Hacker News Reader

Comment by nnnnni | Hacker News Reader

Their answer is to "color over it", but BE CAREFUL if you do that. I'm sure that some of us remember the US government document(s) in the late 90s/early 2000s that were released in redacted form, but the person didn't realize/understand that people with the Acrobat editor program could remove the black bars.

View on HN

Also, image formats like JPEG have a thumbnail stored in them, which may not be updated when you edit the image.

Do they? First I’ve heard of that…

The thumbnail is part of the EXIF metadata. It's reasonably well-known now, but it was not always the case... http://graphicssoft.about.com/b/2003/07/26/techtvs-cat-schwa...

Huh, interesting. Thanks!

A few years ago a TV presenter got caught out by this, she posted a cropped photo of herself online, but the original, uncropped version could be recovered from the file which showed her topless.

There was a trend for a while of people posting images to imgur that had a totally different thumbnail. A rickroll of sorts.

You can use 'exiftool' on Linux to manipulate the EXIF data, get rid of the thumbnail, or set it to whatever you want. Imagemagick's 'convert' command also has a '-strip' option that will get rid of all EXIF data including any thumbnails.

I believe it's a Photoshop thing, rather than something common to all images. Photoshop in general does unusual things.

Also, when blacking out data from JPEGs, leave generous margins, because there may be compression artifacts in the nearby pixels that also act effectively as a one-way hash. I haven't tested how consistent these artifacts are, but it's better to be safe than sorry.

You don't have to go all the way back to the early 2000s to find poorly redacted federal documents. Rachel Maddow had a great segment on botched redactions, like removing the black lines from a PDF.

The best solution was to actually cut out the parts of the page you don't want seen and then scan in the result. All other methods are prone to mistakes.

Edit: corrected link to segment http://www.msnbc.com/rachel-maddow-show/watch/redaction-rule...

Would a screenshot work?

I've always drawn over sensitive parts in Paint or something, then taken a screenshot of it. It makes sure that everything is compressed to a single layer and can't be undone.

Just be sure to get all of it. It's pretty common that people leave a few pixels. How not to do it: https://imgur.com/ZaCIY5P

Leave generous margins. JPEGs can have compression artifacts that leak information outside the boundaries of the object.

It shouldn't matter if the original image (the screenshot) didn't contain any information to leak.

Exactly my thought. A BMP is too simple to go wrong. There's so many pitfalls with digital files, because they can have much more information than the viewer will show you in an obvious manner or at all. Not only layers, but metadata (EXIF) and whatnot.

Along the same lines, I remember an MIT Mystery Hunt puzzle once where there were hidden clues in a PostScript document. If you didn't think to look at the PostScript source you probably had no hope of solving it.

For a fun variant of this problem, see the 2008 Underhanded C Contest: http://underhanded.xcott.com/?page_id=17

Also great: HTML pages with sensitive passages using #000 for background and foreground. You just need to select and copy to Notepad - voila.

I think I once saw that on the site of a home security company, citing an email from customers who thanked them for burglarproofing their home in XX XXXXXXXX Street. Quite ironic.

There is also "Leaking Sensitive Information in Complex Document Files--and How to Prevent It" from IEEE Security & Privacy earlier this year. All copies might be behind paywalls, however.

Reply on news.ycombinator.com