[HN Gopher] Whistleblowers take note: don't trust cropping tools
___________________________________________________________________
Whistleblowers take note: don't trust cropping tools
Author : LinuxBender
Score : 128 points
Date : 2023-02-14 16:12 UTC (6 hours ago)
(HTM) web link (theintercept.com)
(TXT) w3m dump (theintercept.com)
| andix wrote:
| If you're whistleblowing you should probably convert all your
| pages to images first and then create a PDF out of those images.
| If you convert to b&t images (1 bit) the risk of watermarking
| with some colored dots in images may be reduced.
|
| But there is probably still a lot of watermarking that could leak
| through.
| jay-barronville wrote:
| > _[. . .] convert all your pages to images first and then
| create a PDF out of those images._
|
| PDF's are risky business. So much metadata can be hidden in a
| PDF depending on how it was generated. Stick to optimized
| JPEG's (as I suggested in another comment [1]).
|
| [1]: https://news.ycombinator.com/item?id=34794953
| andix wrote:
| That's really an easy option.
|
| For clean PDFs you would need a dedicated tool. I wouldn't
| trust PDFs that were created by any standard office software
| (Word, Acrobat, ...). There is always the risk some
| information about your computer, user name, time zone,
| location or maybe even license key/hash of the software may
| leak into the created document.
| epilys wrote:
| I'm just a nobody, but I wouldn't trust the Intercept on OPSEC
| advice. From a purely technical point, they did fail to protect
| their sources when they exposed Reality Winner to the US
| government.
| probably_wrong wrote:
| There's a second possibility, though: that after having screwed
| up this badly they are now doing their best to protect future
| sources.
|
| Or as Thomas J. Watson put it: "Recently, I was asked if I was
| going to fire an employee who made a mistake that cost the
| company $600,000. No, I replied, I just spent $600,000 training
| him. Why would I want somebody to hire his experience?"
| bell-cot wrote:
| ...and the 1970's (first I heard it, IIR) comeback:
|
| Don't fire him, and you've paid $600,000 to train just him.
| Fire him, and you've paid $600,000 to train _everybody else_
| at the company. Which one is the better value?
| egberts1 wrote:
| Original employee, especially the higher up they are in
| skillset.
| karaterobot wrote:
| I would not pay $600k to teach everyone at the company that
| if they make a mistake I will fire them to set an example.
| If that was my position, it's a lot cheaper just to walk
| around threatening people and making them feel paranoid
| every day at work. But I think it's a bad position to take.
| So I'd probably keep the one guy who is never going to make
| that mistake again around, and fix whatever system allowed
| the mistake to happen in the first place.
| yunwal wrote:
| That's a great way to teach people to cover up their
| mistakes
| pessimizer wrote:
| That was an intentional failure to protect, because Reality
| Winner's biography was important for the story that much of the
| US government was trying to sell.
|
| However don't trust... tools can't help but be good advice.
| There's no need to trust the Intercept on metadata existing.
| jvanderbot wrote:
| "Has failed in the past" would remove every company from doing
| opsec advice columns.
| pard68 wrote:
| Export/save to PDF should fix this
| burna_aws_acct wrote:
| Anecdote: I experienced this first-hand with Facebook actually,
| in 2017. I tried to crop a screenshot, and then post the cropped
| image in a FB Messenger group chat. FB Messenger defaulted back
| to the full screenshot image. I decided to no longer use FB after
| this.
|
| Also, all TikTok videos are restored to their original form and
| archived, by TikTok, both in the US and China. All those "blurry"
| nudes, "a day in the life at the office", and more, belong to
| TikTok. Along with all that metadata. TikTok you don't stop!
| korroziya wrote:
| Another reason why MS Paint is king.
| femto113 wrote:
| If this article doesn't make you sufficiently paranoid may I
| refer you to my all time favorite Underhanded C Contest, the
| leaky image redactor from 2008. The winning entry is just
| brilliant: it's simple, it works perfectly, does nothing tricky,
| but still allows near perfect recovery of redacted text.
|
| http://www.underhanded-c.org/_page_id_17.html
| encryptluks2 wrote:
| [dead]
| icelancer wrote:
| Wow. Meacham's method is brilliant.
| knodi123 wrote:
| I don't get it. How is his code treating pixels differently
| according to intensity?
| manchmalscott wrote:
| Because the code iterates per character, not per pixel.
|
| If a pixel's value is '7' and in the redacted zone, the
| program will iterate over the single character and output
| '0'. If the pixel's value is actually '174', the program
| will iterate over all three characters, outputting '000'.
| Any normal PPM image viewer will display these identically,
| but high contrast areas like text will be recoverable.
| oh_sigh wrote:
| Funny, the guy who made the chipophone (Linus akesson) and
| other cool audio projects won 3rd place that year. His site was
| just on hn a week or two ago but I forget exactly what for
| charles_f wrote:
| The only method I somewhat trust is taking a screenshot of the
| thing I want to strip the metadata from
| kurthr wrote:
| Use a separate digital camera and JPG rescale/compress the hell
| out of it after the fact. Screen grabs are convenient, but not
| sufficiently lossy, and can leak information.
|
| If you're feeling rough, run the screencap through an OCR and a
| spell checker first before taking an off axis picture in Times
| New Roman.
| [deleted]
| antegamisou wrote:
| Correct answer is always getting buried to the bottom haha.
| jraph wrote:
| Make sure you don't care about the time and location of the
| screenshot and possibly the user name being leaked if you are
| not careful :-)
| tjoff wrote:
| I wouldn't even trust that blindly, I totally imagine that
| there could be metadata in the screenshot containing for
| example the title of the window being screenshotted etc.
|
| If noone does that right now it is just an update away.
| chasd00 wrote:
| i think if you export to a bitmap then you at least have a
| fighting chance. The bitmap format is simple enough that you
| could probably use a hex editor to read the header segment
| and be reasonably sure you understand what is tagging along
| with the file.
|
| https://en.wikipedia.org/wiki/BMP_file_format
| paulpauper wrote:
| This is why sensitive screenshots should always be edited and
| saved in something like MS Paint. This way you see everything and
| minimal metadata. no surprises. Fancy editing tools always have
| hidden stuff. Text should be redacted by blacking it out, not
| blurring, which can also be reconstructed.
| Maxburn wrote:
| It pains me that the easy crop handles in mspaint seem to have
| gone away in win11. I don't have a win11 machine in front of me
| but I'm thinking there is now a tool to accomplish simple crop
| in the new and "improved" mspaint?
| wlesieutre wrote:
| Seems the same as always to me, the top left corner is fixed
| but you can click and drag to change the canvas size from the
| bottom right.
|
| Alternate way is to select the area you want to keep and then
| click the crop button on the toolbar.
| hacknewslogin wrote:
| I find the "snip and sketch" tool handy. If you push the
| "windows + shift + s" keys it lets you draw a box around what
| you want a "snip" of. Then you'll get a notification you can
| click on that will bring up basic editing tools, including
| image crop.
| nhchris wrote:
| Something to keep in mind when accusing people of overreacting to
| "minor" data leaks, such as a little extra metadata here, some
| telemetry there... they add up. And one day, you might have to do
| something actually important, and there will be all these little
| landmines lying around.
| LarryMullins wrote:
| We need a return to WYSIWYG principles. Any metadata stored in
| a file should be shown to the user in some way, to make them
| aware of that metadata existing. And if the metadata is
| incomprehensible to the user, then maybe it shouldn't be stored
| at all. There shouldn't be any surprises. If a file has an
| embedded thumbnail preview of itself which could become out of
| sync with the main image data, both should be shown to the user
| so they have an opportunity to notice it.
| adolph wrote:
| Even "plain text" includes hidden metadata
|
| https://en.wikipedia.org/wiki/Byte_order_mark
| jefftk wrote:
| That's a bit of a weird use of WYSIWYG, which is usually used
| to mean that you _can 't_ see the metadata. For example,
| imagine you're editing a WYSIWYG document and enter:
| A Ctrl+I Enter Ctrl+I B
|
| This will look like: A B
|
| If you later start typing on that intermediate line, though,
| your text will be in italics. This is what users expect, and
| is in contrast to outting a little "italics" markup symbol on
| the line, as people did pre-WYSIWYG or do today in Markdown,
| HTML, and other markup languages.
| gurjeet wrote:
| The phrase "death by a thousand paper cuts" comes to mind.
| r3trohack3r wrote:
| Don't entrust your freedom to tools you don't understand.
| dbg31415 wrote:
| Reference to Red Dwarf. +1
| dbg31415 wrote:
| For PDFs at least there are tools to reduce file size that get
| rid of the originals and just save the image as it is used.
| a_shovel wrote:
| For those who are thinking "Yeah, duh, just use an image editor
| to crop it," as I did at first, this article is probably most
| useful for barely-tech-literate people, who can use Microsoft
| Word, Outlook, Edge, maybe Teams, and not much else. They
| wouldn't think that they'd need to open a whole separate image
| editor when Word has a cropping function built in that's always
| worked for them before.
| tjoff wrote:
| Not foolproof, there have been instances when people have been
| cropping in an image-editor and failed to realize that the
| thumbnail hadn't been updated and leaked information.
| hilbert42 wrote:
| _"...failed to realize that the thumbnail hadn 't been
| updated..."_
|
| Right, I'd never use part of the original image. Best print
| it out and rescan it, preferably on different scanner.
|
| Being truly anonymous is enormously difficult, even the Bauer
| pattern/Bayer filter shape in one's image sensor will give
| one away. That alone requires sophisticated filtering to
| decouple it from a specific sensor/camera.
|
| And that's only the beginning, there are many other factors
| that contribute to the leaking one's identity.
| acuozzo wrote:
| > Best print it out
|
| https://en.wikipedia.org/wiki/Machine_Identification_Code
| Hamuko wrote:
| If I need to ensure there's nothing on an image that wasn't
| supposed to be there, I just copy the visible pixels and
| paste it to a new document. No EXIF data, outdated thumbnails
| or anything.
| e28eta wrote:
| I can actually imagine a tool that'd copy/paste the
| metadata along with the data, but I don't know if any
| exist.
| chihuahua wrote:
| Using a screenshot tool should be safe. It will treat all
| pixels on the screen the same, so it doesn't know that
| some pixels have metadata beyond what's visible on the
| screen.
| Kon-Peki wrote:
| > Using a screenshot tool should be safe. It will treat
| all pixels on the screen the same
|
| Nope. Microsoft Office has an option/plugin that lets you
| flag emails and documents as restricted. You can, for
| example, send such an email to someone else. That person
| can open the email and use a screenshot tool on that
| email. What they will get is a flat gray box where the
| email content was.
|
| Not all pixels on the screen are the same. And you have
| no idea if your computer tattled on you and let the
| sending org know that you tried to screenshot the email.
| hef19898 wrote:
| Then print and scan the screen shot before faxing it to
| authorities.
| toss1 wrote:
| And make sure that the scan is of low enough resolution
| that it fails to pickup the printer identification dot
| pattern in the printout...
|
| The fax should help with that, except that it'll reveal
| the location of your source fax. Using fax
| software/service needs its own security...
|
| maybe snail-mail...
|
| This is getting seriously nontrivial
| hef19898 wrote:
| Well, if we talk about goverbment whistleblower programs
| I assume using a fax from a random location while
| travelling would be good enough to not be identified by
| your employer (or whom ever you blow whistle on).
|
| If you do blow the whistel _on_ the government, well, you
| better trust your journalist partner a lot. Or use a
| trustworthy lawyer as a go between.
|
| But hey, one could send the fax back and forth, cut of
| the fax numbers and physically mail it from a very busy
| train station! And have a someone put the letter into the
| letterbox for you, someone you pay out of view of any
| CCTV cameras!
| adolph wrote:
| Don't forget to pilfer newspapers from around the country
| and cut/glue letters from different fonts to compose the
| message and use homemade paper as the base layer.
| hef19898 wrote:
| Instead of home made, use the most prolific paper you can
| imagine!
| a_shovel wrote:
| Okay, that one might catch me. I couldn't tell if an image
| had a thumbnail stored with it to begin with.
| knodi123 wrote:
| Referring to TechTV presenter Cat Schwartz, I presume?
|
| https://en.wikipedia.org/wiki/Catherine_Schwartz
| SapporoChris wrote:
| I sometimes get smartphone photos of computer screens sent to
| me by friends. It makes me cringe every time, but now I'm
| thinking maybe they're onto something.
| LarryMullins wrote:
| I believe this is often done to avoid corporate surveillance
| on the computer that might record the screenshot and
| exfiltration.
| c0nsumer wrote:
| While I doubt they are meaning it as such, it's not far off
| from the technique of physically redacting a printout and
| then scanning that as duotone so there was never, ever a
| digital path between the original and the resulting digital
| copy.
| icelancer wrote:
| I bet some of them are Live photos that leak data otherwise.
| [deleted]
| kerblang wrote:
| I think I would do this by default because I'm so
| ignorant/incompetent with the fancier tools that I'd never
| think to look for a cropper. I'm the cretin that says, "Oh I
| can do this in MS Paint!" and even spends a 1/2 hour
| remembering how to do that much...
| bcrosby95 wrote:
| Iirc some formats support cropping too. So even if you crop in
| an image editor, all the data may still be there.
| godot wrote:
| It really would benefit most people to learn to use (Windows)
| Snipping Tool or (Mac) cmd-shift-4 to crop an image that is
| currently displayed on their screen; that would create a new
| image altogether (cropped screenshot). It's truly even easier
| to use than whatever Gsuite or Office alternatives they would
| otherwise use, once you know of their existence.
|
| My significant other is outside of tech and wasn't aware of
| either of these. Once shown, there was no reason to go back to
| using anything else to crop images.
|
| No image editors involved!
| burkaman wrote:
| > barely-tech-literate people
|
| I think this is a little unfair. I would not blame anyone for
| thinking that the part of the image they cropped is deleted.
| That's what the word means, that's what it looks like is
| happening, there's usually no warning that it's recoverable.
|
| When you delete text it is really gone from the document, even
| though you can undo to get it back. It's totally reasonable to
| expect images to work the same way.
| a_shovel wrote:
| What I had in mind when I was writing that was a story I once
| read of a user who did all of her computer interactions
| through Word (i.e. all of her emails were empty with a Word
| document attachment containing the text, among a few other
| amusing anecdotes). But yeah, the characterization is a bit
| unfair from that perspective.
| zellyn wrote:
| An increasing number of image editors are focusing on "non-
| destructive editing" too...
| WirelessGigabit wrote:
| This reminds me of Federal Public Service Finance of Belgium.
|
| When they take possession of items for various reasons they want
| to sell them off to reclaim lost tax revenue.
|
| Cars for example, now you must know that in Europe for some
| reason people are very weary of their VIN. It's not shown on
| websites as it is in the USA.
|
| So the tax office posts a PDF with all the cars they possessed
| with their VINs, but with 80% blacked out.
|
| With black boxes.
|
| And they didn't flatten the PDF.
|
| Sending around data is a minefield. Metadata everywhere. It's so
| easy to lose track of it.
| pxx wrote:
| VINs are by design very visible on cars? You could get the same
| information by just going to the lot...
|
| Though the overall lesson of the story is good: analog
| redactions with a permanent market and a b&w photocopier are
| recommended for anybody without 100% confidence in their tools.
| LarryMullins wrote:
| > _a permanent marker_
|
| Or better yet, an exacto blade. If the "black and white"
| photocopier is actually grayscale, then you could get text
| leaking through the marker if you play around with the image
| contrast.
| Something1234 wrote:
| Can you really trust photocopiers with the microdots they
| encode nowadays?
| sokoloff wrote:
| Aren't those only in color photocopiers/printers (relying
| on the lesser visibility of yellow ink)?
| billiallards wrote:
| Not sure I would rely on that, but Xerox's docs state
| that the requirement was introduced as an anti-
| counterfeit measure by some governments. Counterfeiting
| currency probably wouldn't be a concern with B&W
| printers.
|
| Most banknotes are not printed on ordinary paper, but it
| doesn't stop people from trying. Printers which produce
| those dots will also usually refuse to print high-
| resolution pictures of dollar bills.
| jaywalk wrote:
| If all you're worried about is redaction and not anonymity,
| a photocopier is perfectly fine for the job.
| Hamuko wrote:
| > _Cars for example, now you must know that in Europe for some
| reason people are very weary of their VIN._
|
| Quite a lot of cars in Europe, including from European
| marquees, have the VIN in a visible place at the bottom of the
| windshield.
|
| I can also look up the VIN for pretty much any car on the road
| by just searching the number plate on the traffic authority's
| website. Gives me the VIN, last inspection date, tyre sizes,
| tax info, etc.
| doodlebugging wrote:
| For many years I have used SnagIt for cropping photos and
| documents. It has excellent features for marking up the resulting
| images too. It is very useful for customizing something for
| insertion in a Powerpoint slide. I do hate the nag screen poking
| me to upgrade from version 8 though. Fortunately it is a two
| click operation that has become muscle memory to me now.
| RandomTisk wrote:
| Any risks with Windows Snipping tool?
| barbazoo wrote:
| Not that I can think of, that would be the much more sensible
| thing to do. And CMD+SHIFT+4 or whatever your shortcut is on a
| Mac.
| jay-barronville wrote:
| A very simple and easy way to pretty much guarantee an image
| doesn't contain unnecessary metadata, can't be uncropped, _etc._
| is to first convert it to JPEG and then run it through an image
| optimizer (like ImageOptim [1]). Don't use cloud software for any
| of this -- do it all locally.
|
| [1]: https://imageoptim.com/mac
| sudobash1 wrote:
| Personally, when I want to make sure that no metadata gets
| copied, I just take a screenshot. Simple, and nothing tricky.
| jay-barronville wrote:
| Your screenshot likely has metadata encoded in it too.
| andix wrote:
| I just checked the PNGs created by the Windows screenshot
| tool (win+shift+s). There was no obvious metadata inside.
| If there is something, it is not easy to find.
| icelancer wrote:
| Snipping tool + recompression + conversion is usually
| enough to get the job done. That's what I do when I put
| public screenshots up that I care about redacting or
| protecting.
| [deleted]
| Permik wrote:
| Btw, you don't actually want to use a lossy image container in
| the modification steps if you don't want to leak any data. JPEG
| has ways of extracting data that was either cropped out or
| written over, by how the compression is performed over the
| parts of/whole image. Compression artifacts can and will
| propagate data that you are not fully aware of. PNG is a safer
| bet for screenshot content for the middle steps.
|
| Only the final image should be compressed using a lossy image
| compressor as then any details can't be diffused to the image
| if they simply aren't there.
| knodi123 wrote:
| Does anybody remember the famous incident with the TechTV host
| Cat Schwartz, who took a topless photo, and then cropped it to
| just her eyes and posted it on her blog? And then a fan told her
| "btw, the original photos contained a thumbnail version in the
| exif data, and photoshop did not update or remove that." So you
| really could do that gag from Red Dwarf where they "uncrop" a
| photo.
|
| (red dwarf scene) https://www.youtube.com/watch?v=6i3NWKbBaaU
| taubek wrote:
| I didn't use Word in years now, but I remember that there was an
| option for reducing image size. That option would remove cropped
| part. I've just searched for help and this is what I've found
| https://support.microsoft.com/en-us/office/reduce-the-file-s...
___________________________________________________________________
(page generated 2023-02-14 23:01 UTC)