5 ms·

I suspect that the "hash" actually is the following info per file: sha1-hash, md5-hash, crc32-hash and file size. If a file matches the file size, hash1 is chec

by Ueland 12y ago

I suspect that the "hash" actually is the following info per file: sha1-hash, md5-hash, crc32-hash and file size. If a file matches the file size, hash1 is checked, then hash2 and so on. I will be pretty impressed if you can fake that somehow. Edit: this is a normal algorithm for files in general, but it appears to be a image-specific algorithm used in this case. (A la imageDNA)

lifeisstillgood 12y ago
If you are the sort of person able and willing to screw with someone's life like that, you will have no qualms using your stolen credit cards to buy child porn images to use in this way. I remember a episode of some legal drama where our hero the judge had his laptop "hacked" and child poem images installed on it. (Luckily it was make believe so he was able to "delete" them before the other judges arrived with the tipoff but that's not the point) I think we shall soon enter a legal landscape where mere possession of digital products does not imply legal possession. It's going to be an interesting world.
- pooper 12y ago
  This scares me. What can we do though? Can we decriminalize/legalize possession of anything? Perhaps just make it illegal to produce illicit materials? How would it work? Would that mean bad guys would be able to legally own weapons-grade plutonium if they didn't produce it?
  - lifeisstillgood 12y ago
    It only applies to digital products. If you are found with next doors stolen TV it's not much of a defence to say "I did not put it there", but since any script kiddie from Russia or China can dump bitcoins, porn or military files on your bot netted PC we shall have to see a higher level of proof from prosecuters beyond "well it's on his PC so he must be a MtGox exec / paedophile / spy"
    - pooper 12y ago
      I like this idea. It should also apply to people when someone else mooches on one's home wireless network to download copyrighted material.
- tomjen3 12y ago
  Alternatively you could put feathers from endangered birds inside peoples cars. Mere possession of such feathers is a felony. There are plenty of ways to screw with people.
  - lifeisstillgood 12y ago
    That probably comes under the "hmmm, weird" federal statutes.
parkaboy 12y ago
I'm actually guessing not. It's probably something similar algorithm-wise to what Shazam does. Probably not a crypto-hash, but more likely a hashing of robust features (in a relative as opposed to absolute location form) detected from the image to give a "fingerprint." Such features would be robust to scaling and most compression artifact issues. EDIT: Here's a good example: http://laplacian.wordpress.com/2009/01/10/how-shazam-works/ http://laplacian.wordpress.com/2009/01/10/how-shazam-works/
- tptacek 12y ago
  If this is Microsoft's hash algorithm, the one from the robust image hashing paper, it's not perceptual (like Shazam); it's coding-theoretic. If I understand it correctly, it leaves room for false negatives from drastic (but intelligible) image changes in favor of avoiding false positives from attackers trying to deliberately trip it with non-matching images.
euroclydon 12y ago
The article said the hash was effective across resized versions of the same file. Pick the top 50 most prevalent colors by pixel and create a normalized vector representing the distance of each color's center of mass from the center of the image.
Xorlev 12y ago
Also potentially p-hashes or similar for fuzzy matching the images. Works pretty well for at least narrowing the space of what you're looking for. Given that Google Image has reverse search, you can almost guarantee that they have approximate hashes.
Natsu 12y ago
For a photo, you might have to be a bit fuzzier than that, given that things like jpeg recompression can change a lot of that. I assume there are techniques to get around that sort of thing, though, and major software vendors like Google & Microsoft ought to have the sort of people who can solve that problem.

by Ueland 12y ago

lifeisstillgood 12y ago

If you are the sort of person able and willing to screw with someone's life like that, you will have no qualms using your stolen credit cards to buy child porn images to use in this way. I remember a episode of some legal drama where our hero the judge had his laptop "hacked" and child poem images installed on it. (Luckily it was make believe so he was able to "delete" them before the other judges arrived with the tipoff but that's not the point) I think we shall soon enter a legal landscape where mere possession of digital products does not imply legal possession. It's going to be an interesting world.

pooper 12y ago
This scares me. What can we do though? Can we decriminalize/legalize possession of anything? Perhaps just make it illegal to produce illicit materials? How would it work? Would that mean bad guys would be able to legally own weapons-grade plutonium if they didn't produce it?
- lifeisstillgood 12y ago
  It only applies to digital products. If you are found with next doors stolen TV it's not much of a defence to say "I did not put it there", but since any script kiddie from Russia or China can dump bitcoins, porn or military files on your bot netted PC we shall have to see a higher level of proof from prosecuters beyond "well it's on his PC so he must be a MtGox exec / paedophile / spy"
  - pooper 12y ago
    I like this idea. It should also apply to people when someone else mooches on one's home wireless network to download copyrighted material.
tomjen3 12y ago
Alternatively you could put feathers from endangered birds inside peoples cars. Mere possession of such feathers is a felony. There are plenty of ways to screw with people.
- lifeisstillgood 12y ago
  That probably comes under the "hmmm, weird" federal statutes.

parkaboy 12y ago

I'm actually guessing not. It's probably something similar algorithm-wise to what Shazam does. Probably not a crypto-hash, but more likely a hashing of robust features (in a relative as opposed to absolute location form) detected from the image to give a "fingerprint." Such features would be robust to scaling and most compression artifact issues. EDIT: Here's a good example: http://laplacian.wordpress.com/2009/01/10/how-shazam-works/ http://laplacian.wordpress.com/2009/01/10/how-shazam-works/

tptacek 12y ago
If this is Microsoft's hash algorithm, the one from the robust image hashing paper, it's not perceptual (like Shazam); it's coding-theoretic. If I understand it correctly, it leaves room for false negatives from drastic (but intelligible) image changes in favor of avoiding false positives from attackers trying to deliberately trip it with non-matching images.

euroclydon 12y ago

The article said the hash was effective across resized versions of the same file. Pick the top 50 most prevalent colors by pixel and create a normalized vector representing the distance of each color's center of mass from the center of the image.

Xorlev 12y ago

Also potentially p-hashes or similar for fuzzy matching the images. Works pretty well for at least narrowing the space of what you're looking for. Given that Google Image has reverse search, you can almost guarantee that they have approximate hashes.

Natsu 12y ago

For a photo, you might have to be a bit fuzzier than that, given that things like jpeg recompression can change a lot of that. I assume there are techniques to get around that sort of thing, though, and major software vendors like Google & Microsoft ought to have the sort of people who can solve that problem.