Slashdot Mirror
Introducing the NSA-Proof Crypto-Font
Daniel_Stuckey writes "At a moment when governments and corporations alike are hellbent on snooping through your personal digital messages, it'd sure be nice if there was a font their dragnets couldn't decipher. So Sang Mun built one. Sang, a recent graduate from the Rhode Island Schoold of Design, has unleashed ZXX — a 'disruptive typeface' that he says is much more difficult to the NSA and friends to decrypt. He's made it free to download on his website, too. 'The project started with a genuine question: How can we conceal our fundamental thoughts from artificial intelligences and those who deploy them?' he writes. 'I decided to create a typeface that would be unreadable by text scanning software (whether used by a government agency or a lone hacker) — misdirecting information or sometimes not giving any at all. It can be applied to huge amounts of data, or to personal correspondence.' He named it after the Library of Congress's labeling code ZXX, which archivists employ when they find a book that contains 'no linguistic content.'"
Undecipherable my ass.
for all the printed content that you want nobody to read.
Given that this seems to be just a simple font, why would it be hard to write an OCR program to decipher specifically this font (or any other supposedly secure font)? Perhaps a program that dynamically obfuscated text like a CAPTCHA would be more useful. This appears to be more of an artistic statement than something useful.
I heard he's quite the cunning linguist!
which is only subsequently translated into a type face when the item is converted into an image which doesn't contain the letters. So all your data would have to be held as such PDFs, which are no longer searchable.Nice idea - shame about the reality
I guess it will work for all my digital content that I save as raster graphics. Which is...um...none of it.
...when people with a fundamentally flawed understanding of computer communication try their hands at digital cryptography.
How can we conceal our fundamental thoughts from artificial intelligences and those who deploy them?
By using a real form of encryption.
So, the NSA is reading your digital communications. A funky font is no help here, unless it also uses a different encoding (such as trivial replacement scheme where letters look like different letters). This kind of security by obscurity is't something that will defeat the NSA if they try. It might help if they don't try, but wouldn't real encryption be a better idea?
In the case of printed text, this font is supposed to resist OCR via security by obscurity. Thats not very useful: feed the publicly available font into the OCR software then the encryption is broken.
I'm glad someone it trying to cause a minor inconvenience for the NSA, but perhaps he should just use https for his site instead? That would accomplish more. Unencrypted site that wants to give me a cookie; that protects my privacy real well. (Oh, and slashdot, about time for https for you too?).
Recommending Tor would make more sense.
I am not sure if the person is an idiot or just trying to get attention from the NSA news.
The fact that each character has the same obfuscation means that it would be easy to match against, it would be more secure to take a marker pen and scribble random lines through pictures of your rebel message.
But the "clever cryptographic fontâ"which you can use in email messages to shield them from snoops" is just laughable. Any text scanner would only see the character encoding, not the font, or is opening an e-mail and changing it's font beyond their comprehension.
Almost completely indecipherable. http://blokkfont.com/
hey this has given me an idea for the perfect secure font...every char is a blank.
never bring a twinkie to a food fight.
"This project will not fully solve the problems we are facing now", they say. I'd say it barely solve some.
It could even mislead people into thinking that writing emails with this font will make their messages safer. My father for sure would, as he doesn't know what UTF-8 nor what "charset" do mean.
I think most commenters here will end up completely missing the point, just as I initially did. Of course it will be trivial to bypass any possible protection the font might briefly provide, but that isn't the point. The making of the font is a political statement against government machinery and software spying on us and taking our humanity away. As such, I'd say it's quite clever and attention-getting.
Now I'll sit back and watch 50 different people get up-modded for pedantically explaining how it will be trivial to train an OCR to recognize the font and how software reads the bytecodes and doesn't care about the font and blah blah blah...
Is that a giant whooshing sound I hear?
At a moment when governments and corporations alike are hellbent on snooping through your personal digital messages, it'd sure be nice if there was a font their dragnets couldn't decipher.
It is just a font! If I'm sending a digital message, as the intent of this article states, then it hardly matters what font I want it displayed in. What am I expected to do, print every email that I type and all of the data that I want to send into an image that uses this font and just send the image? I'm not convinced that would slow the NSA down as much as it would impact the people I was trying to send it to, not to mention the potential for errors in receiving messages. I'll stick with my one time pad software.
I'm an American. I love this country and the freedoms that we used to have.
not sure what the point is even if you typed it in wingdings it would not obscure the meaning of the original message
As SCO once demonstrated so aptly...
You could obfuscate HTML by generating a custom font with glyphs in the Unicode private use space for each message, then using hard-to-read characters. This is, of course, a monoalphabetic substitution, which is close to the weakest known cryptosystem. At best it might be useful for getting spam through filters.
If anybody started using this font for CAPCHAs, there would be a module to break it for spam programs within weeks. Assuming the existing learning algorithms didn't solve it automatically.
Yes, as anyone with half an ounce of sense will have already realised, no font will ever be NSA proof. The first mistake was publishing it on the internet...
The creator is trying to make a point about privacy, not implement a workable solution.
systemd is Roko's Basilisk.
I would not ether unless I had a tech support call about a x showing up when the guy pressed the r key... This really about ASCII codes. The person who created it thinks 1. NSA is focued on U.S. keyboards (as it is the English standered each key is mapped to a ASCII code so if you mix up those codes and send all your e-mail in HTML where the codes are mapped to the letters then your safe 2. NSA is so big and working on so many streams of info that the amount of work it would take to create a single system to work on the font that few will use its pointless. (apple effect for hackers) Also NSA is looking most likely for keywords this will not set off any of those.
Firstly, if its using standard character values and this font is laid over it, then you just look at the character value.
Secondly, If this is only for display documents, there's OCR and the NSA is unlikely to get a sneaker net hard copy anyway.
So if you limit it to electronic documents, then the only way to make it unreadable is
a) the underlying character values are goofy ( the letter 'z' displays as "A").
So the unicode character values
zd% ne@erkaw $ekkew
is actually display as
"The terrorist network."
And then you might as well use stenography.
She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
RISD is just a place where stupid hipster kids with rich parents go to film themselves masturbating in bath tubs then go in front of the class and spout a line of b.s. about how it's the most original and unique thing ever created.
I dunno. The Talking Heads came out of the RISD, and they were pretty cool back in the 80's.
Of course, maybe the RISD only produces a band like that once in a lifetime . . .
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
In all fairness, there's a good reason why nobody ever before attempted to do whatever they did, so it IS unique.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
http://search.dilbert.com/comic/Small%20Font
Prior art?
Serenity now, insanity later.
I was going to come in here and remind Soulskill that this is not April first. But then I remembered that there's a "submit story" link in the /. global footer. This is probably his way of reminding us that we need to click that now and then if we don't want to see this crud.
Help stamp out iliturcy.
lousy encryption idea. I mean, all one has to do is add this to an OCR database in order to decipher the text. anything printed and mapped is in essence already broken.
The idea should be to get ideas out on a larger scale, not hide them.
now we need to go OSS in diesel cars
So his stuff will actually show up in that font when they try to read it.
Wait...
"As SCO once demonstrated so aptly..."
I believe you are confusing a lawsuit concieved by wingings rather than written in that font. :)
Too easy to train OCR for his font. Same glyph for same character. When they say that NSA is reading your mail, they don't mean snail mail. I'm sure that it seamed like a good idea at the time.
There was an unknown error in the submission.
If you exported a document as a pdf, you can embed fonts in it. Run a program to convert your original text file into another one. translate out the characters to other ascii ids. and then embed the font.
For example, ""DOG". Letter "D" is ascii 68. So the pdf will say "this is character 68, in whatever font you had selected." So place the obfuscated glyph for "D" in the position for "Y" (90) and then change all Ds to Ys in the document's text stream. Then when a person reads it, it LOOKS like DOG but copy-paste will get "YOG". Do this for all characters and numbers.
A smart app to do this would roll up a random ascii remapping for each document, and obfuscate characters in the font differently each document. This would make it difficult to craft a specific skimmer module to handle this obfuscation automatically..
This will allow you to email or post the data, and humans to read it, but skimmers won't get legible text with a copy and paste, and if they then fall back to OCR attempt, that will also fail.
Although in reality, fallback to OCR in an automated system is unlikely, and would probably just move on to the next document to skim. So just making very slight adjustments to the glyphs in the font, (to prevent automated correction) in addition to mixing them up, would probably do a good job against fully automated skimming. The adjustments this guy is making (except for the last one) are inconvenient to read. Just adding a LITTLE noise would do the trick I think.
I work for the Department of Redundancy Department.
Al of /. completely missed his joke. Man, you guy are pathetic.
I know /. readership has dropped over the past few years, but I think you might be exaggerating just a little bit, here.....
"City hall" in German is "Rathaus" Kinda explains a few things......
Of course, NSA could still apply basic kindergarten 101 cryptanalysis (e.g. by selecting characters according to their frequency and mapping them to EATOINSHRDLU...), but that would be more work. A simple grep(1) won't be enough and, more importantly, couldn't be done on current massively parallel silicone chips: they'd have to be reprogrammed. Sure, just a bump in the road for NSA, but it's a way to show dissent.
cpghost at Cordula's Web.
That is to use anti-NSA measures for communication.
On a side note, even just trying to read the example on the website gave me a headache. And I bet an OCR could read it much much faster than me.
If I use this for all my writing will it make me as k3wL as if I used 1337 speak?
Many have already pointed out that making an unreadable font would really only protect against physical letters (as in, mail, not email) being read, or perhaps text being distributed through raster images. After all, 0x446561746820746F20416D6572696361 means the same thing, whether it's displayed in Helvetica, Times Roman or this new font.
We have measures that are better against machine interception (such as encryption), but those still have one flaw - they're obviously hiding something, and apparently "having something to hide" is now a crime in and of itself. There are steganographic techniques to hide one message inside another, but as soon as they become commonplace, they too will be scanned for.
What we need is something machines cannot adapt to. We need language. Come up with a system of code phrases that can easily be confused for inane, "safe" chatter. Either they don't scan for it, or grabbing it gets too much, and any actual messages get hidden within the noise. Make it so that only a human could reliably determine whether it's an actual "terrorist" message, or if it's a regular email.
For extra protection, base it off a somewhat-obscure set of jargon, so that even the average person wouldn't find anything suspicious about it.
The fact that this post made it onto slashdot's page is proof that it has jumped the shark. A "crypto-proof font" is like "crypto-proof salad dressing". It's absurd on its face, and it actually made it to full article status on /. Alas and adieu.
If the NSA and other snoops capture and record data that is sent and just store it for subsequent analysis when the need arises, a better approach to foiling them would be to not actually send data at all, but only to compute data live at each end.
Computing the data of a communication can be done in countless ways, from timing the intervals between items of data sent (where the data is either garbage or readable misdirection), to encoding it in IP addresses used, applying mathematical functions to the live stream, or any of a million other wierd approaches that a suitably inebriated brain could dream up. This diversity is a strength.
Note that this is not cryptography, it's denial of cryptographic analysis at a later date because essential reassembly parameters are available only at the time of transmission, not later. All it would do is prevent dumb data gathering and storage by the mass dragnet from providing data that is meaningful at a later time.
Needless to say, you could use it in conjunction with cryptography too if you wanted to ensure that, should they actually be monitoring you live and capturing a whole pile of possible reassembly parameters, then they'd still need to break the real crypto as well. But if they're doing that to you then you're probably in deep trouble already and you shouldn't be online reading Slashdot.
Where it can help is by being a thorn in the side of the mass data collectors, and so helping the great mass of public communication remain private despite subsequent analysis by the spooks. To combat it, they would not be able to just blindly collect traffic for posterity, because it would be meaningless.
It's not an original idea, but perhaps after the PRISM revelations it's time to revive some old ones.
The inventor is more concerned with a political statement rather than use. Unfortunately, he's convinced himself that it has some use because it tricked some OCR program he downloaded.
SCO probably thinks just because they use wingdings to correspond with their lawyers that the Linux kernel must be violating their copyright because actual source code to them just looks the same as wingdings to everyone else
This is the dumbest article I have ever read.
...sorry, just had to get that out.
That is how hieroglyphs were decrypted.
No, that's not how heiroglyphs were translated, although that's an important tool in breaking substitution cyphers. Heiroglyphic (and Demotic) scripts were translated using the Rosetta Stone, which is inscribed with a decree in heiroglyphs, demotic and greek, although none of the versions are complete.
Good, inexpensive web hosting
This is a bad title. The font is of course breakable, and author tells about it in TFA::
Sang has no illusions that even a clever cryptographic font—which you can use in email messages to shield them from snoops and font-recognition bots—will remain encoded for long. They're not meant to be long-term tools with which to combat the NSA. Rather, he views them as an awareness-raising measure.
"This project will not fully solve the problems we are facing now," he writes, " but hopefully will raise some peculiar questions."
Slashdot title is bad. Of course the font is breakable, and the author even acknowledges it in TFA:
Sang has no illusions that even a clever cryptographic font—which you can use in email messages to shield them from snoops and font-recognition bots—will remain encoded for long. They're not meant to be long-term tools with which to combat the NSA. Rather, he views them as an awareness-raising measure.
"This project will not fully solve the problems we are facing now," he writes, " but hopefully will raise some peculiar questions."
I have to give the creator credits for a relatively creative scheme but there is a fundamental flaw. Ultimately, based on the availability of the font, NSA can just forensically evaluate which key strokes create which characters and work backwards from there. There is no privacy guarantee. This could only work well if the font were dynamic and shifted shapes on a random basis. Then you would be more closely approximating cryptography.
because Sang Mun == anagram for "Man Guns"
Even better, a Doctors hand writing - the NSA will have to hire pharmacists or RN's to read it.
if AI scanning were what the government was actually doing.
It'd be a little better because decent captcha generators won't generate the exact same symbol for a given letter every time specifically to foil OCR programs. But often captcha generators produce outputmthat even humans can't read...
This is about as secure as rot13
How can we conceal our fundamental thoughts from artificial intelligences and those who deploy them?
Easy, don't put them on the Internet or computer. You see they have these things called pens and pencils and this other stuff called paper. You want something hidden from electronic surveillance, don't make it electronic.
Right. The NSA is doing screen captures and then using OCR to read your messages, rather than just intercepting the bytes that don't give a fuck what font you're using.
Where do you get silicone chips? Old breast implants? Do they only function in supporting roles? And by massively parallel, are you saying that anything below a DD won't work? To start up a silicone chip, do you bra-strap it instead of boot-strap it? Are silicone chips the ideal technology to create AI's without feelings?
I would like to learn more about this. How can I subscribe to your newsletter? I can already tell it's worth at least a nipple an issue.
I've fallen off your lawn, and I can't get up.
Support your local open source project: http://freecode.com/projects/fuckthensa
from their website:
"FuckTheNSA is a binary-to-text encoding and decoding tool. The encoded data is an ASCII-string, 8 times bigger than the source data, and consists purely of anti-NSA profanity. It encodes any 8-bit byte sequences."
Sooooo much funnier too.
Lightning Bolt!