💾 Archived View for rawtext.club › ~sloum › geminilist › 006096.gmi captured on 2023-11-14 at 09:36:53. Gemini links have been rewritten to link to archived content

-=-=-=-=-=-=-

[tech] Zero-width characters and tracking via pasted text

nervuri nervuri at disroot.org

Sun Mar 14 16:12:12 GMT 2021

- - - - - - - - - - - - - - - - - - -

Public service announcement: Zero-width characters can be used to embedhidden information inside of plain text. For example, a page can bedynamically generated server-side to include, between every few words:

your username / certificate ID (if logged in)* your IP address* the current timestamp

By copying text from the page and pasting it somewhere public, you wouldbe revealing this information to anyone who knew how to look for it.This subtle form of tracking would work just as well on Gemini as itdoes on the web. Gopher is more protected from this, as many clientsare ASCII-only.

I'm gathering information about this sort of thing (and textsteganography more broadly) at:

gemini://rawtext.club/~nervuri/stega.gmigemini://rawtext.club/~nervuri/zero-width.gmi

The first is an explanation of the problem, with links to various toolsand references.

The second is a test to check which software displays (or warns aboutthe presence of) zero-width characters.

Contributions are welcome. I'm especially interested in what softwarepasses the 0-width character test and what 0-width chars I've missed.If you know of a good tool for detecting plain text steganography, dotell.

P.S. In Amfora I noticed a visual glitch when I openedgemini://rawtext.club/~nervuri/zero-width.gmi and scrolled up and downfor a bit.