3 ms·

The real question you should be asking yourself is how hard it is to fake these. If I get hold of someones copies, can I use them as template?

by bobsam 9y ago

kemiller2002 9y ago
I think this is an excellent example of why security through obscurity is a bad idea. Now that we know they are there, it's only a matter of time before they are all broken and duplicated. How hard is it? I don't know, but I can't imagine that its impossible. Given time and technology, someone will figure how to forge these without difficulty. They were clearly betting on the fact that no one would notice they are there. What scares me is we're just finding this out. How long have criminal organizations and rogue nations known about this and what have they used it for?
- schoen 9y ago
  I'm confused about why people consistently think that this was a total secret, no matter how many waves of press coverage it gets. https://en.wikipedia.org/wiki/Printer_steganography https://en.wikipedia.org/wiki/Printer_steganography There were press articles about it by 2004 (and I think some earlier), we had written the tool that Rob Graham used to decode these scans by 2005, and I gave a number of TV interviews about it during 2005. A small number of manufacturers (maybe worried about European data protection laws) also alluded to the existence of the technology in their user manuals. Some of the people from industry who contacted me also said that this was common knowledge to people in the printing industry since at least the turn of the millennium.
  - rhizome 9y ago
    people consistently think that this was a total secret As far as I've seen, this isn't true.
    - schoen 9y ago
      Maybe I should say "regularly"?
      - taeric 9y ago
        I'm curious if there is a "half life" to this knowledge. Or, rather, what that would be.
      - rhizome 9y ago
        It sounds like you're being surprised that anybody doesn't know about it, even if they're in a risky position themselves, which seems disingenuous. Before today, what was the most likely path to this knowledge? As in one month ago...and how many 26 year olds have occasion to learn themselves the details of printers? Nobody uses printers. Yes, working in that position it would be more likely, but she still could merely be a corner case when it comes to laser printer dot awareness, even within the IC.
  - Mathnerd314 9y ago
    None of those are enough. Unless the spying feature is directly marketed to consumers, e.g. a TV ad that says "Buy a color printer THAT SPIES ON YOU today!", >92% of the population will never learn about it. (That estimate being from the # who don't read license agreements: https://measuringu.com/eula/ https://measuringu.com/eula/) Generally, anything that less than half of the population knows abut is a secret (e.g., menstruation is still called a "secret" in some circles...), so you shouldn't be confused, just disappointed at how gullible / uninformed the average person is.
    - bubblethink 9y ago
      >Unless the spying feature is directly marketed to consumers, e.g. a TV ad that says "Buy a color printer THAT SPIES ON YOU today!", >92% of the population will never learn about it. Heh. The tagline for this car HUD (http://www.jbl.com/connected-car/CP100+LEGEND.html http://www.jbl.com/connected-car/CP100+LEGEND.html) says, "Now your car can be on the grid too". That's getting pretty close to your tagline.
- cestith 9y ago
  Print sensitive documents at FedEx Office or Staples and pay in cash. It's the only way to be sure. There were magazine articles, newspaper articles, and news site discussions about this years ago. They covered it being added to stop color laser printers and dye sublimation printers from being used for currency counterfeiting. That the tech community has this short of a communal memory astounds and saddens me. Even beyond the public knowledge of this tactic, that Reality Winner was working at an intelligence agency and was silly enough to think said intelligence agency couldn't track what had been printed in its own offices is laughable. Either she had no business working in that environment as she clearly doesn't understand their mission and methods or she's a scapegoat. * 2014 - PC World - http://www.pcworld.com/article/229647/counterfeit_money_on_color_laser_printers.html http://www.pcworld.com/article/229647/counterfeit_money_on_c... * 2004 - PC World - http://www.pcworld.com/article/118664/article.html http://www.pcworld.com/article/118664/article.html * 2005 - Washington Post, stating it had been in use at least ten years, and that at least one version of the yellow dot code had been broken. - http://www.washingtonpost.com/wp-dyn/content/article/2005/10/18/AR2005101801663.html http://www.washingtonpost.com/wp-dyn/content/article/2005/10... * 2004 - Slashdot - https://hardware.slashdot.org/story/04/02/06/1513255/hp-discusses-anti-counterfeiting-measures https://hardware.slashdot.org/story/04/02/06/1513255/hp-disc... * 2004 - Geek.com - https://www.geek.com/news/color-laser-printers-allow-feds-to-track-your-documents-557002/ https://www.geek.com/news/color-laser-printers-allow-feds-to... I could probably easily find more.

The real question you should be asking yourself is how hard it is to fake these. If I get hold of someones copies, can I use them as template?

by bobsam 9y ago

The real question you should be asking yourself is how hard it is to fake these. If I get hold of someones copies, can I use them as template?

kemiller2002 9y ago

I think this is an excellent example of why security through obscurity is a bad idea. Now that we know they are there, it's only a matter of time before they are all broken and duplicated. How hard is it? I don't know, but I can't imagine that its impossible. Given time and technology, someone will figure how to forge these without difficulty. They were clearly betting on the fact that no one would notice they are there. What scares me is we're just finding this out. How long have criminal organizations and rogue nations known about this and what have they used it for?

schoen 9y ago
I'm confused about why people consistently think that this was a total secret, no matter how many waves of press coverage it gets. https://en.wikipedia.org/wiki/Printer_steganography https://en.wikipedia.org/wiki/Printer_steganography There were press articles about it by 2004 (and I think some earlier), we had written the tool that Rob Graham used to decode these scans by 2005, and I gave a number of TV interviews about it during 2005. A small number of manufacturers (maybe worried about European data protection laws) also alluded to the existence of the technology in their user manuals. Some of the people from industry who contacted me also said that this was common knowledge to people in the printing industry since at least the turn of the millennium.
- rhizome 9y ago
  people consistently think that this was a total secret As far as I've seen, this isn't true.
  - schoen 9y ago
    Maybe I should say "regularly"?
    - taeric 9y ago
      I'm curious if there is a "half life" to this knowledge. Or, rather, what that would be.
    - rhizome 9y ago
      It sounds like you're being surprised that anybody doesn't know about it, even if they're in a risky position themselves, which seems disingenuous. Before today, what was the most likely path to this knowledge? As in one month ago...and how many 26 year olds have occasion to learn themselves the details of printers? Nobody uses printers. Yes, working in that position it would be more likely, but she still could merely be a corner case when it comes to laser printer dot awareness, even within the IC.
- Mathnerd314 9y ago
  None of those are enough. Unless the spying feature is directly marketed to consumers, e.g. a TV ad that says "Buy a color printer THAT SPIES ON YOU today!", >92% of the population will never learn about it. (That estimate being from the # who don't read license agreements: https://measuringu.com/eula/ https://measuringu.com/eula/) Generally, anything that less than half of the population knows abut is a secret (e.g., menstruation is still called a "secret" in some circles...), so you shouldn't be confused, just disappointed at how gullible / uninformed the average person is.
  - bubblethink 9y ago
    >Unless the spying feature is directly marketed to consumers, e.g. a TV ad that says "Buy a color printer THAT SPIES ON YOU today!", >92% of the population will never learn about it. Heh. The tagline for this car HUD (http://www.jbl.com/connected-car/CP100+LEGEND.html http://www.jbl.com/connected-car/CP100+LEGEND.html) says, "Now your car can be on the grid too". That's getting pretty close to your tagline.
cestith 9y ago
Print sensitive documents at FedEx Office or Staples and pay in cash. It's the only way to be sure. There were magazine articles, newspaper articles, and news site discussions about this years ago. They covered it being added to stop color laser printers and dye sublimation printers from being used for currency counterfeiting. That the tech community has this short of a communal memory astounds and saddens me. Even beyond the public knowledge of this tactic, that Reality Winner was working at an intelligence agency and was silly enough to think said intelligence agency couldn't track what had been printed in its own offices is laughable. Either she had no business working in that environment as she clearly doesn't understand their mission and methods or she's a scapegoat. * 2014 - PC World - http://www.pcworld.com/article/229647/counterfeit_money_on_color_laser_printers.html http://www.pcworld.com/article/229647/counterfeit_money_on_c... * 2004 - PC World - http://www.pcworld.com/article/118664/article.html http://www.pcworld.com/article/118664/article.html * 2005 - Washington Post, stating it had been in use at least ten years, and that at least one version of the yellow dot code had been broken. - http://www.washingtonpost.com/wp-dyn/content/article/2005/10/18/AR2005101801663.html http://www.washingtonpost.com/wp-dyn/content/article/2005/10... * 2004 - Slashdot - https://hardware.slashdot.org/story/04/02/06/1513255/hp-discusses-anti-counterfeiting-measures https://hardware.slashdot.org/story/04/02/06/1513255/hp-disc... * 2004 - Geek.com - https://www.geek.com/news/color-laser-printers-allow-feds-to-track-your-documents-557002/ https://www.geek.com/news/color-laser-printers-allow-feds-to... I could probably easily find more.