天空вℓσи∂ [Deprecated edition] @skyblond@social.cleverlibre.org

*Me scrolling through the app*

Who posted this super long post? Why can't they make things short?

*Look carefully*

Oh, it's me.

@marathon0

Oh, I typed the wrong letter. It should be EFF.

A fun coincidence is that I donated EFF recently, and the day after that day, people started reporting a Chinese social media uses blind watermark to track users.

@freeschool

Copyright on movie seems not very effect. I still collecting BD remux I didn't pay for, and running a BT seedbox.

However, the gaming industrial use it a lot. Nintendo is still actively stop people from rip the data off from their purchased game cartridge, even if that's the only way to preserve the history and make the game available to future generations. But Nintendo don't care this, and they take down sites and passages by issue copyright complains.

Generally speaking, I don't want other people to abuse my content (video, code, concept, etc.), but I do like people using their own way to preserve it.

----

Also, the software that applies random color map, it's not hard to write one, using JavaFX and the raster, I think it's fairly easy without thinking about optimizing the algorithm. However, I know a Chinese website do this: stegonline.iculture.cc

You need to upload a file by clicking “上传图片” (which basically means "upload picture"), then you got a bar that you can switch different mode by clicking "<" (previous one) or ">" (next one).

I never heard about Machine Identification Code before, but I feel pretty uncomfortable when this device can mark and track things without letting me know.

And... I got the speed wrong last night.

I thought I was using a proxy server hosted on Hetzner, but I was actually using a Japanese server.

With a DE proxy not hosted by Hetzner, I got 240 Mbps download, as same as the Google drive (and I think this is the limit of my downlink). The uplink speed is the same.

Solved the mounting issue with mountain duck.

Solved the folder sync/backup issue with duplicati.

Now I can cancel my Google One subscription and call it a day.

@khird

Yeah, I know similar things in the cinema, where the publisher uses a special machine to insert a unique id or something as a watermark in real time when the movie is playing. It's mainly used to identify the uploader record the movie in which cinema at what time. For copyright protection, this is a totally great technology.

But for tracking civils? 🤔

So, how can I know if my Windows/Android/some social media platform is tracking me or not?

I don't know. You don't know. Only they know. Since it's a blind watermark or steganography, by design, no one should notice and know the existence of the hidden info, unless they know the mechanism beforehand. The LSB, 2D Fourier transform, jstep methods are old and known by the public. However, it would be easy to develop their way, maybe from scratch, or based on advanced research and paper.

The best way to defeat is turning your screenshots into only white and black, aka binarize. By doing so, all info in the pic will be significantly decreased, while the text on the picture can still be read. This method doesn't work with pictures. Another way to defeat it is taking a photo of your screen, but it's not 100% time working. People have tools to remove hidden info in the picture, and they released their code on GitHub. However, I want to warn you that they are not 100% working. They can only handle the watermark/steganography they know. Just like virus scanning, they can only find the patterns they have already known. You must develop your own methodology to keep yourself safe, like no login if not required, using proxy/vpn/tor, using a virtual machine, describing what you see instead of sending a screenshot, etc.

Automated tools can't solve everything. That's why we need security researchers and people at EEF to keep watching on all possible threats.

(This is the end of the thread)

I talked about this with my friends. This is not the first time that a blind watermark has been used to track the flow of info. They usually are used in enterprise situations, where you want to know who takes a screenshot of the internal IM app and sent on the internet, and I think this is acceptable.

However, tracking regular users is kind of crossing the line. After 30 minutes of diving into the steganography and blind watermark, I think most apps use the blind watermark when dealing with screenshots.

Steganography like LSB or jstep, or even 2D Fourier transform, is not practice. Thinking about LSB or jstep. I post a photo on qoto. No matter your client, it's a small picture on your device. You take a screenshot of what I said with that pic. With this significant scaling, I think most info is lost. With 2D Fourier transform (add high-frequency info to the pic), it would be hard for an app to do this, since they cannot change how Android or iOS render the button, etc. However, I think a modified ROM or hardware can output something secretly when taking screenshots or photos. A simple solution is to encode the Google/Xiaomi/Huawei account id, or IMEI in the screenshot or the photo, and considering this is not a massive amount of information, it shouldn't cause too much interference to the pic. And since it's system/hardware level, it's hard to notice.

The more common way is the blind watermark, aka, an invisible layer with graphical info, like text, on top of the app. The invisible layer tends to use 0.5% transparency, so it can't be detected by the naked eye. However, if you apply a random color map, aka map each color to a random color, the similar, hard-to-detected color will be mapped to a different color, which is likely to be easily detected.

As far as I (and other people on the internet) know, only the watermark is used to track people in public, based on how many things can the target platform control (mostly App).

@Pat

I'd prefer something like RAID or ZFS. If the thumb drive failed, all of those 1TB data will be gone. Before I start using unraid, that's how I store and lost my data

Also want to talk about the blind watermark on some Chinese social medias, to track user across different platforms.

It's extremely dangerous when someone post those screenshots with their identity to something like twitter, since twitter is blocked in China, and the police can catch and charge you if they can proof you have the account on those platforms.

The best way to defeat that is turning screenshots into pure white and black, works with text, not work with pics.

... And it's too late, I'm on the bed. I'll keep talking this tomorrow (if I can remember).

Even though the people are active at a late time (1:30 AM here), and with a not-so-beautiful web panel compared to Twitter (I'm a PC guy, while my friends prefer mobile), I still love using mastodon.

Seeing different people from different instances reacting to my post is fantastic! And I was amazed by how fast my post spread across the mastodon network (when you need minutes to sync between P2P nodes).

(And I just noticed, even with Grammarly, my English is still bad, by not taking Grammarly's suggestions, LOL)

(You definitely can understand what I'm trying to say, right? ...Right?)

@inference

Yeah, that's a huge risk, so I'm eager to move my data from google to somewhere else, after 3 years of nothing happened. However, you can't select China because their country list doesn't have that option. I can select Taiwan or HongKong, but I don't have any local payment to use. Now I'm using a virtual credit card to handle my payments, which, charges 5% fee for each tx.

Thankfully, I've been using my account for years, and they might think I'm an American living in China. If that's a new account, I'm sure using a virtual card and an IP from the datacenter will trigger their anti-fraud system in less than 5 minutes, LOL.

@pthenq1

Normally I don't. But I'm in China, and the network is worse. Without a proxy, the transfer speed is less than 100KB/s, and as far as I know, there is no way to force windows to use a socks5 proxy (VPN has been dead in China for years) when mounting samba.

@inference

Then cross-platform would be a nightmare. Also, considering I rely on Google too much, I think I'd better spread my data over other service providers before they close my account since I'm using an American account while in China.

I think I'm safe because now I have Google, AWS, and Hetzner in my supply chain. I asked AWS and Hetzner, and they said they would never check my file, not with human nor with AI.

@freemo Oh, glad to know that! I'll have a look soon :)

I'm thinking about switching from google drive to dropbox, due to safety reasons (I don't want any suspicious AI spy on my files). Today I noticed the Hetzner Storage box and mountain duck.

Hetzner storage box offers 1TB network drive for 3.2 EUR per month, and mountain duck offers a way to mount that network drive on Windows, with a 39 USD one-time fee. The software is made in swiss.

Due to the god damn GFW in China, the speed can't go over 100KB/s without proxy. Thankfully, with my proxy server set up on the Hetzner FSN datacenter, the upload speed is faster than 4MB/s, which I think is the limit of my network. The download speed is also not bad: 8MB/s at the beginning, drop to 2MB/s, sometimes stuck at 2Mbps. Not sure who should be blamed for this, since there are too many participants involved: mountain duck, my transparent proxy, my network ISP, the proxy server on Hetzner, Hetzner storage box, I don't know. But with WebDAV, it supports random access, which means I can stream a video and scroll back and forth without waiting for the stupid client software to download the entire file (It's you, Google Drive Client).

The price is also the cheapest. Hetzner's price is equivalent to 38.16 USD per TB per year (BX11, with BX41, you get 24.246 USD per TB per year), while Google Drive (2TB annually) is 49.995 USD per TB per year, and dropbox (2TB annually) is 59.94 USD per TB per year. The proxy server is kind of required no matter which service I use, so that's not a big game changer.

I will try this configuration for a while. If I think it's good enough, that would be a great deal.

@trinsec We can't receive registration SMS. It is blocked in China. (However, we can still get telegram's SMS)