3 ms·

Being fair, if anyone is sending anything to the client and assumes it's not visible then they are fair game. I just hope the code around password entry fields

Being fair, if anyone is sending anything to the client and assumes it's not visible then they are fair game. I just hope the code around password entry fields is carefully audited. That's all on the client.

version_five 4y ago
There's a story from years ago (I couldn't find it) about some government or legal documents having info redacted, but whoever did it just used some pdf editing tool to draw black boxes over the redacted parts, so all the info was still in the pdfs. Edit: I found this but I'm not sure it's the one I'm remembering: https://www.techdirt.com/2014/01/28/new-york-times-suffers-redaction-failure-exposes-name-nsa-agent-targeted-network-uploaded-pdf/ https://www.techdirt.com/2014/01/28/new-york-times-suffers-r...
- perth 4y ago
  This happened with the Maxwell redacted court docs
  - lliamander 4y ago
    Do you have a link to the unrelated docs?
    - lliamander 4y ago
      *unredacted Stupid autocorrect
- karlshea 4y ago
  One of the Apple v Samsung (?) cases had court docs released with some App Store numbers redacted but it was just black squares over the actual numbers, just selecting the sentence and copy/pasting it gave it to you.
kevincox 4y ago
Yes, but there is more than that there. What if I as the client try to print a page or export to PDF. I think that there is nothing sensitive visible on the page so I share the result. It turns out that there was actually sensitive info in the canvas that was not visible due to something like overdraw. As a simple example imagine that an image is drawn to the canvas and then blacked out. You wouldn't expect that the saved PDF may contain those as separate layers. Of course this highlights an existing issue with complex formats. You need to be very careful before sharing complex documents.
rkagerer 4y ago
I've seen big-firm lawyers make the same mistake more often than you'd think - a pdf "redaction" that's just a black box under which you can simply highlight and copy the obscured text. Oops.

version_five 4y ago

There's a story from years ago (I couldn't find it) about some government or legal documents having info redacted, but whoever did it just used some pdf editing tool to draw black boxes over the redacted parts, so all the info was still in the pdfs. Edit: I found this but I'm not sure it's the one I'm remembering: https://www.techdirt.com/2014/01/28/new-york-times-suffers-redaction-failure-exposes-name-nsa-agent-targeted-network-uploaded-pdf/ https://www.techdirt.com/2014/01/28/new-york-times-suffers-r...

perth 4y ago
This happened with the Maxwell redacted court docs
- lliamander 4y ago
  Do you have a link to the unrelated docs?
  - lliamander 4y ago
    *unredacted Stupid autocorrect
karlshea 4y ago
One of the Apple v Samsung (?) cases had court docs released with some App Store numbers redacted but it was just black squares over the actual numbers, just selecting the sentence and copy/pasting it gave it to you.

kevincox 4y ago

Yes, but there is more than that there. What if I as the client try to print a page or export to PDF. I think that there is nothing sensitive visible on the page so I share the result. It turns out that there was actually sensitive info in the canvas that was not visible due to something like overdraw. As a simple example imagine that an image is drawn to the canvas and then blacked out. You wouldn't expect that the saved PDF may contain those as separate layers. Of course this highlights an existing issue with complex formats. You need to be very careful before sharing complex documents.

rkagerer 4y ago

I've seen big-firm lawyers make the same mistake more often than you'd think - a pdf "redaction" that's just a black box under which you can simply highlight and copy the obscured text. Oops.