5 ms·

Most of these forensic findings use publicly known techniques. What does intrigue me is how they managed to determine the graphics card. Anyone?

tpmx 4y ago
It's odd. If it was from microdots they should know a lot more than about the printer than "most likely an HP inkjet".
- rob74 4y ago
  Or they do know more, but they're not releasing everything? The details they have published are not that useful in pinpointing a suspect - I mean, there are probably thousands of Norwegians who have a PC/laptop with Intel integrated graphics, Windows 8/10, an HP printer and who buy paper and envelopes from Clas Ohlson (a chain with over 200 stores).
  - dontlaugh 4y ago
    If they knew both, it would be odd to say an exact GPU model but not a printer model.
  - vintermann 4y ago
    Thousands are not that many. There's going to be a lot of people you can exclude from a crypto currency ransom/murder case planned at least 6 months in advance.
- sim7c00 4y ago
  there's a lot of techniques used in such research which is not 'public knowledge' (even though a lot of techies might know them). Hence, information might purposfully be a bit vague, to give the idea they did not reach certain conclusions. I'd expect they would, as you, know the exact model and make of the printer if it was microdots. They can also have libraries of things printed with lots of printers to analyse the quality of print etc., and then get an estimate for example by a neural network examining artefacts. in such a case, it would never be 100% certain, but maybe 95-99% range somewhere if they do it good. I can _imagine_ such techniques might even also get to the point where they can somewhat certainly identify other aspects of the pc like graphics cards, even though they don't know exactly how the network will draw these conclusions.
phire 4y ago
It could theoretically effect font rendering, but I really doubt it. It's more likely the printer driver have encoded information about the gpu into the yellow microdots [1] that many color printers use to trace pages. But if they have microdots, then they really should have more information. [1] https://en.wikipedia.org/wiki/Machine_Identification_Code https://en.wikipedia.org/wiki/Machine_Identification_Code
- cm2187 4y ago
  What about B&W laser printers?
  - phire 4y ago
    They typically don't do watermarking. The whole justification was stopping the counterfitting of currency, since color printers can produce quite good results for near zero effort. And you can't really use a b&w laser to print convincing notes.
    - lupire 4y ago
      But now the gov wants to spy more, so they should have light grey tracking dots.
    - deleted 4y ago
      [deleted]
  - codedokode 4y ago
    They can use black microdots, I guess? Or some kind of stenography in the printed image.
hoistbypetard 4y ago
> What does intrigue me is how they managed to determine the graphics card. Cheap GDI printers use the PC for rendering. I find it a bit surprising that would give enough to identify a specific card from a printed sample, but it certainly seems plausible.
kuroguro 4y ago
There's quite a few papers on browser fingerprinting via canvas / webgl, I assume it's similar. Here's one talking about (among other things) fonts and GPU detection: https://hovav.net/ucsd/dist/canvas.pdf https://hovav.net/ucsd/dist/canvas.pdf
1970-01-01 4y ago
PCL6 and WYSIWYG is my guess. https://support.hp.com/us-en/document/c00068221#AbT3 https://support.hp.com/us-en/document/c00068221#AbT3

tpmx 4y ago

It's odd. If it was from microdots they should know a lot more than about the printer than "most likely an HP inkjet".

rob74 4y ago
Or they do know more, but they're not releasing everything? The details they have published are not that useful in pinpointing a suspect - I mean, there are probably thousands of Norwegians who have a PC/laptop with Intel integrated graphics, Windows 8/10, an HP printer and who buy paper and envelopes from Clas Ohlson (a chain with over 200 stores).
- dontlaugh 4y ago
  If they knew both, it would be odd to say an exact GPU model but not a printer model.
- vintermann 4y ago
  Thousands are not that many. There's going to be a lot of people you can exclude from a crypto currency ransom/murder case planned at least 6 months in advance.
sim7c00 4y ago
there's a lot of techniques used in such research which is not 'public knowledge' (even though a lot of techies might know them). Hence, information might purposfully be a bit vague, to give the idea they did not reach certain conclusions. I'd expect they would, as you, know the exact model and make of the printer if it was microdots. They can also have libraries of things printed with lots of printers to analyse the quality of print etc., and then get an estimate for example by a neural network examining artefacts. in such a case, it would never be 100% certain, but maybe 95-99% range somewhere if they do it good. I can _imagine_ such techniques might even also get to the point where they can somewhat certainly identify other aspects of the pc like graphics cards, even though they don't know exactly how the network will draw these conclusions.

phire 4y ago

It could theoretically effect font rendering, but I really doubt it. It's more likely the printer driver have encoded information about the gpu into the yellow microdots [1] that many color printers use to trace pages. But if they have microdots, then they really should have more information. [1] https://en.wikipedia.org/wiki/Machine_Identification_Code https://en.wikipedia.org/wiki/Machine_Identification_Code

cm2187 4y ago
What about B&W laser printers?
- phire 4y ago
  They typically don't do watermarking. The whole justification was stopping the counterfitting of currency, since color printers can produce quite good results for near zero effort. And you can't really use a b&w laser to print convincing notes.
  - lupire 4y ago
    But now the gov wants to spy more, so they should have light grey tracking dots.
  - deleted 4y ago
    [deleted]
- codedokode 4y ago
  They can use black microdots, I guess? Or some kind of stenography in the printed image.

hoistbypetard 4y ago

> What does intrigue me is how they managed to determine the graphics card. Cheap GDI printers use the PC for rendering. I find it a bit surprising that would give enough to identify a specific card from a printed sample, but it certainly seems plausible.

kuroguro 4y ago

There's quite a few papers on browser fingerprinting via canvas / webgl, I assume it's similar. Here's one talking about (among other things) fonts and GPU detection: https://hovav.net/ucsd/dist/canvas.pdf https://hovav.net/ucsd/dist/canvas.pdf

1970-01-01 4y ago

PCL6 and WYSIWYG is my guess. https://support.hp.com/us-en/document/c00068221#AbT3 https://support.hp.com/us-en/document/c00068221#AbT3