6 ms·

It seems nice but every single time I see service allowing anonymous uploads like such I’m thinking immediately: criminal use. How hard would it be write a pro

by xlii 2y ago

It seems nice but every single time I see service allowing anonymous uploads like such I’m thinking immediately: criminal use. How hard would it be write a protocol that uses relatively safe urls to encode messages, e.g. by ensuring that the ratio of emojis isn’t serialized URL, credentials to some stash or an encoded picture no one wants to keep?

graemep 2y ago
What do you have in mind? It seems to only allow sending a single character at a time from a limited set. What criminal use does that allow?
- xlii 2y ago
  You don’t need a upload a lot of data in order to have illegal data stash and there are creative criminals out there. E.g. for GPS coordinates you need only a 16 digits. Emojis are 8 bytes so by selecting specific ones and adding a control character (or two) and ensuring other stay in sequence you can encode this data in. And then I can only respond with „Did you read article on ACME Times about a car riding a bike?” which is a simple pointer for URL which you might check for the drop coordinates. This it’s also possible to provide encryption keys, url serialization, cryptocurrency wallet pointers etc. And sure, this seems complicated and dystopian but when government asks you to provide data of your users who committed hard crimes it’s not really fun to be at position when you say „I don’t know who my users are”. From my experience any service that allows anonymous write and anonymous read over long periods will sooner or later be used for illicit activity. It doesn’t matter if that’s 1mb or 10 bytes.
  - goosejuice 2y ago
    Sure, I guess that could happen. Hackernews allows anon data uploads over long periods. How many online services actually do KYC if they don't legally have to? Any motivated criminal could also just use a book cipher or any number of less trackable options.
  - graemep 2y ago
    The GET request does not return data in sequence, does it? Just counts fr each emoji. What exactly does the govt do if you do not have data they want? I assume if you run a service like this you would comply with any data retention requirements in your country and hand over logs - although older ones which you might have deleted to comply with other laws! Unless you have id verification crminals can sign up with false identities.
    - xlii 2y ago
      > Unless you have id verification crminals can sign up with false identities. Having registration is enough to not be liable, that’s why everyone is doing that. You get subpoenaed, you give logs for user that you have, case closed. Data can be linked to your server. If you cannot pass the torch it’s you who will be investigated as potential partner in crime.
  - bbor 2y ago
    Why not just use pastebin for a "hey I left ur drugs at this coord", or even just a plain ol' encrypted message over email, Signal, etc...? I'm a little lost here, probably due to naivete. Is the storage of URLs or crypto wallet pointers really the bottleneck for cybercrime?
    - xlii 2y ago
      Because that way it’s easy to track both poster and visitor (one could say that every visitor of such URL was involved). Indirect communication shifts focus from channel to method. And if anyone can use channel and anyone can read message then it’s impossible to pinpoint true poster and true recipient. E.g. Few years back I was helping fix a Wordpress site which shared leaked CC through page visitor counters. Imaging proving anyone’s participation. And finally I didn’t say anything about it cybercrime, the cases I know of were related to identity theft, assets theft, extortion and illicit videos. Seized servers and personal computer for years.
- reaperducer 2y ago
  It seems to only allow sending a single character at a time from a limited set. What criminal use does that allow? In the age of beepers, criminals found plenty of creative ways to send messages in just a few characters. And this permits emojis, which -- binarily speaking, contain far more bits than a beeper message.
  - fizx 2y ago
    The problem isn't that criminals can use your service, its that the service provider really doesn't want to be liable for that happening, which generally only happens when you host illegal content.
- _Algernon_ 2y ago
  >A Open Heart message should contain of a single emoji sequence
  - LordDragonfang 2y ago
    A single emoji is a sequence (of bytes)
    - _Algernon_ 2y ago
      "<thing> sequence" is generally taken as a sequence of <thing>. There is a certain ambiguity there.
      - bbor 2y ago
        It's just one :) https://github.com/dddddddddzzzz/open-heart-element/blob/main/src/index.ts#L34-L45 https://github.com/dddddddddzzzz/open-heart-element/blob/mai...
        triyambakam 2y ago
        So the API rejects a lot of valid emojis from my reading of that
        isitnow 2y ago
        May want to have a look at the linked count again “BBOR”: https://api.oh.dddddddddzzzz.org/github.com/dddddddddzzzz/OpenHeart https://api.oh.dddddddddzzzz.org/github.com/dddddddddzzzz/Op... https://emojipedia.org/zero-width-joiner https://emojipedia.org/zero-width-joiner
        LordDragonfang 2y ago
        Huh. ZWJ is an interesting corner case. Technically it's supposed to be used when combining emoji sequences that compose another single emoji (flags, skin color, gender, etc), but if the server doesn't discriminate for "real" emoji combos it technically can be an arbitrary combo.
- GuB-42 2y ago
  With ZWJ (Zero Width Joiner) sequences you could in theory encode an unlimited amount of data in a single emoji. Particularly interesting are the "family" emojis, made by joining any number of person-type emoji with ZWJ characters. So in theory, a family made of thousands of men, women, girls, boys, etc... would be a valid emoji.
  - isitnow 2y ago
    Yup, ZWJ was my first thought, and yes, it works. Tried up to 4. Too lazy to push it to see how many joins until the api breaks. https://emojipedia.org/zero-width-joiner https://emojipedia.org/zero-width-joiner
    - deleted 2y ago
      [deleted]
  - labster 2y ago
    Ottoman harem emoji is valid Unicode now.
  - paulgb 2y ago
    This nerd-sniped me, I wrote a tool for encoding arbitrary strings into one emoji: https://news.ycombinator.com/item?id=42829938 https://news.ycombinator.com/item?id=42829938 I tried with ZWJ but it turns out variation selectors were easier to make work.
- toomim 2y ago
  The ultimate exploit is to create fake "likes". Once any system of likes becomes successful, it gets used for (a) filtering news feeds, and (b) establishing consensus & social truth. This is the biggest exploit there is. A cheap system for "likes", such as this, is only safe when few people use it. Once it becomes popular, and worth something, it gets exploited, and then utterly fails.
- egypturnash 2y ago
  "A Open Heart message should contain of a single emoji sequence. However, the emoji sequence may be followed by arbitrary data which the server is expected to ignore." Italics mine. That arbitrary data could be a multi-gigabyte zip file of some expensive program, classified data, copyrighted video/music,or anything for all this spec cares.
  - NortySpock 2y ago
    Ok, so? Provided the receiving server is configured to redirect the arbitrary data into the trash, you're in the clear, right? Not your fault someone sent you extra data, and you're not expected to keep it, and if you don't keep it anywhere, law enforcement could search your server but there's nothing to find because your system doesn't retain anything from the arbitrary data.
- atoav 2y ago
  You are aware that computers also just use zeros and ones to enable everything that is around us?
notatoad 2y ago
that's really only a risk when you allow direct retrieval of the uploaded data. if you're only returning counts and you're not even offering a guarantee that every submission will be counted, then the potential for abuse isn't really any higher than any other website out there.
- xlii 2y ago
  Byte value is a count of flipped bits. Those bits aren’t even guaranteed to be correct (see cosmic bit flipping) and yet our computers work this out. IMO this is risky because it’s easy to distribute upload, e.g. I could have infected, semi popular website that would submit distributed request on visit (think about it like 1000 credits daily to use to encode message). Visitors of this website wouldn’t see a thing and yet the encoded message would be consistent. As for other websites - especially free image hosts - they often keep a metric ton of data, some won’t work if you won’t have an identifiable partner cookie on submission request, and there is post upload analysis etc.
  - notatoad 2y ago
    like yes, theoretically somebody could probably manage to encode a few bytes of secret message. but it's just that there's so many easier and better ways to do that, and even if they managed to accomplish it here it's hardly hurting this project - worst case scenario it's a bit of unwanted noise. it seems very silly to worry about it.
AnthonyMouse 2y ago
> It seems nice but every single time I see service allowing anonymous uploads like such I’m thinking immediately: criminal use. This seems like the Hollywood movie plot criminal use. Actual criminals just put a normal server/proxy in a non-extradition country or compromise any of the zillion unpatched Wordpress instances on the internet or something equally boring.
- deleted 2y ago
  [deleted]
- Pannoniae 2y ago
  Might I say that this whole safetyist moral panic is very convenient for large corporations? If you can't host your own service due to these concerns, you'll use the cloud :)
  - XorNot 2y ago
    It's not a moral panic it's called "an extended engagement with law enforcement will be unpleasant and costly" and you probably don't want that. And if you're wondering why it's that way, then casually observe everytime people declare that people under arrest or being tried "don't deserve..." something.
    - AnthonyMouse 2y ago
      The problem here is that we keep acting like the way we should solve this is by having people making toy projects or general purpose tools cower in fear of their own government and stop trying to make anything, instead of establishing a government that can distinguish between violent drug cartels and child abusers vs. innocent behavior or minor offenses and then not inflict senseless damage on the latter.
      - teddyh 2y ago
        Government is incentivized and rewarded for finding and punishing violent drug cartels and child abusers. When those become hard to find, the government punishes minor offenses, since it is easy to paint these as hardened criminals, and nobody is in a real position to discover or publicize the actual state of things.
AGorilla 2y ago
[dead]
teddyh 2y ago
<http://habitatchronicles.com/2007/03/the-untold-history-of-toontowns-speedchat-or-blockchattm-from-disney-finally-arrives/ http://habitatchronicles.com/2007/03/the-untold-history-of-t...>

by xlii 2y ago

graemep 2y ago

What do you have in mind? It seems to only allow sending a single character at a time from a limited set. What criminal use does that allow?

xlii 2y ago
You don’t need a upload a lot of data in order to have illegal data stash and there are creative criminals out there. E.g. for GPS coordinates you need only a 16 digits. Emojis are 8 bytes so by selecting specific ones and adding a control character (or two) and ensuring other stay in sequence you can encode this data in. And then I can only respond with „Did you read article on ACME Times about a car riding a bike?” which is a simple pointer for URL which you might check for the drop coordinates. This it’s also possible to provide encryption keys, url serialization, cryptocurrency wallet pointers etc. And sure, this seems complicated and dystopian but when government asks you to provide data of your users who committed hard crimes it’s not really fun to be at position when you say „I don’t know who my users are”. From my experience any service that allows anonymous write and anonymous read over long periods will sooner or later be used for illicit activity. It doesn’t matter if that’s 1mb or 10 bytes.
- goosejuice 2y ago
  Sure, I guess that could happen. Hackernews allows anon data uploads over long periods. How many online services actually do KYC if they don't legally have to? Any motivated criminal could also just use a book cipher or any number of less trackable options.
- graemep 2y ago
  The GET request does not return data in sequence, does it? Just counts fr each emoji. What exactly does the govt do if you do not have data they want? I assume if you run a service like this you would comply with any data retention requirements in your country and hand over logs - although older ones which you might have deleted to comply with other laws! Unless you have id verification crminals can sign up with false identities.
  - xlii 2y ago
    > Unless you have id verification crminals can sign up with false identities. Having registration is enough to not be liable, that’s why everyone is doing that. You get subpoenaed, you give logs for user that you have, case closed. Data can be linked to your server. If you cannot pass the torch it’s you who will be investigated as potential partner in crime.
- bbor 2y ago
  Why not just use pastebin for a "hey I left ur drugs at this coord", or even just a plain ol' encrypted message over email, Signal, etc...? I'm a little lost here, probably due to naivete. Is the storage of URLs or crypto wallet pointers really the bottleneck for cybercrime?
  - xlii 2y ago
    Because that way it’s easy to track both poster and visitor (one could say that every visitor of such URL was involved). Indirect communication shifts focus from channel to method. And if anyone can use channel and anyone can read message then it’s impossible to pinpoint true poster and true recipient. E.g. Few years back I was helping fix a Wordpress site which shared leaked CC through page visitor counters. Imaging proving anyone’s participation. And finally I didn’t say anything about it cybercrime, the cases I know of were related to identity theft, assets theft, extortion and illicit videos. Seized servers and personal computer for years.
reaperducer 2y ago
It seems to only allow sending a single character at a time from a limited set. What criminal use does that allow? In the age of beepers, criminals found plenty of creative ways to send messages in just a few characters. And this permits emojis, which -- binarily speaking, contain far more bits than a beeper message.
- fizx 2y ago
  The problem isn't that criminals can use your service, its that the service provider really doesn't want to be liable for that happening, which generally only happens when you host illegal content.
_Algernon_ 2y ago
>A Open Heart message should contain of a single emoji sequence
- LordDragonfang 2y ago
  A single emoji is a sequence (of bytes)
  - _Algernon_ 2y ago
    "<thing> sequence" is generally taken as a sequence of <thing>. There is a certain ambiguity there.
    - bbor 2y ago
      It's just one :) https://github.com/dddddddddzzzz/open-heart-element/blob/main/src/index.ts#L34-L45 https://github.com/dddddddddzzzz/open-heart-element/blob/mai...
      - triyambakam 2y ago
        So the API rejects a lot of valid emojis from my reading of that
      - isitnow 2y ago
        May want to have a look at the linked count again “BBOR”: https://api.oh.dddddddddzzzz.org/github.com/dddddddddzzzz/OpenHeart https://api.oh.dddddddddzzzz.org/github.com/dddddddddzzzz/Op... https://emojipedia.org/zero-width-joiner https://emojipedia.org/zero-width-joiner
        LordDragonfang 2y ago
        Huh. ZWJ is an interesting corner case. Technically it's supposed to be used when combining emoji sequences that compose another single emoji (flags, skin color, gender, etc), but if the server doesn't discriminate for "real" emoji combos it technically can be an arbitrary combo.
GuB-42 2y ago
With ZWJ (Zero Width Joiner) sequences you could in theory encode an unlimited amount of data in a single emoji. Particularly interesting are the "family" emojis, made by joining any number of person-type emoji with ZWJ characters. So in theory, a family made of thousands of men, women, girls, boys, etc... would be a valid emoji.
- isitnow 2y ago
  Yup, ZWJ was my first thought, and yes, it works. Tried up to 4. Too lazy to push it to see how many joins until the api breaks. https://emojipedia.org/zero-width-joiner https://emojipedia.org/zero-width-joiner
  - deleted 2y ago
    [deleted]
- labster 2y ago
  Ottoman harem emoji is valid Unicode now.
- paulgb 2y ago
  This nerd-sniped me, I wrote a tool for encoding arbitrary strings into one emoji: https://news.ycombinator.com/item?id=42829938 https://news.ycombinator.com/item?id=42829938 I tried with ZWJ but it turns out variation selectors were easier to make work.
toomim 2y ago
The ultimate exploit is to create fake "likes". Once any system of likes becomes successful, it gets used for (a) filtering news feeds, and (b) establishing consensus & social truth. This is the biggest exploit there is. A cheap system for "likes", such as this, is only safe when few people use it. Once it becomes popular, and worth something, it gets exploited, and then utterly fails.
egypturnash 2y ago
"A Open Heart message should contain of a single emoji sequence. However, the emoji sequence may be followed by arbitrary data which the server is expected to ignore." Italics mine. That arbitrary data could be a multi-gigabyte zip file of some expensive program, classified data, copyrighted video/music,or anything for all this spec cares.
- NortySpock 2y ago
  Ok, so? Provided the receiving server is configured to redirect the arbitrary data into the trash, you're in the clear, right? Not your fault someone sent you extra data, and you're not expected to keep it, and if you don't keep it anywhere, law enforcement could search your server but there's nothing to find because your system doesn't retain anything from the arbitrary data.
atoav 2y ago
You are aware that computers also just use zeros and ones to enable everything that is around us?

notatoad 2y ago

that's really only a risk when you allow direct retrieval of the uploaded data. if you're only returning counts and you're not even offering a guarantee that every submission will be counted, then the potential for abuse isn't really any higher than any other website out there.

xlii 2y ago
Byte value is a count of flipped bits. Those bits aren’t even guaranteed to be correct (see cosmic bit flipping) and yet our computers work this out. IMO this is risky because it’s easy to distribute upload, e.g. I could have infected, semi popular website that would submit distributed request on visit (think about it like 1000 credits daily to use to encode message). Visitors of this website wouldn’t see a thing and yet the encoded message would be consistent. As for other websites - especially free image hosts - they often keep a metric ton of data, some won’t work if you won’t have an identifiable partner cookie on submission request, and there is post upload analysis etc.
- notatoad 2y ago
  like yes, theoretically somebody could probably manage to encode a few bytes of secret message. but it's just that there's so many easier and better ways to do that, and even if they managed to accomplish it here it's hardly hurting this project - worst case scenario it's a bit of unwanted noise. it seems very silly to worry about it.

AnthonyMouse 2y ago

> It seems nice but every single time I see service allowing anonymous uploads like such I’m thinking immediately: criminal use. This seems like the Hollywood movie plot criminal use. Actual criminals just put a normal server/proxy in a non-extradition country or compromise any of the zillion unpatched Wordpress instances on the internet or something equally boring.

deleted 2y ago
[deleted]
Pannoniae 2y ago
Might I say that this whole safetyist moral panic is very convenient for large corporations? If you can't host your own service due to these concerns, you'll use the cloud :)
- XorNot 2y ago
  It's not a moral panic it's called "an extended engagement with law enforcement will be unpleasant and costly" and you probably don't want that. And if you're wondering why it's that way, then casually observe everytime people declare that people under arrest or being tried "don't deserve..." something.
  - AnthonyMouse 2y ago
    The problem here is that we keep acting like the way we should solve this is by having people making toy projects or general purpose tools cower in fear of their own government and stop trying to make anything, instead of establishing a government that can distinguish between violent drug cartels and child abusers vs. innocent behavior or minor offenses and then not inflict senseless damage on the latter.
    - teddyh 2y ago
      Government is incentivized and rewarded for finding and punishing violent drug cartels and child abusers. When those become hard to find, the government punishes minor offenses, since it is easy to paint these as hardened criminals, and nobody is in a real position to discover or publicize the actual state of things.

AGorilla 2y ago

[dead]

teddyh 2y ago

<http://habitatchronicles.com/2007/03/the-untold-history-of-toontowns-speedchat-or-blockchattm-from-disney-finally-arrives/ http://habitatchronicles.com/2007/03/the-untold-history-of-t...>