7 ms·

My organization built a similar tool that can find bad redactions caused when people just use a black rectangle on top of text in PDFs: https://free.law/project

My organization built a similar tool that can find bad redactions caused when people just use a black rectangle on top of text in PDFs: https://free.law/projects/x-ray https://free.law/projects/x-ray Very fun project. Lots of problems out there.

steelstraw 5y ago
Interesting. They have the right idea (using a black rectangle) but in the wrong program. I can see how this could trip up non-technical people.
pkaye 5y ago
Seems like even the size of the rectangle would give hints on what it is redacting. For example "Yes" has a bigger box vs "No".
- Mountain_Skies 5y ago
  Yes, it's been that way long before PDFs. Simply knowing the potential words, often names, that could appear in a document, gives those with the redacted documents a chance at determining what has been hidden based on size. This might be part of the reason why when declassifying documents, the redactions end up being more of a sentence than is needed. The extra buffer of hidden words gives some additional protection to what needs to be redacted.
- praptak 5y ago
  A malicious "redacting" algorithm submitted to the underhanded C contest used a similar idea, just on lower level. PNG allows ASCII numbers, so flipping all digits to 0 creates a pixel which is graphically "masked" but leaks information about the original pixel: "000" means the value was larger than 99.
  - anderskaseorg 5y ago
    That’s PPM format, not PNG. http://underhanded-c.org/_page_id_17.html http://underhanded-c.org/_page_id_17.html http://netpbm.sourceforge.net/doc/ppm.html http://netpbm.sourceforge.net/doc/ppm.html
- lnauta 5y ago
  This reminds me of one of my proudest moments in high school. For a test in German class (my worst class), the teacher had just used tippex to remove some words and put them next to the text, and we had to fill them back in. I grabbed my ruler and measured all the sizes. There was 1 very long word, many medium sizes and a few smaller ones, but with this information and the context of the text for the first and last time I was able to get my first and last 10/10 in this class.
cobookman 5y ago
Am I the only one who redacts info, prints it out, then scans it back in? Or redacts, then takes a screenshot before sending out? For some reason I just never trust the PDF tool (or human error on my end) actually redacting the info, even if I were to do a print to PDF.
- kortex 5y ago
  Nope. That's called rebroadcast. It's also used to try to "launder" photo manipulations, like compositing. I helped work on some algorithms which could pick up artifacts even after rebroadcast. I would absolutely not trust pdf not to leak metadata. Although now you risk metadata leak from the printer or scanner, which may or may not affect your threat model.
- KyeRussell 5y ago
  When a coworker asked me for my recommended method of creating and publicly sharing redacted copies of documents which (in their unredacted forms) contained PII for children, I told them to do this, in no uncertain terms.
- dragonwriter 5y ago
  > Am I the only one who redacts info, prints it out, then scans it back in? if you have the source document, redacting from the source (by actually removing and replacing with an appropriate placeholder, not obscuring, the content) and regenerate the static (e.g., PDF) version. If you are working from print, I think scan and redact by digital replacement (not overlay or otherwise obscure) would be sufficient. Redact->print->scan probably helps somewhat (especially if the scan is low quality) if you are using a bad redaction method to start with, but why do that?
- sbierwagen 5y ago
  Careful what printer you use to print it out, some of them add patterns of dots that can uniquely identify the print: https://en.wikipedia.org/wiki/Machine_Identification_Code https://en.wikipedia.org/wiki/Machine_Identification_Code
- Markoff 5y ago
Markoff 5y ago
That's why you always Print to PDF the document and not just save it, I'm amazed people save documents instead printing them.
- phito 5y ago
  You're amazed that people use the conventional "save" method instead of a weird option in the print menu?
  - Markoff 5y ago
    If they go lengths to protect some information, then yes I'm amazed they forget about such simple precaution.
    - 542354234235 5y ago
      Wanting to redact information is not a subset of PDF knowledge. Understanding how PDFs work is not a prerequisite of desire to redact information. Lots of people have only the most basic rudimentary understand of how PDFs work, how Adobe works, and the limits or capabilities.
- alpaca128 5y ago
  A lot of people don't even know you can print to a file instead of paper. Not sure why you're surprised about that, after all the standard method for all formats is "save as" or "export" and it's reasonable to assume those two options include all possible ways to save a file. It's a UI quirk that goes against user expectations.
- justsomehnguy 5y ago
  Doesn't help if the output type is wrong. Recently discovered a manual forr some home appliance with a clear Word comment along with username, seems like slipped in when the manual was translated.
unglaublich 5y ago
On MacOS, preview makes a clear distinction between 'drawing on' and 'redacting' PDFs. It is an important part of UX that shooting yourself in the foot should _not_ be the default.

steelstraw 5y ago

Interesting. They have the right idea (using a black rectangle) but in the wrong program. I can see how this could trip up non-technical people.

pkaye 5y ago

Seems like even the size of the rectangle would give hints on what it is redacting. For example "Yes" has a bigger box vs "No".

Mountain_Skies 5y ago
Yes, it's been that way long before PDFs. Simply knowing the potential words, often names, that could appear in a document, gives those with the redacted documents a chance at determining what has been hidden based on size. This might be part of the reason why when declassifying documents, the redactions end up being more of a sentence than is needed. The extra buffer of hidden words gives some additional protection to what needs to be redacted.
praptak 5y ago
A malicious "redacting" algorithm submitted to the underhanded C contest used a similar idea, just on lower level. PNG allows ASCII numbers, so flipping all digits to 0 creates a pixel which is graphically "masked" but leaks information about the original pixel: "000" means the value was larger than 99.
- anderskaseorg 5y ago
  That’s PPM format, not PNG. http://underhanded-c.org/_page_id_17.html http://underhanded-c.org/_page_id_17.html http://netpbm.sourceforge.net/doc/ppm.html http://netpbm.sourceforge.net/doc/ppm.html
lnauta 5y ago
This reminds me of one of my proudest moments in high school. For a test in German class (my worst class), the teacher had just used tippex to remove some words and put them next to the text, and we had to fill them back in. I grabbed my ruler and measured all the sizes. There was 1 very long word, many medium sizes and a few smaller ones, but with this information and the context of the text for the first and last time I was able to get my first and last 10/10 in this class.

cobookman 5y ago

Am I the only one who redacts info, prints it out, then scans it back in? Or redacts, then takes a screenshot before sending out? For some reason I just never trust the PDF tool (or human error on my end) actually redacting the info, even if I were to do a print to PDF.

kortex 5y ago
Nope. That's called rebroadcast. It's also used to try to "launder" photo manipulations, like compositing. I helped work on some algorithms which could pick up artifacts even after rebroadcast. I would absolutely not trust pdf not to leak metadata. Although now you risk metadata leak from the printer or scanner, which may or may not affect your threat model.
KyeRussell 5y ago
When a coworker asked me for my recommended method of creating and publicly sharing redacted copies of documents which (in their unredacted forms) contained PII for children, I told them to do this, in no uncertain terms.
dragonwriter 5y ago
> Am I the only one who redacts info, prints it out, then scans it back in? if you have the source document, redacting from the source (by actually removing and replacing with an appropriate placeholder, not obscuring, the content) and regenerate the static (e.g., PDF) version. If you are working from print, I think scan and redact by digital replacement (not overlay or otherwise obscure) would be sufficient. Redact->print->scan probably helps somewhat (especially if the scan is low quality) if you are using a bad redaction method to start with, but why do that?
sbierwagen 5y ago
Careful what printer you use to print it out, some of them add patterns of dots that can uniquely identify the print: https://en.wikipedia.org/wiki/Machine_Identification_Code https://en.wikipedia.org/wiki/Machine_Identification_Code
Markoff 5y ago

Markoff 5y ago

That's why you always Print to PDF the document and not just save it, I'm amazed people save documents instead printing them.

phito 5y ago
You're amazed that people use the conventional "save" method instead of a weird option in the print menu?
- Markoff 5y ago
  If they go lengths to protect some information, then yes I'm amazed they forget about such simple precaution.
  - 542354234235 5y ago
    Wanting to redact information is not a subset of PDF knowledge. Understanding how PDFs work is not a prerequisite of desire to redact information. Lots of people have only the most basic rudimentary understand of how PDFs work, how Adobe works, and the limits or capabilities.
alpaca128 5y ago
A lot of people don't even know you can print to a file instead of paper. Not sure why you're surprised about that, after all the standard method for all formats is "save as" or "export" and it's reasonable to assume those two options include all possible ways to save a file. It's a UI quirk that goes against user expectations.
justsomehnguy 5y ago
Doesn't help if the output type is wrong. Recently discovered a manual forr some home appliance with a clear Word comment along with username, seems like slipped in when the manual was translated.

unglaublich 5y ago

On MacOS, preview makes a clear distinction between 'drawing on' and 'redacting' PDFs. It is an important part of UX that shooting yourself in the foot should _not_ be the default.