4 ms·

> and if it is a PDF, convert to an image afterwards because too many PDF editors use non-destructive operations to add a new object instead of changing what's

> and if it is a PDF, convert to an image afterwards because too many PDF editors use non-destructive operations to add a new object instead of changing what's underneath. You'd be surprised at how many times this happens on Government documents with redaction. :S

banana_giraffe 6y ago
Even when the black box is done right, sometimes there are quasi side-channel leaks of the size. The box covering a name for instances may be discoverable if there are only a few names possible, and it's a small box, meaning it's the shortest name.
Someone1234 6y ago
That's why some even departments now have policies of printing and re-scanning retracted documents. It is dumb, but yet pretty hard to get wrong. Both MS Word and PDF have leaked redacted/removed information in the past. Wasting paper given the severity of some of these leaks is minimal cost.
- powersnail 6y ago
  Why don't they convert the PDF to image and convert back? This approach seems to be a lot more efficient, and less prone to other type of human errors (e.g. missing page). Is there still an attack vector?
  - mhh__ 6y ago
    It's a bit like point and speak checklists on aircraft - it takes a certain amount of energy to do so you can't skip it without doing it deliberately
    - Proziam 6y ago
      The Japanese train system utilizes similar concepts IIRC. When I first read about this I was astonished about how effective it was [0](up to 85% error reductions)! [0] https://www.atlasobscura.com/articles/pointing-and-calling-japan-trains https://www.atlasobscura.com/articles/pointing-and-calling-j... [1] https://news.ycombinator.com/item?id=18952193 https://news.ycombinator.com/item?id=18952193
      - frosted-flakes 6y ago
        Toronto and New York City use a similar point-only system on its subway systems. Without the white gloves though. https://www.theglobeandmail.com/canada/toronto/article-automation-will-mean-the-end-of-an-unusual-but-effective-safety/ https://www.theglobeandmail.com/canada/toronto/article-autom...
  - exikyut 6y ago
    If you do that, look at the document, hit CTRL+Z, then look at the document again, it will likely look identical, thanks to the fact that rendering a PDF to a JPEG with 70-90% quality... at ~600DPI... then scaling it back out to a 75-150DPI screen... is going to look visually lossless. So, not only do you have the energy-investment thing noted in the/a sibling comment, you have the issue that there's no giant "THIS IS AN IMAGE" or "THIS HAS TEXT IN IT" that you can just Look At and know that yeah the document is okay. There's no lowest-common-denominator provability thing. You have to hyperspecifically know what to look for (render to image) then know how to verify whether it's an image or not. And... how do you verify if it's an image? I don't have any PDF authoring/editing software on this machine, so the only thing I can think of is checking the Undo menu for "convert to image" or similar.
    - powersnail 6y ago
      There will be no CTRL + Z, as it can only be used to save to a new document (just like scanning). Under the hood, you created a new document, rasterize the original document page by page as JPEG, and insert the JPEGs back to the new document. You can even create a fake "printer", that outputs a PDF with rasterized images as pages, so you don't have to teach the office clerks to anything extra. To me, it seems to be indistinguishable from printing and scanning. PS: It's pretty easy to verify if the page contains nothing but an image, programmically, especially if you also wrote the software that rasterize it in the first place.
      - jooize 6y ago
        It is probably still easier to screw up on a computer than by looking at physical documents to verify them and then scanning them.
      - pessimizer 6y ago
        > It's pretty easy to verify if the page contains nothing but an image, programmically, especially if you also wrote the software that rasterize it in the first place. It's pretty easy for a computer to verify any of this, the point is making it idiot proof. You don't have to be much of an idiot, if you process hundreds of documents a year where there's no way to visually verify the difference between a badly redacted document and a well redacted document, to screw up once. Especially when the difference between them is that you remembered to push the "redact correctly button", and if you forgot that, remembered to push the "verify if is redacted correctly programmatically" button before hitting send. What you do is create a ritual where you have to walk across the room and use a physical machine. You'll remember doing that. And if you don't, since the output will look a bit crap, you can confirm it trivially. Creating a process that has to be done perfectly every time or it fails catastrophically, and has few indications of failure during the process, is worse than having no process at all.
- Freak_NL 6y ago
  If it is hard to get wrong, is it still dumb? Being able to verify with your own eyes that the redacted parts are indeed redacted is a pretty strong benefit to that process. You'll need to train staff to properly black out stuff (no idea what they do, heavy cardboard cut-outs or cutting out the censored content and using a black background for the scan?), but once that process is in place, it works. With software you either need vetted and approved, very expensive software, or you have to accept a much higher error rate, because the operator cannot verify the results of the process with certainty.
  - eru 6y ago
    Incidentally, you just wrote a pretty good argument for (political) voting on paper instead of via machines.
    - Freak_NL 6y ago
      Absolutely. A system you can see and understand garners a lot more trust than a black-box (even if the box runs vetted and open software).
    - aidenn0 6y ago
      I think the correct solution is a machine that prints out both a human- and machine-readable representation of the vote. The voter can confirm that the human-readable representation is correct, and you can randomly hand-count a few boxes of ballots to check that the hand-count matches the machine-count. An election doesn't need to be tamper-proof we just need to be able to detect tampering well enough to make tampering a loser's game.
      - cesarb 6y ago
        It's not just tampering one needs to worry about with elections. There's also secrecy (to prevent voter coercion).
        aidenn0 6y ago
- techdragon 6y ago
  Then they use the big multifunction networked printer’s built in scanner, which saves a copy to the “little” hard drive they all tend to have in them now, and forget to ensure these things get wiped/destroyed... years later they sell the printer once the lease ends and the surprise inside is months to years of raw scanned documents the new owner gets access to with very little effort.
Agentlien 6y ago
A friend of mine once had to review some (Swedish) court document with redacted witness names. It was a word document with history intact. Just undoing a few steps was all it took.
- taneq 6y ago
  One of my lecturers did that back at university - they generated an Excel spreadsheet containing everyone's marks, then for each student, deleted all but that student and saved as a different file. Document history was turned on and anyone who hit ctrl+z got the full class marks. (The same lecturer initially failed me because they forgot to add my final exam score to my assignments score, and then took four months to fix it. They weren't very competent.)

banana_giraffe 6y ago

Even when the black box is done right, sometimes there are quasi side-channel leaks of the size. The box covering a name for instances may be discoverable if there are only a few names possible, and it's a small box, meaning it's the shortest name.

Someone1234 6y ago

That's why some even departments now have policies of printing and re-scanning retracted documents. It is dumb, but yet pretty hard to get wrong. Both MS Word and PDF have leaked redacted/removed information in the past. Wasting paper given the severity of some of these leaks is minimal cost.

powersnail 6y ago
Why don't they convert the PDF to image and convert back? This approach seems to be a lot more efficient, and less prone to other type of human errors (e.g. missing page). Is there still an attack vector?
- mhh__ 6y ago
  It's a bit like point and speak checklists on aircraft - it takes a certain amount of energy to do so you can't skip it without doing it deliberately
  - Proziam 6y ago
    The Japanese train system utilizes similar concepts IIRC. When I first read about this I was astonished about how effective it was [0](up to 85% error reductions)! [0] https://www.atlasobscura.com/articles/pointing-and-calling-japan-trains https://www.atlasobscura.com/articles/pointing-and-calling-j... [1] https://news.ycombinator.com/item?id=18952193 https://news.ycombinator.com/item?id=18952193
    - frosted-flakes 6y ago
      Toronto and New York City use a similar point-only system on its subway systems. Without the white gloves though. https://www.theglobeandmail.com/canada/toronto/article-automation-will-mean-the-end-of-an-unusual-but-effective-safety/ https://www.theglobeandmail.com/canada/toronto/article-autom...
- exikyut 6y ago
  If you do that, look at the document, hit CTRL+Z, then look at the document again, it will likely look identical, thanks to the fact that rendering a PDF to a JPEG with 70-90% quality... at ~600DPI... then scaling it back out to a 75-150DPI screen... is going to look visually lossless. So, not only do you have the energy-investment thing noted in the/a sibling comment, you have the issue that there's no giant "THIS IS AN IMAGE" or "THIS HAS TEXT IN IT" that you can just Look At and know that yeah the document is okay. There's no lowest-common-denominator provability thing. You have to hyperspecifically know what to look for (render to image) then know how to verify whether it's an image or not. And... how do you verify if it's an image? I don't have any PDF authoring/editing software on this machine, so the only thing I can think of is checking the Undo menu for "convert to image" or similar.
  - powersnail 6y ago
    There will be no CTRL + Z, as it can only be used to save to a new document (just like scanning). Under the hood, you created a new document, rasterize the original document page by page as JPEG, and insert the JPEGs back to the new document. You can even create a fake "printer", that outputs a PDF with rasterized images as pages, so you don't have to teach the office clerks to anything extra. To me, it seems to be indistinguishable from printing and scanning. PS: It's pretty easy to verify if the page contains nothing but an image, programmically, especially if you also wrote the software that rasterize it in the first place.
    - jooize 6y ago
      It is probably still easier to screw up on a computer than by looking at physical documents to verify them and then scanning them.
    - pessimizer 6y ago
      > It's pretty easy to verify if the page contains nothing but an image, programmically, especially if you also wrote the software that rasterize it in the first place. It's pretty easy for a computer to verify any of this, the point is making it idiot proof. You don't have to be much of an idiot, if you process hundreds of documents a year where there's no way to visually verify the difference between a badly redacted document and a well redacted document, to screw up once. Especially when the difference between them is that you remembered to push the "redact correctly button", and if you forgot that, remembered to push the "verify if is redacted correctly programmatically" button before hitting send. What you do is create a ritual where you have to walk across the room and use a physical machine. You'll remember doing that. And if you don't, since the output will look a bit crap, you can confirm it trivially. Creating a process that has to be done perfectly every time or it fails catastrophically, and has few indications of failure during the process, is worse than having no process at all.
Freak_NL 6y ago
If it is hard to get wrong, is it still dumb? Being able to verify with your own eyes that the redacted parts are indeed redacted is a pretty strong benefit to that process. You'll need to train staff to properly black out stuff (no idea what they do, heavy cardboard cut-outs or cutting out the censored content and using a black background for the scan?), but once that process is in place, it works. With software you either need vetted and approved, very expensive software, or you have to accept a much higher error rate, because the operator cannot verify the results of the process with certainty.
- eru 6y ago
  Incidentally, you just wrote a pretty good argument for (political) voting on paper instead of via machines.
  - Freak_NL 6y ago
    Absolutely. A system you can see and understand garners a lot more trust than a black-box (even if the box runs vetted and open software).
  - aidenn0 6y ago
    I think the correct solution is a machine that prints out both a human- and machine-readable representation of the vote. The voter can confirm that the human-readable representation is correct, and you can randomly hand-count a few boxes of ballots to check that the hand-count matches the machine-count. An election doesn't need to be tamper-proof we just need to be able to detect tampering well enough to make tampering a loser's game.
    - cesarb 6y ago
      It's not just tampering one needs to worry about with elections. There's also secrecy (to prevent voter coercion).
      - aidenn0 6y ago
techdragon 6y ago
Then they use the big multifunction networked printer’s built in scanner, which saves a copy to the “little” hard drive they all tend to have in them now, and forget to ensure these things get wiped/destroyed... years later they sell the printer once the lease ends and the surprise inside is months to years of raw scanned documents the new owner gets access to with very little effort.

Agentlien 6y ago

A friend of mine once had to review some (Swedish) court document with redacted witness names. It was a word document with history intact. Just undoing a few steps was all it took.

taneq 6y ago
One of my lecturers did that back at university - they generated an Excel spreadsheet containing everyone's marks, then for each student, deleted all but that student and saved as a different file. Document history was turned on and anyone who hit ctrl+z got the full class marks. (The same lecturer initially failed me because they forgot to add my final exam score to my assignments score, and then took four months to fix it. They weren't very competent.)