4 ms·
Out of curiosity: How do you counter document fingerprinting?
by aqme28 10y ago
Out of curiosity: How do you counter document fingerprinting?
- _rolf 10y agoProbably best if you recreate the document from scratch and "in your own words".
- vog 10y agoThat's dangerous as well, because now your language can be analyzed and compared with other writings from you.
- tyrust 10y agoJust get hammered [0] before writing. [0] - or sober, whatever is the opposite of your typical working state
- Forbo 10y agoSoftware like Anonymouth [1] can be used to counter attempts to perform stylometric analysis. [1]: https://github.com/psal/anonymouth https://github.com/psal/anonymouth
- UnoriginalGuy 10y agoThen you're sending a fake to the media. The media will ask if the document is real and the organisation will correctly claim that the document is a fake (because you used your own words). A lot of these techniques actually make verifying leaked documents very difficult.
- techbio 10y agoIn fact some of the faithfully rewritten "facts" may be small fictions designed to identify, couched in the real text. Rewording them still confers the fingerprinted meaning.
- logfromblammo 10y agoUse an automatic document processor written by someone else to paraphrase the text. I imagine such a program already exists among top-shelf university student cheating service providers to defeat the academic plagiarism detectors. (If not, write one, and sell it to leak sites and to cheating service providers. $$$)
- Retra 10y agoAKA the "roll your own crypto" strategy.
- logfromblammo 10y agoI fail to see how using an existing tool if it exists, and writing it only if it does not qualifies as "roll your own crypto". Automatic paraphrasing would defeat the writing style analysis suggested by cousin post.
- r0muald 10y agoI found analog loopholes are the most basic countermeasure to document fingerprinting.
- stuckagain 10y agoPrinting and scanning would defeat fingerprint in the form of invisible Unicode whitespace and combining characters. Retyping everything would be good.
- ricardobeat 10y agoHow about maybe using a computer to extract all non-ASCII characters and output plain text instead of retyping everything?
- caseysoftware 10y agoNo. No. NO. That is only one type of fingerprinting used. The actual process is inserting typos and slightly different phrasing in various places. So if someone leaks the entire document or copy/pastes from it or takes a picture or whatever, it's trackable. And yes, I worked in that space for quite a while.
- mrskeltal 10y agoAnd how do you counter that?
- willvarfar 10y agoConnect to google translate over tor and get them to translate it french and back again perhaps?
- ComodoHacker 10y agoThen your evidence translates into gossip.
- j2kun 10y agoThis strikes me as a clever idea :)
- jerf 10y agoSome stuff will survive that, like a proper noun that doesn't translate in either direction and is given a characteristic misspelling, possibly combined with other hints. Sentence order will survive too, as well as higher-level structure. There are so many places in a document that is several dozen kilobytes large to hide bits that it probably impossible to ever be sure you've scrubbed them. Especially since it won't take that many bits to identify the source. Hiding the bits doesn't even have to be done via clever textual manipulation; it is a standard part of the intelligence game to make up entire facts with no basis in reality and then see where they leak out, then trace back. No amount of cleverness will save you from that.
- leni536 10y agoIf you have the chance to download documents from multiple accounts and IPs, then you can check if the documents are the same bit-for-bit. If not then you can do some conversion routines, like pdf->(list of images)->merged to a single pdf again, and then you can compare the resulting documents from the different accounts. Fingerprints can be visible, but not obvious, so printing and scanning back could leave them in.
- ComodoHacker 10y ago>If you have the chance to download documents from multiple accounts and IPs, then you can check if the documents are the same bit-for-bit. Now imagine fingerprinting is done on the fly by your corporate proxy server.
- CobrastanJorji 10y agoI worked for a company that made a device back in the day. Many engineers had been issued one well before it was announced so that they could develop the software. Each device was carefully labeled with a sticker identifying whose device it was. A picture of one showed up on a blog as a leak. The leaker had sensibly put a black box over the sticker. The thing that neither the leaker nor any of the rest of us knew was that each device also had a series of bumps on the top and bottom of the device which uniquely identified it just as effectively as the sticker. He was fired instantly.
- btown 10y agoIn fact the sticker was probably there as a red herring, to give false confidence to the leaker that he had countered the fingerprinting!
- stordoff 10y agoI wonder if dazzle patterns[1] on pre-release Xbox Ones had a similar function. If each pattern was unique, you could only hide it by obfuscating most of the device. [1] http://uk.businessinsider.com/microsoft-xbox-one-leaked-to-a-customer-before-it-was-announced-2016-9 http://uk.businessinsider.com/microsoft-xbox-one-leaked-to-a...
- tscs37 10y agoRewrite the document. Swap around chapters and sections, use your own words, TLDR some sections, remove/replace images, etc.
- eternalban 10y ago> use your own words Not a good idea.