Hacker News Reader

Comment by andybak | Hacker News Reader

Being fair, if anyone is sending anything to the client and assumes it's not visible then they are fair game.

I just hope the code around password entry fields is carefully audited. That's all on the client.

There's a story from years ago (I couldn't find it) about some government or legal documents having info redacted, but whoever did it just used some pdf editing tool to draw black boxes over the redacted parts, so all the info was still in the pdfs.

Edit: I found this but I'm not sure it's the one I'm remembering: https://www.techdirt.com/2014/01/28/new-york-times-suffers-r...

One of the Apple v Samsung (?) cases had court docs released with some App Store numbers redacted but it was just black squares over the actual numbers, just selecting the sentence and copy/pasting it gave it to you.

This happened with the Maxwell redacted court docs

Do you have a link to the unrelated docs?

*unredacted

Stupid autocorrect

Yes, but there is more than that there. What if I as the client try to print a page or export to PDF. I think that there is nothing sensitive visible on the page so I share the result. It turns out that there was actually sensitive info in the canvas that was not visible due to something like overdraw.

As a simple example imagine that an image is drawn to the canvas and then blacked out. You wouldn't expect that the saved PDF may contain those as separate layers.

Of course this highlights an existing issue with complex formats. You need to be very careful before sharing complex documents.

I've seen big-firm lawyers make the same mistake more often than you'd think - a pdf "redaction" that's just a black box under which you can simply highlight and copy the obscured text. Oops.

Reply on news.ycombinator.com