Hacker News Reader

Comment by tgsovlerkhgsel | Hacker News Reader

I really hope the blur on the picture (https://citizenlab.ca/wp-content/uploads/2021/10/Hubbard-Ima...) isn't hiding anything actually important because that can almost certainly be de-blurred with the right tooling.

View on HN

> I really hope the blur on the picture (https://citizenlab.ca/wp-content/uploads/2021/10/Hubbard-Ima...) isn't hiding anything actually important because that can almost certainly be de-blurred with the right tooling.

Yeah, the right way to use blurring is to mockup a lookalike for content you want to hide, then blur the mockup.

You don't even need this. I searched "unblur" in Google Play Store, downloaded the first result, tweaked the settings a touch, and I could make out the characters. The whole process took a couple minutes. If the data actually needs to be hidden, this picture should be taken down.

It sounds like you didn’t read the post you are replying to. They indicated a mock copy should be made to avoid techniques reconstructing the data.

Yeah, I replied to the wrong comment, sorry. I navigated away and skimmed to figure out where I was when I came back.

if you generate a lookalike full of UUIDs, you don't really need to blur except for dramatic effect I guess.

I just go solid opaque bar. Way easier to do and harder to screw up.

Amusingly enough, people have even screwed this up. I recall some government agency trying to censor data with a black bar, but the problem was that the data was in a SVG-like document, so people could just delete the bars from the document and see the apparently-censored text.

I remember a version of this happening with PDFs

Yep - Apple wound up adding a “Redact” tool to Preview.app for PDFs, likely in response to all the people who just drew shapes over selectable sensitive text.

https://eclecticlight.co/2020/12/11/how-effective-and-safe-i...

I believe the US government did this at least once, by implementing the black bars in a PDF as a separate object, so the unredacted item was intact in the files they shared.

Whoops.

It would be funny to place fake data behind the removable bars for tech savvy people to find.

> It would be funny to place fake data behind the removable bars for tech savvy people to find.

Tech savvy people, but also journalists

https://arstechnica.com/tech-policy/2021/10/missouri-gov-cal...

This has happened with PDFs many, many times.

The EU has redacted PDFs this way a number of times, but I don't think anything truly sensitive ever leaked.

I remember that. Unredacted versions were also circulated.

I built a redaction process for a small company once.

My critical security step was rendering out the PDF as individual flat image files, then re-assembling it like a traditionally photo-copied document.

That way the loss-full operation is enforced, at the cost of forcing end users to OCR unsearchable image-scan (like) PDFs.

It's the only way to be sure!

You could replace the censored text with gibberish before blacking it out. Or some secret message for QAnons to find.

well if you had an open (.odf) or openable (.doc≈xml) format you could replace strings and be sure something was gone

> just delete the bars

I think you mean "illegally hack the black bars".

> I just go solid opaque bar. Way easier to do and harder to screw up.

There may be graphic design reasons you don't want to do that. A big black redaction bar isn't much of an illustration.

What's even worse is that he blurred "ts/" from "attachments", kinda to give you a hint on how to de-blurr.

https://en.m.wikipedia.org/wiki/Christopher_Paul_Neil

Pedo who used to swirl his face not knowing people can unswirl.

man why do people even take the gamble of using a blur just use a opaque box

A certain subset of hackers have had a Gaussian-blur fetish for half a decade now, at least.

Life imitates art I suppose! You don't see opaque boxes used in Hollywood productions. Blur matches a popular fantasy aesthetic

Perhaps 'someone' wanted it blurred for exactly the reason they want to de-blur it later....

Opaque boxes have been issues before, when they end up being "semi-transparent" and you can up the brightness to beat them.

Safest is probably just to cut/crop the sensitive bits out.

The information is lost if you have a flat image without any layers. You should take additional steps for other formats of course. Granted, it has to be completely opaque of course.

This is how I get FOIA responses. Agencies just remove the pieces they don't want me to see, sometimes with a code to tell me why it was excised. I use the redaction feature built into Acrobat.

I've used blur in the past. I assumed it was just as secure (please don't hate me!).

I did blur over black box because the blur was less visually obtrusive

Those strings in the center look like UUIDs.

Really? Seems blurred enough to me that even some sort of ML would spit out wrong characters.

Known font, known range of possible characters (almost certainly ascii), and probably several blurred characters in there that we know (like the t in attachment). If the blur is differentiable per-character, it's probably reversible.

Even without automation. Just make a list of blurred alphanumerics, then match every blurred character in the picture against the character list. with some patience probably doable in a single day

Probably the most time efficient way to do it tbh.

That’s called generative recognition, and it’s the best way to do it (probably can be formally proved under some noise model assumptions) if you have a good model of the data and enough computational resources.

What tools do people use for stuff like this? A python library? C++?

Not at all, I can already make out the characters and recognized quickly that all but the last 4 blurred characters are hexadecimal and the last appear to be [a-z][A-Z]

You don't need ml. If you know the font and blurring algorithm (or a close approximation), you blur all letters of the font at that size and compare output.

Most of the time, blurring is down with a Gaussian blur and this is, in theory, reversible. In practice what is actually done is round_to_fraction_over_256(gaussian_blur(point, image, …)) so there is an error in the unblurring process. But this error is often not insurmountable, especially with extra information.

Actually, if you can identify the exact font and exact location of each letter (as is in this case) it doesn't matter what kind of blur it is.

If you assume the photo was made with one of the consumer applications, there are only so many popular bluring algorithms. You can brute force it quite easily by testing each character and each type of blur until you get exact match (and in many cases even inexact will suffice).

It's blurred lightly enough for me to be able to tell at least some characters just with my eyes.

Reply on news.ycombinator.com