14 ms·
Why blurring sensitive information is a bad idea (2007)
- Udo 12y agoA nice Gaussian blur would probably be fine, it's specifically the pixelation technique that's leaking data.
- nick_riviera 12y agoIsn't that still forwardly deterministic i.e. you can apply the same algorithm to it but at a higher resolution?
- jarman 12y agoYes it is reversible for practical purposes. There is some data loss on edges, which will manifest as noise on recovered image.
- ekr 12y agoYou think the technique mentioned in the article doesn't leak data? It actually leaks more data than a gaussian blur. Gaussian blur suffers from exactly the same problem, although a different difference function is needed for it.
- goldenkey 12y agoGaussian blur is equivalent to an auto key cipher [0] without a key. Each pixel is composed of a couple pixels from the original. With some simple algebra, cross-examining pixels that have values determined by the same origin pixel, you can reverse the operation. [0] http://en.m.wikipedia.org/wiki/Autokey_cipher http://en.m.wikipedia.org/wiki/Autokey_cipher
- Udo 12y agoI see that I deserved a schooling on gaussian blur, but > You think the technique mentioned in the article doesn't leak data? yes, I do think it leaks data, which was the correct half of my comment, actually. Not that it matters now, but I always assumed blurring distorted the data in way way that would make it hard to recover in practice.
- Qantourisc 12y agoGaussian blur is a 100% reversible! You just sharpen using the same Gaussian settings for a Gaussian sharpen. It's only due to rounding to 8bit per colour that causes it to loose any information.
- jarman 12y agoIt will be worse than that. Pixellation destroys information, it's not reversible in general. But in this case, what is left is enough for recovery, as source domain (check number) is small. Gaussian blur is theoretically lossless (rounding loss and loss on image edges in practice) - you can take arbitrary image, blur it, reverse and get original+noise
- Udo 12y agoThanks for making me look deeper into what's going on with common blurring algorithms. My instincts were clearly wrong here, for years I thought reversing blurs wasn't feasible in practice. I was very, very wrong.
- sitkack 12y agoUnknown Partial Knowledge is a huge problem in human cognition. This blew my mind, https://www.youtube.com/watch?v=tyHBnT4PmTE https://www.youtube.com/watch?v=tyHBnT4PmTE
- Udo 12y agoThis is less surprising to me than the gaussian reversal, because this motion-deblurring technique relies on several images of the same object. It's still cool, though :)
- mxfh 12y agoSo if something is 1337 days old it gets autoreposted? Could live with that. Previous discussion: https://news.ycombinator.com/item?id=1939607 https://news.ycombinator.com/item?id=1939607 A bit more precise this post is even older, and was first discussed in 2007 prominently in these two places: http://www.reddit.com/comments/xaae/how_to_extract_personal_information_and_account/cxbgy http://www.reddit.com/comments/xaae/how_to_extract_personal_... https://www.schneier.com/blog/archives/2007/01/how_to_recover.html https://www.schneier.com/blog/archives/2007/01/how_to_recove... (please refrain from responding with XKCD references, I'm aware of that, just want to link to older discussions)
- vog 12y agoMy favourite comment from the old discussion came from andrewreds: > WHAT... why would you completely black out the number, where you could instead use random coloured squares, that look like it is a blurring, so someone can go through all the effort, decoding your white noise, and thinking in the end they have your number... when they don't ;) https://news.ycombinator.com/item?id=1939807 https://news.ycombinator.com/item?id=1939807
- CreakyKnuckle 12y agoTo be fair, that's a pretty numerically apropos age for HN.
- dheera 12y agoI wrote this a lot more than 1337 days ago. IIRC it first appeared on Slashdot. http://it.slashdot.org/story/07/01/07/1352242/blurring-images-not-so-secure http://it.slashdot.org/story/07/01/07/1352242/blurring-image... Not sure what prompted someone to repost it to HN today. But that's cool because I see people continue doing this on a daily basis.
- erikb 12y agoIn some cases even blurring faces might be a bad idea. Just because we are unable to unblur a face today doesn't mean we are unable in 10 years or 100 years. In many cases this might not be a problem but in some cases this might lead to trouble later on which can be avoided just as easily.
- goldenkey 12y agoYou cannot unblur mosaic blurring. It's the equivalent of a hash. The best you can do is brute force possible input vectors. There will be many collisions. This technique only works because digits/numbers limit the input space for a credit card or bank number. For faces, the best you can do is validate if someone you already suspect or someone you have in a database, is the origin of the mosaic. If you had a picture of every person in your country, you could run them all through and find the origin - but you're not really unblurring as much as extracting information to do process of elimination on a 'image hash'
- erikb 12y agoMaybe the scientifically correct definition of "to unblur" is reverting the process directly by applying a mathematical algorithm. In a normal conversation like what we have here, bruteforcing a good enough result can also be considered "to unblur" because for the person it's the same result: Everybody knows who it is.
- goldenkey 12y agoThe un prefix means to reverse. If you have no database of people you're not going to be able to do anything in the way of reversing the mosaic. It's not a reversal as much as it is a heuristic brute force.
- deleted 12y ago[deleted]
- asgard1024 12y agoI can imagine you can computationally unblur mosaic on video, if the object (e.g. face) is not changing, just the camera is moving around a little.
- nnnnni 12y agoTheir answer is to "color over it", but BE CAREFUL if you do that. I'm sure that some of us remember the US government document(s) in the late 90s/early 2000s that were released in redacted form, but the person didn't realize/understand that people with the Acrobat editor program could remove the black bars.
- currysausage 12y agoAlso great: HTML pages with sensitive passages using #000 for background and foreground. You just need to select and copy to Notepad - voila. I think I once saw that on the site of a home security company, citing an email from customers who thanked them for burglarproofing their home in XX XXXXXXXX Street. Quite ironic.
- MichaelApproved 12y agoYou don't have to go all the way back to the early 2000s to find poorly redacted federal documents. Rachel Maddow had a great segment on botched redactions, like removing the black lines from a PDF. The best solution was to actually cut out the parts of the page you don't want seen and then scan in the result. All other methods are prone to mistakes. Edit: corrected link to segment http://www.msnbc.com/rachel-maddow-show/watch/redaction-rules-how-best-to-keep-the-secrets-258076739607 http://www.msnbc.com/rachel-maddow-show/watch/redaction-rule...
- Houshalter 12y agoWould a screenshot work?
- freehunter 12y agoI've always drawn over sensitive parts in Paint or something, then taken a screenshot of it. It makes sure that everything is compressed to a single layer and can't be undone.
- im3w1l 12y ago
- deleted 12y ago[deleted]
- adamnemecek 12y agowhy not just use a solid color instead?
- InclinedPlane 12y agoAre you a professional cryptographer? Can you prove that your random shuffling is impossible to extract sensitive data from? No? Then you better stick with completely deleting the data from the image entirely.
- nullc 12y agoBrings back nausea from arguments past, that went something like this (dramatized for your pleasure): Me: Your protocol has a serious size-side channel that leaks all the important data as sizes. Please use a constant length encoding. Duh: Thanks! I added RANDOM padding. Totally secure now(tm). Me: Your random was rand(), I recovered the LCG state from a few packets with known sizes and then recovered the original sizes, its still totally insecure. /Please/ make it constant size. Duh: I made the random better and got rid of the known length packets. Now its extra completely secure. Me: This will just take more statistical analysis to break, please just make it constant— the overhead is negligible! This is critical and anything short of constant is leaking information. We can't make assumptions about how powerful the attacker's statistical reasoning is, so even a small leak could be fatal. Duh: I tried for two hours and couldn't break it. You're wasting my time. Me: Argh. After a week of analysis, I've created this sampling and averaging script which completely recovers the secret data. Please. Just. Make. The. Encoding. Constant. Length. Duh: Oh come on, that requires the same user to use it four times in a row. But fine, I now also quantize the size to a multiple of 2. The script you gave me no longer works, so now it's secure. Me: <jumps off building> The adage that anyone can make a cryptosystem he himself can't break— should have a sister rule: Most people can make a cryptosystem which isn't cost effective to review by an honest party but which may be very economical to attack once it's protecting something of value.
- bithush 12y agoI feel this is also very relevant http://en.wikipedia.org/wiki/Christopher_Paul_Neil http://en.wikipedia.org/wiki/Christopher_Paul_Neil Police took a photo with a "swirl" effect of a paedophiles face and reversed it to reveal a very usable picture. So good in fact he was found and arrested.
- danepowell 12y agoHe wasn't just a pedophile, he was a child molester.
- deleted 12y ago[deleted]
- frogpelt 12y ago"just a pedophile" A phrase I never thought I'd see.
- chimeracoder 12y agoA pedophile is someone who is sexually attracted to children, whether on not he/she acts on that desire in any way. A child molester is someone who actually engages in inappropriate sexual activity with a child. A child molester may or may not be a pedophile, for what it's worth (one may molest a child for reasons other than sexual attraction - even when you look at rape of adults, in many/most cases sexual attraction is not the primary motivation of the rapist[0]). [0] https://en.wikipedia.org/wiki/Motivation_for_rape https://en.wikipedia.org/wiki/Motivation_for_rape
- izzydata 12y agoSomeone who is homosexual isn't any more inclined to molest or rape someone of their own sex than a pedophile is to molest or rape a child. More on topic about censoring important information. I'm not entirely sure about this, but I feel like I've seen images where the thumbnail was retained from a previous version. Even at 32x32 there might be some way to expand it and gather some kind of information from its pixelated form even after the actual image was censored.
- nathell 12y agoIn some cases, coloring over parts of the image might still not be enough. Specifically, when all of the following are true: (i) the domain of possible entries is reasonably small (e.g., a number or a name and surname), (ii) the text is printed in a proportional (not fixed-width) typeface, and (iii) enough of the rest of the line is visible to infer the font size and kerning settings.
- userbinator 12y agoActually, using fixed-width would be even easier since it reveals the length.
- bryondowd 12y agoI'd be curious to see some numbers backing one or the other, but I suspect proportional would be better. Fixed width narrows to a number of characters. So it depends how many possible values have x characters. Proportional narrows to a particular width, which could be more granular than character count. So it depends how many possible values turn out to be exactly x pixels across given the type settings.
- cruise02 12y agoIt doesn't really matter how many values turn out to be exactly x pixels across given the type settings, you still have to do an exhaustive search on different numbers of characters to find them. That problem is simplified by a fixed width font.
- mokus 12y agoIn general, though, a proportional face will give a larger number of possible widths, meaning more information to work with (fewer possible strings will map to any particular width). Additionally, depending on the type of information you are trying to recover, you may already know the number of characters (for example, a US SSN), in which case fixed-width typefaces mean you get no information you didn't already have, whereas a proportional one would at least give you a little bit of info. But on the other hard I would also guess fixed-length strings such as an SSN are more likely to appear in a more "table"-like part of a document than in the middle of a paragraph of text. I suspect it'd still be a bloody hard analysis either way, but at least according to this back-of-the-envelope theory a proportional typeface should preserve more information.
- hawleyal 12y agoNot really. You would need to have a copy of an uncovered version to know how many lines of text, font size, kerning et al.
- DanBC 12y agoSome documents are trivially easy to get near copies. Other documents provide their own context - they have a lot of other text - that you can use to get font, font size and spacing and etc.
- bjourne 12y agoHas this attack actually been proved possible? He writes that he thinks it should work but doesn't have the time or inclination to prove it. If anyone wants to take a stab at it, I'll gladly submit a mosaiced photo of my credit card because I don't think the attack is practical. If you crack it, you're free to keep whatever you can get. :)
- bluedino 12y agoYou have to know the original font the numbers were in, and the original algorithm or program used to do the blurring. Then it's just a matter of brute forcing it. Using a 'smear' brush would be a more secure way to blur, there are various sizes and you introduce some randomness in the path of your mouse/stylus when blurring, and you can go over the numbers multiple times. Blurring to much higher factors is a better idea but it is simpler to just use black bars.
- dheera 12y agoYou have to be careful doing this. If your blur tool happens to be of the variety that conserves total brightness (i.e. the blurring is accomplished by 2D convolution with a kernel that has a volume of 1, so sum of all pixel values remains constant before and after blurring), it can still be dictionary attacked pretty easily no matter which random ways you blur, since each digit in the cheque font probably has a different amount of total black area, and your blurring preserves that information perfectly. If you blur tool is of the variety that doesn't conserve total brightness, such as most "smudge" tools, and you use human randomness to blur it, then it would probably be pretty hard to reverse. I still recommend cutting out the sensitive information rather than blurring it, just to be safe. Also, leave a generous margin, (1) to avoid giving information about length, and (2) because lossy compressors may have left tiny artifacts of the sensitive information in the areas around it.
- cbhl 12y agoIn North America, all the checks (cheques) use the same fonts. See http://en.wikipedia.org/wiki/Magnetic_ink_character_recognition http://en.wikipedia.org/wiki/Magnetic_ink_character_recognit...
- IvyMike 12y agoBetter yet: change the text to "you think you're clever, don't you" and then blur the image. It's a little easter egg for the people with an unblur plugin.
- Houshalter 12y agoWeb archive version: https://web.archive.org/web/20140714183916/http://dheera.net/projects/blur https://web.archive.org/web/20140714183916/http://dheera.net...
- wcummings 12y agoI entered an underhanded contest one year where the challenge was recoverable-but-correct-looking redaction of jpegs. I used an insecure random seed based on the time (you could brute force an unredacted image based on the rough time it was generated). The winning solutions were more clever
- dalke 12y agoYou (and I) were among the many which implemented that exact technique for http://underhanded.xcott.com/?page_id=17 http://underhanded.xcott.com/?page_id=17 . :)
- cookiecaper 12y agoMost people want to blur because they think it makes their photo flow better than gaudy black highlights, but you can also use highlights that match the background color/image and make it blend it in, leaving a big white space on a white background instead of a big black space. Most people won't notice anything is missing at all. If you want that pixel mosaic look for extra futuristic feel, remove the original content by making it fade into background, replace with new, irrelevant content, and then pixelize.
- tshadwell 12y agoAnd when you colour in the picture always use a pen of 100% opacity or the colour can be removed from the image to reveal the data underneath!
- georgemcbay 12y agoI think a lot of people are unaware of how easily you can achieve blind deconvolution on many images blurred with most blur algorithms and even real-world blurring effects (including motion, out-of-focus, etc blurs). The results won't be perfect, but they are usually close enough to see much of the detail that appeared to be lost. I never use blur to obscure sensitive information; black that shit out (and then also make sure you aren't saving it as metadata or in a layer) or just replace it with fake data.
- yeukhon 12y agoWouldn't cutting that hidden text out entirely with a photo editing tool be better? I've heard people talking about recovering text f. Well, in the case of edges sticking out of the black bar (this happens a lot for people who aren't careful) like using paint, I believe there is a chance to recover partial, if not, the entire content back. Also, doesn't adding a black bar on top of a text means just adding more bytes to the file, instead of removing the bytes belonging to the now hidden text?
- ohazi 12y agoI'll just leave this here: http://refocus-it.sourceforge.net/ http://refocus-it.sourceforge.net/
- JoshTheGeek 12y agohttp://blog.mailgun.com/open-sourcing-our-email-signature-parsing-library/ http://blog.mailgun.com/open-sourcing-our-email-signature-pa... (https://news.ycombinator.com/item?id=8081532 https://news.ycombinator.com/item?id=8081532) has some screenshots with blurred email addresses you can read without fancy deciphering.
- jheriko 12y agodo those pixel blocks actually represent accumulated samples from the image? any number of very obvious methods can be used to avoid this besides using a black box...
- cnst 12y agoWhere did they find such a crappy font for body? SimHei for Latin letters looks absolutely horrendous with disabled font blurring. They advise you not to blur, yet require blurring for comfortable reading? How ironic!