5 ms·

Not foolproof, there have been instances when people have been cropping in an image-editor and failed to realize that the thumbnail hadn't been updated and leak

by tjoff 4y ago

Not foolproof, there have been instances when people have been cropping in an image-editor and failed to realize that the thumbnail hadn't been updated and leaked information.

a_shovel 4y ago
Okay, that one might catch me. I couldn't tell if an image had a thumbnail stored with it to begin with.
Hamuko 4y ago
If I need to ensure there's nothing on an image that wasn't supposed to be there, I just copy the visible pixels and paste it to a new document. No EXIF data, outdated thumbnails or anything.
- e28eta 4y ago
  I can actually imagine a tool that’d copy/paste the metadata along with the data, but I don’t know if any exist.
  - chihuahua 4y ago
    Using a screenshot tool should be safe. It will treat all pixels on the screen the same, so it doesn't know that some pixels have metadata beyond what's visible on the screen.
    - hef19898 4y ago
      Then print and scan the screen shot before faxing it to authorities.
      - toss1 4y ago
        And make sure that the scan is of low enough resolution that it fails to pickup the printer identification dot pattern in the printout... The fax should help with that, except that it'll reveal the location of your source fax. Using fax software/service needs its own security... maybe snail-mail... This is getting seriously nontrivial
        adolph 4y ago
        Don’t forget to pilfer newspapers from around the country and cut/glue letters from different fonts to compose the message and use homemade paper as the base layer.
        hef19898 4y ago
        Instead of home made, use the most prolific paper you can imagine!
        hef19898 4y ago
        Well, if we talk about goverbment whistleblower programs I assume using a fax from a random location while travelling would be good enough to not be identified by your employer (or whom ever you blow whistle on). If you do blow the whistel on the government, well, you better trust your journalist partner a lot. Or use a trustworthy lawyer as a go between. But hey, one could send the fax back and forth, cut of the fax numbers and physically mail it from a very busy train station! And have a someone put the letter into the letterbox for you, someone you pay out of view of any CCTV cameras!
        gregoryl 4y ago
        People who have information x, and were in location y (especially where y is not a common place for x holding people) will be a very limited set.
    - Kon-Peki 4y ago
      > Using a screenshot tool should be safe. It will treat all pixels on the screen the same Nope. Microsoft Office has an option/plugin that lets you flag emails and documents as restricted. You can, for example, send such an email to someone else. That person can open the email and use a screenshot tool on that email. What they will get is a flat gray box where the email content was. Not all pixels on the screen are the same. And you have no idea if your computer tattled on you and let the sending org know that you tried to screenshot the email.
      - thrashh 4y ago
        When they mean safe, they mean it doesn’t expose any extra data to a new person This thread has nothing to do with preventing your source from finding out
        Kon-Peki 4y ago
        My anecdote demonstrates that the operating system is clearly not treating all pixels the same, which is exactly what I wrote. And the screenshot tool participates in this. This MS Office trick is a quick and easy way to show someone that you can’t trust Windows when it comes to screenshots. Ignore it at your own risk.
      - deadbunny 4y ago
        I mean other email clients exist...
      - greggyb 4y ago
        If you use Outlook to restrict an email and send that to me at a non-Microsoft-affiliated account (that I access from a non Microsoft OS), I have to imagine the restriction is worthless.
        Sylamore 4y ago
        My child's school uses this feature when they email parents, you have to open the email up in a web browser and the web browser has to be allowed/supported by outlook web access to render. I haven't tried to screenshot it, but it's annoying as hell getting one of those emails on my iPhone.
hilbert42 4y ago
"...failed to realize that the thumbnail hadn't been updated..." Right, I'd never use part of the original image. Best print it out and rescan it, preferably on different scanner. Being truly anonymous is enormously difficult, even the Bauer pattern/Bayer filter shape in one's image sensor will give one away. That alone requires sophisticated filtering to decouple it from a specific sensor/camera. And that's only the beginning, there are many other factors that contribute to the leaking one's identity.
- acuozzo 4y ago
  > Best print it out https://en.wikipedia.org/wiki/Machine_Identification_Code https://en.wikipedia.org/wiki/Machine_Identification_Code
  - jwestbury 4y ago
    Black and white from here on out, then.
    - hilbert42 4y ago
      Right. Good idea, see my 2nd comment.
  - hilbert42 4y ago
    I'm aware of that, hence my comment about the many other issues that have to be considered in decoupling information from hardware. 1. First, most whistleblowing comes from B&W documents so color isn't an issue. If it is the case then there are alternative solutions which I'll not persue here in any detail (the post would be very long). 2. Printing then rescanning can decouple the camera to some extent as physical distortions are introduced by (a) the geometry of the inkjet nozzles or laser subsystem, (b) more geometric distortion is added by changes in paper size as its fused/dried, (c) additional distortion is added by the optics of the rescanning system, same goes for any further printing and so on. Also, each stage alters the gamma and adds other non linearities to the transfer. 3. Reducing the scanning resolution will add additional distortions, blurring is to be encouraged but not to the point of illegibility. (Doing a low resolution copy on a FAX machine with time/date/headers/footers turned off could help.) 4. This may sufficiently decouple the camera but it won't decouple the copying/scanning/rescanning equipment. Best do this on machines that are located well away from the source so they're not easily traceable or associated with you or your work. 5. Copying documents across multiple different photocopiers will help as they all add optical and other geometric distortions and transfer—gamma-type—errors. Deliberately lightening and darkening the image at each stage will further increase distortions. The combined distortions will make it very difficult (but not impossible) to reverse engineer the path back to the source. Have you ever wondered why the quality of the printed type in copies of evidence, FOIs, official documents etc. often looks so daggy and blurred as to be almost illegible? 6. The idea is to add as much distortion and blurring in the chain of copies as is possible and yet still keep the final copy legible/identifiable. It's a fine balance. 7. That still does not guarantee anonymity. Sensitive documents are often 'doctored' so that each recipient receives a subtlety different copy, spacing between words may change so may the page layout, also small seemingly insignificant and barely obvious 'marks' on the page will differ between copies thus identifying each recipient. None of the camera techniques above will overcome this problem. 8. One technique is to retype the document so that it is almost identical in both looks and content but with lots of subtle changes in both layout and wording—but NOT to the extent of changing the document's meaning. Same goes for modifying images (a complex matter). As a last resort this could give you a degree of plausible deniability in cases where marked documents are issued. If you do this it would be very advisable to spirit away actual copies of the originals in a truly safe location—you may really need them one day (after you're accused of, say, forgery). I'd suggest you only go down this path if you are very competent and the stakes are very high. 9. None of what I've said should be taken lightly. No matter how hard you try to decouple yourself totally from the source (or from any involvement) it is nigh on impossible to hide from formidable and sophisticated forensics if applied relentlessly. 10. Moreover, whistleblowers, more often than not, end up being reveilled by fellow workers and usually without a job or decent reemployment prospects. Unfortunately, our culture hasn't embraced whistleblowers and whistleblowing as it should. It's a very risky business. Take the case of whistleblower Daniel Ellsberg and the Pentagon Papers; his effort wasn't rewarded as we ought to expect and he nearly ended up being locked up. Moreover, at one point Ellsberg wistfully noted that reaction by the American public to his efforts wasn't very favorable. When it comes to whistleblowing it seems not much has improved in the last five decades. _ Edit: FYI, there are many excellent videos on Daniel Ellsberg and whistleblowing on YouTube.
knodi123 4y ago
Referring to TechTV presenter Cat Schwartz, I presume? https://en.wikipedia.org/wiki/Catherine_Schwartz https://en.wikipedia.org/wiki/Catherine_Schwartz
8n4vidtmkvmk 4y ago
i just screenshot images. that way it'll lose any metadata. any parts outside of my screenshotted area can't be included... and i think the black rectangles are genuinely black in sharex...

by tjoff 4y ago

Not foolproof, there have been instances when people have been cropping in an image-editor and failed to realize that the thumbnail hadn't been updated and leaked information.

a_shovel 4y ago

Okay, that one might catch me. I couldn't tell if an image had a thumbnail stored with it to begin with.

Hamuko 4y ago

If I need to ensure there's nothing on an image that wasn't supposed to be there, I just copy the visible pixels and paste it to a new document. No EXIF data, outdated thumbnails or anything.

e28eta 4y ago
I can actually imagine a tool that’d copy/paste the metadata along with the data, but I don’t know if any exist.
- chihuahua 4y ago
  Using a screenshot tool should be safe. It will treat all pixels on the screen the same, so it doesn't know that some pixels have metadata beyond what's visible on the screen.
  - hef19898 4y ago
    Then print and scan the screen shot before faxing it to authorities.
    - toss1 4y ago
      And make sure that the scan is of low enough resolution that it fails to pickup the printer identification dot pattern in the printout... The fax should help with that, except that it'll reveal the location of your source fax. Using fax software/service needs its own security... maybe snail-mail... This is getting seriously nontrivial
      - adolph 4y ago
        Don’t forget to pilfer newspapers from around the country and cut/glue letters from different fonts to compose the message and use homemade paper as the base layer.
        hef19898 4y ago
        Instead of home made, use the most prolific paper you can imagine!
      - hef19898 4y ago
        Well, if we talk about goverbment whistleblower programs I assume using a fax from a random location while travelling would be good enough to not be identified by your employer (or whom ever you blow whistle on). If you do blow the whistel on the government, well, you better trust your journalist partner a lot. Or use a trustworthy lawyer as a go between. But hey, one could send the fax back and forth, cut of the fax numbers and physically mail it from a very busy train station! And have a someone put the letter into the letterbox for you, someone you pay out of view of any CCTV cameras!
        gregoryl 4y ago
        People who have information x, and were in location y (especially where y is not a common place for x holding people) will be a very limited set.
  - Kon-Peki 4y ago
    > Using a screenshot tool should be safe. It will treat all pixels on the screen the same Nope. Microsoft Office has an option/plugin that lets you flag emails and documents as restricted. You can, for example, send such an email to someone else. That person can open the email and use a screenshot tool on that email. What they will get is a flat gray box where the email content was. Not all pixels on the screen are the same. And you have no idea if your computer tattled on you and let the sending org know that you tried to screenshot the email.
    - thrashh 4y ago
      When they mean safe, they mean it doesn’t expose any extra data to a new person This thread has nothing to do with preventing your source from finding out
      - Kon-Peki 4y ago
        My anecdote demonstrates that the operating system is clearly not treating all pixels the same, which is exactly what I wrote. And the screenshot tool participates in this. This MS Office trick is a quick and easy way to show someone that you can’t trust Windows when it comes to screenshots. Ignore it at your own risk.
    - deadbunny 4y ago
      I mean other email clients exist...
    - greggyb 4y ago
      If you use Outlook to restrict an email and send that to me at a non-Microsoft-affiliated account (that I access from a non Microsoft OS), I have to imagine the restriction is worthless.
      - Sylamore 4y ago
        My child's school uses this feature when they email parents, you have to open the email up in a web browser and the web browser has to be allowed/supported by outlook web access to render. I haven't tried to screenshot it, but it's annoying as hell getting one of those emails on my iPhone.

hilbert42 4y ago

"...failed to realize that the thumbnail hadn't been updated..." Right, I'd never use part of the original image. Best print it out and rescan it, preferably on different scanner. Being truly anonymous is enormously difficult, even the Bauer pattern/Bayer filter shape in one's image sensor will give one away. That alone requires sophisticated filtering to decouple it from a specific sensor/camera. And that's only the beginning, there are many other factors that contribute to the leaking one's identity.

acuozzo 4y ago
> Best print it out https://en.wikipedia.org/wiki/Machine_Identification_Code https://en.wikipedia.org/wiki/Machine_Identification_Code
- jwestbury 4y ago
  Black and white from here on out, then.
  - hilbert42 4y ago
    Right. Good idea, see my 2nd comment.
- hilbert42 4y ago
  I'm aware of that, hence my comment about the many other issues that have to be considered in decoupling information from hardware. 1. First, most whistleblowing comes from B&W documents so color isn't an issue. If it is the case then there are alternative solutions which I'll not persue here in any detail (the post would be very long). 2. Printing then rescanning can decouple the camera to some extent as physical distortions are introduced by (a) the geometry of the inkjet nozzles or laser subsystem, (b) more geometric distortion is added by changes in paper size as its fused/dried, (c) additional distortion is added by the optics of the rescanning system, same goes for any further printing and so on. Also, each stage alters the gamma and adds other non linearities to the transfer. 3. Reducing the scanning resolution will add additional distortions, blurring is to be encouraged but not to the point of illegibility. (Doing a low resolution copy on a FAX machine with time/date/headers/footers turned off could help.) 4. This may sufficiently decouple the camera but it won't decouple the copying/scanning/rescanning equipment. Best do this on machines that are located well away from the source so they're not easily traceable or associated with you or your work. 5. Copying documents across multiple different photocopiers will help as they all add optical and other geometric distortions and transfer—gamma-type—errors. Deliberately lightening and darkening the image at each stage will further increase distortions. The combined distortions will make it very difficult (but not impossible) to reverse engineer the path back to the source. Have you ever wondered why the quality of the printed type in copies of evidence, FOIs, official documents etc. often looks so daggy and blurred as to be almost illegible? 6. The idea is to add as much distortion and blurring in the chain of copies as is possible and yet still keep the final copy legible/identifiable. It's a fine balance. 7. That still does not guarantee anonymity. Sensitive documents are often 'doctored' so that each recipient receives a subtlety different copy, spacing between words may change so may the page layout, also small seemingly insignificant and barely obvious 'marks' on the page will differ between copies thus identifying each recipient. None of the camera techniques above will overcome this problem. 8. One technique is to retype the document so that it is almost identical in both looks and content but with lots of subtle changes in both layout and wording—but NOT to the extent of changing the document's meaning. Same goes for modifying images (a complex matter). As a last resort this could give you a degree of plausible deniability in cases where marked documents are issued. If you do this it would be very advisable to spirit away actual copies of the originals in a truly safe location—you may really need them one day (after you're accused of, say, forgery). I'd suggest you only go down this path if you are very competent and the stakes are very high. 9. None of what I've said should be taken lightly. No matter how hard you try to decouple yourself totally from the source (or from any involvement) it is nigh on impossible to hide from formidable and sophisticated forensics if applied relentlessly. 10. Moreover, whistleblowers, more often than not, end up being reveilled by fellow workers and usually without a job or decent reemployment prospects. Unfortunately, our culture hasn't embraced whistleblowers and whistleblowing as it should. It's a very risky business. Take the case of whistleblower Daniel Ellsberg and the Pentagon Papers; his effort wasn't rewarded as we ought to expect and he nearly ended up being locked up. Moreover, at one point Ellsberg wistfully noted that reaction by the American public to his efforts wasn't very favorable. When it comes to whistleblowing it seems not much has improved in the last five decades. _ Edit: FYI, there are many excellent videos on Daniel Ellsberg and whistleblowing on YouTube.

knodi123 4y ago

Referring to TechTV presenter Cat Schwartz, I presume? https://en.wikipedia.org/wiki/Catherine_Schwartz https://en.wikipedia.org/wiki/Catherine_Schwartz

8n4vidtmkvmk 4y ago

i just screenshot images. that way it'll lose any metadata. any parts outside of my screenshotted area can't be included... and i think the black rectangles are genuinely black in sharex...