social, too anti-corruption.

They had one in bangladesh the other day.

>Start openly supporting Russia

Already done.

Trump is a born banana Republic dictator...

I like to refer to MAGA as Banana Republicans.

They effectively already left NATO and openly support Russia already. ICC members are already under fire and some had their microsoft account banned by Trump. Trump will invade Greenland and Canada first. China is less of an priority.

> They effectively already left NATO

What the fuck are you talking about? Someone should tell Russia.

NATO works by projecting a united force. Nations unconditionally backing each other up. The USA is now clearly no longer a part of that. That's not to say that the USA will do nothing if a NATO member is attacked. It might. Or not.

One can only imagine what America not fighting an attack on NATO member would have on nuclear proliferation.

Europe is already considering to have a nuclear shield.

This is because if Trump

No need to consider. The UK and France have nukes. France even has a two-tier response. Not enough to vitrify Russia or China five times over, but enough to make them reconsider.

Any country without nukes, that is not currently developing them, is stupid imo.. Nukes are the only thing that can guarantee sovereignty now. Ukraine gave up their nukes.

Do you believe the existing nuclear powers will just allow any country to join their ranks without a fight?

We're currently in the position of the USA threatening to attack a NATO member (Denmark)

Limiting Nuclear proliferation was already fucked.

Trump tore up Iran's "we won't do nukes" deal, doesn't matter whether you think they were genuine or not, it demonstrates we will go back on a deal so our word isn't worth anything.

Ukraine shows that the west will not actually protect you like they claim, so your only option is getting nukes to really deter people.

North Korea and Pakistan demonstrate that you can pretty much do whatever you want with just a couple nukes, the west will cower in fear over idle threats.

No country would look at any of this and conclude that they have any choice but to build nukes to protect themselves.

For much of NATO history, the US is NATO. The US doesn’t want it to be like that anymore because it needs to strategically shift to the other side of the world. So, the US says “What if Europe can be NATO? If we can force them to meet the GDP commitment then maybe we don’t need to worry about them too much and commit less of our own resources to this theater.” But of course people interpret this as if the US is abandoning the alliance. No, the US just has other problems to deal with in the world.

Well, the very fact that we are even discussing it means Trump already weakened NATO as an alliance.

The US has been the biggest opponent to a European (or EU) army, fearing loss of influence and control. It was very much in US interest at the time.

That is the rationalization, but don't be surprised if the US would not confront China at all.

The main flow of capital in the US had been going to the mil.industry, but that is not the case anymore. It is mainly surveillance tech that is receiving capital. In a very unhealthy economy, this all looks eerily pre-'30s.

The US, right now, is only threatening weak countries, they don't have the industrial power to confront China, nor do they want it. This shouldn't be a surprise, some ideologues behind this maga-project belief in an America from one pole to the other. They believe in "spheres of influence", and as such China has their own sphere of influence. A sphere of influence means a kind of colony, where natural resources, people and industry are all resources to be extracted by them. It is the Russian model, it is the model of criminal mobs, it is might makes right, it is a multi-polar world.

Meanwhile, re-industrialization projects have been scrapped, partners have been scared of, and tariffs have hit the industry that was still left in America.

Monopolists are parasites on the economy, and the US is already very weakened from that. As the Japanese said, the US is still a great power, but the throne is empty. I suspect there will be skirmishes with other "great powers" over exploitable resources like Africa, Middle East, Europe, but I don't expect the current crop to go all-in on China.

Yes, the US has always been the driving force behind NATO. It provides close to 40% of the combined military personnel, and an even higher portion of military spending.

No longer committing to defend other NATO countries, even if their military spending exceeds the target, is abandoning the alliance though. NATO is little else than that commitment.

There's a left wing cooker conspiracy theory that the guy who gave Ukraine the Javalin anti tank missiles and forced NATO to increase military spending to 5% of GDP is actually a secret Russian agent.

You literally just used NATO for a grouping that does not include the US.

Can you rephrase what I said without "literally using NATO for a grouping that does not include the US"?

I didn't even mention the US lol, I think you're paranoid but please, correct me ...

I mean, I didn't phrase it as Trump being a part of NATO, but he's not actually a country.

Oops I guess if this is as much sense as you can make then there wasn't much point in my trying to parse your comment in the first place.

I didn't group NATO and the US separately. You thought I did, but I didn't and you just hadn't read properly.

I waffled a bit in my reply to not rub it in too hard.

And do you want to contribute with something other than nitpick or insult?

Do YOU think that an informed and intelligent person can conclude that Trump is secretly a Russian agent, given he was the driving force behind a massive hike in NATO spending (which Putin really hates)?

I'm not calling Trump competent, or consistent, or benevolent. You can say he has a weird crushed on Putin and is easily manipulated and corrupt.

You can even suggest a lot of the MAGA people who surround Trump are actually working for Russia, since Russia tries to influence a lot of groups and Trump's cronies (and the influencers Trump listens to) are often compromised.

But do you think Trump is actually consistently taking orders from Putin because of some kind of leverage Putin has? Because people say this constantly and it's (in my opinion) almost as embarrassing as Republicans and the Pizza conspiracy. Trump has done some things that are increadibly damaging to Russia, and blackmail doesn't work on a pathological liar with no sense of shame.

I'm sure you're smart enough to agree with pretty much all of this. But you disingenuously attack me because I'm attacking people who are on your side, even if you would privately admit they are dumb.

This is what I read in your comment: that Trump "forced NATO to increase military spending to 5% of GDP". Are you talking about the US there? No, tautologically, you are talking about those parts of NATO that Trump forced to increase military spending to 5% of GDP. So what is controversial about my observation that you used the term NATO to stand for a NATO without the US?

My point was that by doing so you yourself add weight (a very little weight) to the thesis of the grandparent that, at least in people's perceptions, the US has left NATO. It wasn't just a nitpick, but at the same time I did not intend to join this side or that side in some mad argument that is playing out in your mind. I freely admit that at this point I am not reading all your output.

Yes the US is forced to meet the 5% target, as it is a part of NATO. What is your point?

Trump is the person who demanded the 5% target; Trump forced NATO to adopt a 5% target.

Trump also ordered ICE to deport more illegal / undocumented migrants, does this suggest that ICE is not a part of the US?

Trump forced the US to impose sanctions, does this suggest the US is not a part of the US?

How else would you phrase "Trump forced organisation x to do y"?

> Trump is secretly a Russian agent,

Russian asset, not necessarily agent. At least that's the commonly spread idea, for which there is at least some circumstancial evidence: commercial projects in Russia for several decades and well documented links to Ukrainian and Russian oligarchs under Trump I just to name two.

Support for NATO within the US is Isreal-lite for different demographics. Pouring resources into it isn't without downsides.

I'm not too concerned about the US. They've made their bed.

I'm more concerned with them dragging everyone else down, and someone much worse taking their place.

Pray tell what western country right now isn’t in the same position?

This low https://en.wikipedia.org/wiki/Child_abuse_in_Pakistan aka a society where child abuse is simply accepted and mainstream, with the child abuse of child labour and dhijhadism being just additional nightmare fuel on top.

If we survive long enough I do believe historians will look back on this period and state as a matter of fact, rape and child abuse were completely acceptable, because it seems it’s totally fine with our elected leaders. If these leaders were democratically elected there is only one conclusion to draw from it…

Maybe the person tasked with the redacting didn't agree so they chose the worst possible way to do it.

Normally, I'd never attribute to intention what can be blamed on incompetence. Especially if the government is doing it. But sure, if I were the intern tasked with this job...

> Especially if the government is doing it.

Also if doing it right means more work?

My personal guess is that only 10% of people love their work, and don't object to doing more of it - governmental or private sector. But the efficacy of those people is amplified in the private sector and nullified in government.

Source: I'm the guy everyone wanted on their group science project in high school, because I'd feel responsible for doing all the work while they smoked weed. I have brothers both in and out of government who work equally hard at similar jobs, and I see the dispatity of motivation.

I learned that a long time ago when I was a student and wanted to submit a pdf generated by a trial version of some software as an assignment and was trying to be clever and cover the watermark that said unregistered with a white box.

When opening the file in my slow computer, I could see all the rendering of the watermark happening in slow motion until the white box would pop up on top of the text.

It's actually quite easy to open the pdf and see that there are several different elements per page to the document, eg the main text, an image, the footer, the title.

Randomly removing these by trial and error will usually quite easily allow you to find the watermark and nix it, with the advantage that even a sophisticated recipient will not be able to find out from the pdf file what the watermark was.

When I was a student, and using a shareware or trial version of some software and wanted some printed output from it without a watermark, I printed to postscript (chose a printer that supported postscript and the driver used it instead of rasterized images), but using a file instead of a printer.

I could then open up the postscript, delete the commands that rendered the watermark, save it, then I converted it to PDF so it would be easy to print.

You don't need PostScript for that. The PDF text commands are Tj and TJ, and rarely ' and ". They are easy to delete without going through PostScript. Tj means showing a simple text string. TJ means showing an array of strings possibly with space adjustments. ' means moving to the next line and showing a simple string. " means doing that and setting character spacing.

Perhaps, but it's easier to open up and edit a .ps file in a text editor than a PDF. PDF is a binary format with compressed streams, while postscript is just a stack-oriented programming language.

Tools like qpdf makes it easy to edit a .pdf file in a text editor too. I’d argue using such tools is easier than and simpler than printing to postscript.

Sure. I've not tried it. Was it around in 2002? Because that's when my story occured.

I then convert the image to grayscale only. Then I apply a filter so that only 16 colors are used. And I then adjust brightness/contrast so that "white is really white". It's all scripted: "screenshot to PDF". One of my oldest shell script.

16 shades of grey (not 50) is plenty enough for text to still be smooth.

I do it for several reasons, one of them being I often take manual notes on official documents (which infuriates my wife btw) but then sometimes I need to then scan the documents and send them (local IRS / notary / bank / whatever). So I'll just scan then I'll fill rectangle with white where I took handnotes. Another reason is when there's paper printed on two sides, at scan times sometimes if the paper is thin / ink is thick, the other side shall show.

I wonder how that'd work vs adversarial inputs: never really thought about it.

care to share the script?

Personally, I only trust an image manipulation tool to put down solid colored blocks, or something that does not involve the source pixels when deciding on the redacted pixel. Formats like PDF are just so complicated to trust.

And even being this careful, if the opacity is slightly off it could be undone

The one that was crazy to me is undoing a blur effect (based on its algo), so yeah I also will layer and screenshot something

This is what I do while sharing such images. I crop out those parts first and then take another screenshot. I do not even risk painting over and then take another screenshot. I have been doing this forever.

In practical terms, a more convenient way to achieve this is just printing the document to a PDF, which rasterises the visible layer into what the printer would see. Most pdf tools support this.

That seems like a dangerous approach. Though printer drivers do often use rasterization, especially when targeting cheap printers, many printers can render vector graphics and text as well. Print-to-PDF will often use the later approach, unless of course the source program always rasterizes it's output when sending it out to the printer driver, or the used Print-to-PDF driver is particularly stupid.

You can, but I don't trust software for these types of niche but critical tasks hah. Next thing I know I'd be reading a headline about how "bug in print to PDF actually retains XYZ metadata"

I feel the same and do the same.

Me too.

Reply on news.ycombinator.com