SoylentNews

Be Careful What You Copy: Invisibly Inserting Usernames Into Text

posted by Fnord666 on Thursday April 05 2018, @08:27PM   
from the digital-fingerprints dept.

Arthur T Knackerbracket has found the following story:

Zero-width characters are invisible, ‘non-printing’ characters that are not displayed by the majority of applications. F​or exam​ple, I’ve ins​erted 10 ze​ro-width spa​ces in​to thi​s sentence, c​an you tel​​l? (Hint: paste the sentence into Diff Checker to see the locations of the characters!). These characters can be used to ‘fingerprint’ text for certain users.

Well, the original reason isn’t too exciting. A few years ago I was a member of a team that participated in competitive tournaments across a variety of video games. This team had a private message board, used to post important announcements amongst other things. Eventually these announcements would appear elsewhere on the web, posted to mock the team and more significantly; ensuring the message board was redundant for sharing confidential information and tactics.

The security of the site seemed pretty tight so the theory was that a logged-in user was simply copying the announcement and posting it elsewhere. I created a script that allowed the team to invisibly fingerprint each announcement with the username of the user it is being displayed to.

I saw a lot of interest in zero-width characters from a recent post by Zach Aysan so I thought I’d publish this method here along with an interactive demo to share with everyone. The code examples have been updated to use modern JavaScript but the overall logic is the same.

---

Original Submission

• Re:Not showing my username Re:Not showing my username (Score: 3, Interesting) by maxwell demon on Friday April 06 2018, @06:55AM (1 child)

  by maxwell demon (1608) on Friday April 06 2018, @06:55AM (#663309) Journal

  Actually, you can just look at it with less. Then you even get the Unicode code numbers in a readable form:

  F<U+200B>or exam<U+200B>ple, I’ve ins<U+200B>erted 10 ze<U+200B>ro-width spa
  <U+200B>ces in<U+200B>to thi<U+200B>s sentence, c<U+200B>an you tel<U+200B>
  <U+200B>l?

  (Note that the Unicode code points are shown inverted, so you can distinguish them from an ASCII character sequence of the same form).

  --
  The Tao of math: The numbers you can count are not the real numbers.

  Parent

  Starting Score:	1		point
  Moderation		+1
  Interesting=1, Total=1
  Extra 'Interesting' Modifier		0
  Karma-Bonus Modifier		+1
  Total Score:		3

• Re:Not showing my username (Score: 3, Interesting) by FatPhil on Friday April 06 2018, @08:00AM

  by FatPhil (863) <{pc-soylent} {at} {asdf.fi}> on Friday April 06 2018, @08:00AM (#663328) Homepage

  Good point. TMTOWTDT is good. But is this the Unix way? Personally, I don't believe that's less's job, it should be a pager with scrollback, and very little more - I don't even see a switch to turn it off, unless that's what -r is for, and in that case, it's terribly documented (non-ASCII utf-8 isn't control characters). And don't get me started on cat -t!
  
  At least less implemented the escaping functionality correctly, locale aware - when you unset LANG you'll get:
  F<E2><80><8B>or exam<E2><80><8B>ple, I<E2><80><99>ve ins<E2><80><8B>erted 10 ze<E2><80><8B>ro-width spa<E2><80><8B>ces in<E2><80><8B>to thi<E2><80><8B>s sentence, c<E2><80><8B>an you tel<E2><80><8B><E2><80><8B>l?
  
  Which turns unicode into moar garbage, which I think is fitting.

  --
  Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves

  Parent