4 ms·

A dead simple way to thwart the “screenshot” attack is to release a tool for accurately falsifying a screenshot. I’ve never seen this employed in practice thoug

A dead simple way to thwart the “screenshot” attack is to release a tool for accurately falsifying a screenshot. I’ve never seen this employed in practice though.

tedunangst 8y ago
How is any bitmap editor not such a tool?
- lozaning 8y ago
  I think they're talking more along the lines of those online meme editors. Yea i could download the lion king and clip the frame with simba and then pull it into photo shop and then add text and then upload it to imgur. Or I could go one of those online meme editors in click the photo and enter my text and then get a link to the meme I made. The whole point is to totally lower the bar for anyone to make a passable copy, thus removing all confidence that any screen shot is genuine.
- ggg9990 8y ago
  If it’s made by the company making the messaging app, it will be pixel perfect, and will only take a few seconds to make instead of a few hours. And if you create one for a date in the past they can use the UI they had at that time.
Nadya 8y ago
Photo, audio, and video evidence should already be dismissed until one is able to verify the integrity and source. All of these can already be believably faked - it's just a matter of educating people that a layperson can easily create fake things by using tools developed by research teams. Fake text is the easiest to fake if you can identify the font used - any image editor will work. HN uses 9pt Verdana, even without using dev tools I could fake your post to say anything I wanted it to say since it would just be 9pt Verdana on a solid background set to text wrap every 1050px. See: https://www.youtube.com/watch?v=ohmajJTcpNk https://www.youtube.com/watch?v=ohmajJTcpNk & https://www.youtube.com/watch?v=AmUC4m6w1wo https://www.youtube.com/watch?v=AmUC4m6w1wo
- marcus_holmes 8y ago
  Not even that much effort, just open the browser's dev tools and change the text in the post to say whatever you like.
  - Nadya 8y ago
    I'm aware - but specifically excluded dev tools as faking text in scenarios where dev tools may not exist (eg: chat programs that aren't taking place within the browser) is still trivial.
dogma1138 8y ago
Apps do screenshot detection but again nothing beat the old Polaroid. Any DLP or DRM can be circumvented using analog means.
LeifCarrotson 8y ago
That's an interesting way to combat certain kinds of attacks - those in which the screenshot 'reveals' embarrassing, illicit, or illegal communication: things you've done or intend to do that have no external evidence aside from the message itself. But it does not combat attacks that are not embarrassing but rather a release of information you are known to have but which is intended to be kept secret, or which is easily verified: if someone captures your social security number, private key, or home address in a screenshot, you'd better be really good at bluffing.
- ggg9990 8y ago
  If I release data that only I have, it’s obvious that I released it. If I release data that two people have, I can counter your screenshot with a faked screenshot of my own.

A dead simple way to thwart the “screenshot” attack is to release a tool for accurately falsifying a screenshot. I’ve never seen this employed in practice though.

tedunangst 8y ago

How is any bitmap editor not such a tool?

lozaning 8y ago
I think they're talking more along the lines of those online meme editors. Yea i could download the lion king and clip the frame with simba and then pull it into photo shop and then add text and then upload it to imgur. Or I could go one of those online meme editors in click the photo and enter my text and then get a link to the meme I made. The whole point is to totally lower the bar for anyone to make a passable copy, thus removing all confidence that any screen shot is genuine.
ggg9990 8y ago
If it’s made by the company making the messaging app, it will be pixel perfect, and will only take a few seconds to make instead of a few hours. And if you create one for a date in the past they can use the UI they had at that time.

Nadya 8y ago

Photo, audio, and video evidence should already be dismissed until one is able to verify the integrity and source. All of these can already be believably faked - it's just a matter of educating people that a layperson can easily create fake things by using tools developed by research teams. Fake text is the easiest to fake if you can identify the font used - any image editor will work. HN uses 9pt Verdana, even without using dev tools I could fake your post to say anything I wanted it to say since it would just be 9pt Verdana on a solid background set to text wrap every 1050px. See: https://www.youtube.com/watch?v=ohmajJTcpNk https://www.youtube.com/watch?v=ohmajJTcpNk & https://www.youtube.com/watch?v=AmUC4m6w1wo https://www.youtube.com/watch?v=AmUC4m6w1wo

marcus_holmes 8y ago
Not even that much effort, just open the browser's dev tools and change the text in the post to say whatever you like.
- Nadya 8y ago
  I'm aware - but specifically excluded dev tools as faking text in scenarios where dev tools may not exist (eg: chat programs that aren't taking place within the browser) is still trivial.

dogma1138 8y ago

Apps do screenshot detection but again nothing beat the old Polaroid. Any DLP or DRM can be circumvented using analog means.

LeifCarrotson 8y ago

That's an interesting way to combat certain kinds of attacks - those in which the screenshot 'reveals' embarrassing, illicit, or illegal communication: things you've done or intend to do that have no external evidence aside from the message itself. But it does not combat attacks that are not embarrassing but rather a release of information you are known to have but which is intended to be kept secret, or which is easily verified: if someone captures your social security number, private key, or home address in a screenshot, you'd better be really good at bluffing.

ggg9990 8y ago
If I release data that only I have, it’s obvious that I released it. If I release data that two people have, I can counter your screenshot with a faked screenshot of my own.