Hacker News Reader

Comment by Jyaif | Hacker News Reader

Weird, a friend at Apple received the same email, but with different numbers.

(giving leakers heart attacks is a hobby of mine)

Easy way to narrow down who is leaking eh?

Always thought that’s the best way to narrow down the leaks. Give variations of info to subgroups, and target the group based on which variant was leaked.

As I was reading the memo in TFA, I thought "I wonder if this memo has slight differences in it based upon who is viewing it".

Specifically, I noted one place where I thought a comma should normally have been. Perhaps it's "paranoia", but it seemed like that is one possible "variation" that could have been used.

I don't know how many Apple employees would view this memo (it seems unlikely that all ~135,000 would) but it doesn't seem like it would take very many slight differences like this to be able to generate a unique version of this memo for each viewer.

At that point, Apple just has to sit back and wait for the memo to leak. Compare the version of the memo posted in TFA to the "unique versions" rendered to the employees and you've either identified the leaker or, at the very least, significantly narrowed down the possibilities.

If Bloomberg were being careful, they would attempt to obtain copies of the memo from multiple "leakers" and compare them very carefully before publishing, making sure to look for these minute differences between them. If any were found, they'd have to be very diligent when posting the memo for all the world to see -- if they were being careful and if they cared about protecting the leaker's identity (one would assume they do but I think it'd be safe to assume there's a limit to how far they're willing to go).

Regardless, it's pretty clear that this is a huge attempt by Apple to deter any leakers or potential leakers from doing so.

> As I was reading the memo in TFA, I thought "I wonder if this memo has slight differences in it based upon who is viewing it".

> Specifically, I noted one place where I thought a comma should normally have been. Perhaps it's "paranoia", but it seemed like that is one possible "variation" that could have been used.

This is one of the methods taught in "counterintelligence 101" type classes at intel agencies. Create something hot and surprising, salt it with specific phrases, grammar or punctuation, and then leak it into a number of different compartments. If you have access to where the intel is leaking to, obtain a copy after it gets leaked, and figure out which of your compartments it came from.

If people are aware of this, what if someone finds the variations, and modifies the document and then leaks it, framing someone else for the leak?

You would have to be in possession of the index of which unique modification correlates with which person or group it was distributed to, which is usually knowledge only held by the creators of the salted documents.

Not necessarily. You don't need to randomly change the structure of the memo. You just need to leak a version of the memo that someone else received. It's not that hard to believe that someone would leave their account unattended for a moment.

> (it seems unlikely that all ~135,000 would) but it doesn't seem like it would take very many slight differences like this to be able to generate a unique version of this memo for each viewer.

18 differences would cover it. A few less people and they could get away with 17, which would yield 131072 combinations.

That's assuming each combination is binary, if they have more variations you'd need less, of course.

There was a somewhat interesting ELI5 on Reddit the other day about leaked films, with people on the production and distrubution side explaining how things work so that leaks are prevented.

Here are a few of the interesting bits:

Watermarks https://www.reddit.com/r/explainlikeimfive/comments/86rkbq/e...

NDAs https://www.reddit.com/r/explainlikeimfive/comments/86rkbq/e...

Splitting films in reels https://www.reddit.com/r/explainlikeimfive/comments/86rkbq/e...

Tom Clancy called it the Canary Trap. Each document had very slight differences, and were tracked to each recipient so leaks could be found.

Thanks, that's the first time I've heard the term.

Apparently Elon Musk tried this same technique at Tesla but "it backfired hilariously on the brilliant entrepreneur" [0,1]. According to Wikipedia [0]:

> After a series of leaks at Tesla Motors in 2008, CEO Elon Musk reportedly sent slightly different versions of an e-mail to each employee in an attempt to reveal potential leakers. The e-mail was disguised as a request to employees to sign a new non-disclosure agreement.

[0]: https://en.wikipedia.org/wiki/Canary_trap#Known_canary_trap_...

[1]: https://web.archive.org/web/20131020092330/http://gawker.com...

Also commonly used in digital watermarks: each copy has an unique variation.

See also inserting zero-width characters in text that don't show when you copy and paste: https://medium.com/@umpox/be-careful-what-you-copy-invisibly...

zero width is a good idea as engineers are less likely to leak info as they livelihood is affected by them, unless they are already trying to jump ship.

I wouldn’t be surprised if you were right.

Reply on news.ycombinator.com