Most active commenters
  • CobrastanJorji(3)
  • dylan604(3)

←back to thread

DEDA – Tracking Dots Extraction, Decoding and Anonymisation Toolkit

(github.com)
285 points pavel_lishin | 15 comments | 01 Apr 25 21:11 UTC | HN request time: 0.205s | source | bottom
Show context
twalkz ◴[01 Apr 25 22:16 UTC] No.43551892[source]▶
> My printer does not print tracking dots. Can I hide this fact?

> If there are really no tracking dots, you can either create your own ones (deda_create_dots) or print the calibration page (deda_anonmask_create -w) with another printer and use the mask for your own printer

The thought of being able to “spoof” the tracking dots of another printer has interesting implications for deniability. Though I guess in this case you’d still need access to the original printer to print the anonmask…

replies(2): >>43551967 #>>43553819 #
1. decimalenough ◴[01 Apr 25 22:27 UTC] No.43551967[source]▶
Per Wikipedia, the dots' "arrangement encodes the serial number of the device, date and time of the printing", so all you really need to spoof somebody else's printer is the serial number. Which can likely these days even be accessed remotely through printer settings.
replies(2): >>43552018 #>>43552547 #
2. CobrastanJorji ◴[01 Apr 25 22:37 UTC] No.43552018[source]▶
No need to examine the printer. Just find a sheet of paper that printer printed, decode the dots, and then print your super illegal whatever with their printer's dots and a timestamp that makes sense for whatever you're framing them for doing. Nobody's ever gonna believe "the dots were a lie." They sound too much like fingerprints.
replies(1): >>43552314 #
3. dylan604 ◴[01 Apr 25 23:19 UTC] No.43552314[source]▶
Or just go to a big box retailer, grab a couple of serial numbers off of the packaging, and then randomize per page.
replies(3): >>43552516 #>>43552553 #>>43552777 #
4. banku_brougham ◴[02 Apr 25 00:03 UTC] No.43552516{3}[source]▶
Why is the randomizing step needed?
replies(2): >>43552701 #>>43553282 #
5. timewizard ◴[02 Apr 25 00:08 UTC] No.43552547[source]▶
It depends on how it gets the serial number. If it reads it from internal memory then spoofing your own serial number on each document print is the obvious workaround.
6. thfuran ◴[02 Apr 25 00:10 UTC] No.43552553{3}[source]▶
Better than nothing, but you probably don't want to produce a document that purports to have been printed by three different printers that were likely only in the same place during a relatively short period surrounding when you went to see them. You'd be better off just making up serial numbers.
replies(1): >>43553358 #
7. dylan604 ◴[02 Apr 25 00:40 UTC] No.43552701{4}[source]▶
just to throw of the scent. why do people bounce around TOR nodes?
8. anigbrowl ◴[02 Apr 25 00:55 UTC] No.43552777{3}[source]▶
Assumes single page documents
9. Brian_K_White ◴[02 Apr 25 02:58 UTC] No.43553282{4}[source]▶
why randomize a mac address?

If everything you print has the same fictitious serial number, it's still a stable identifier that can be triangulated.

replies(1): >>43557890 #
10. CobrastanJorji ◴[02 Apr 25 03:24 UTC] No.43553358{4}[source]▶
Nah, it's even better. "These messages were printed on a variety of different printers on three separate dates, but all of the printers were in an Office Depot during that time. Now we just need to go through the footage of those days to see who was in that store on all three days." Meanwhile, you're in another state on those days, doing crime.
replies(2): >>43553548 #>>43554073 #
11. dylan604 ◴[02 Apr 25 04:01 UTC] No.43553548{5}[source]▶
Or post a thread on r/inkjetssuck or some such, and just have people from all over the world go into the big box stores to get serials to post as a reply
12. Terr_ ◴[02 Apr 25 06:13 UTC] No.43554073{5}[source]▶
> on all three

Except if you can manipulate the timestamps, then they aren't relevant anymore, so the search space is much bigger than the intersection of each set of days.

It's the intersection of all the people who visited each printer at least once any time.

replies(1): >>43554211 #
13. CobrastanJorji ◴[02 Apr 25 06:43 UTC] No.43554211{6}[source]▶
Yeah, but the police (and then the prosecutors if they find someone who matches) are operating under the theory that the tracking dots are correct. They really want the dots to be correct. They don't want the dots to be wrong. This is why nonsense like "fiber matching" lasted so long: the people prosecuting the crimes want it to be right so badly that they're practically on your team.
14. banku_brougham ◴[02 Apr 25 15:36 UTC] No.43557890{5}[source]▶
Got it. Then why the first step of go to the effort of getting real serial numbers from the big box store. If the dots signature going to be randomized?
replies(1): >>43564049 #
15. Brian_K_White ◴[03 Apr 25 02:27 UTC] No.43564049{6}[source]▶
Maybe just to get the vaild format.