Why Blurring Sensitive Information is a Bad Choice for Hiding It

[KenR]

Here's an interesting post about how blurred-out information can be recovered

Undoubtedly you have all seen photographs of people on TV and online who have been blurred to hide faces. For example, here's one of Bill Gates:
[See Image Below]

For the most part this is all fine with peoples' faces as there isn't a convenient way to reverse the blur back into a photo so detailed that you can recognise the photo. So that's good if that is what you intended. However, many people also resort to blurring sensitive numbers and text. I'll illustrate why that is a BAD idea.

Suppose someone posted a photo of their check or credit card online for whatever awful reason (proving to Digg that I earned a million dollars, showing something funny about a check, comparing the size of something to a credit card, etc.), blurring out the image with the far-too-common mosaic effect to hide the numbers...

http://dheera.net/projects/blur.php

[Deozaan]

Wow, that's cool.

[f0dder]

Pretty interesting.

Blurring is so much prettier than just blocking out, though

[jgpaiva]

I think that there's also another issue: wouldn't the person who made the bluring algorith be able to reverse engineer it and get the original text?

[f0dder]

I think that there's also another issue: wouldn't the person who made the bluring algorith be able to reverse engineer it and get the original text?

-jgpaiva (January 08, 2007, 05:16 AM)

No, it's a lossy operation, so you won't be able to get the exact original. (Well, a malicious blur-tool author could do trick things with alpha channel in a 32bpp image, or perhaps some palette tricks for 8bpp, to make it a bit easier to get at original-ish data, but... that's pretty far-fetched).

[jgpaiva]

I see.
Another question: doesn't the method mentioned in the article only work if all bluring methods use the same algorithm? (which they don't, or do they?)

[f0dder]

Well, you can often guess which tool a person used (photoshop, gimp, paint shop pro). And most effects are probably implemented similarly anyway.

[mouser]

As f0dder says, blurring is a *lossy* algorithm, which means that information gets lost when you blur something, so it's not going to be possible to recover the original exactly or completely in most cases.

The real lesson from this article is that you should be really careful about "slightly blurring images which could have come from a small set of possible sources (like a number)".  If you sufficiently blur something with some real variety it's going to be difficult to recover it.

Still - it does suggest that there is room in the world for a "cryptographically secure" blurring algorithm, which purposely introduces some randomness and color reduction in order to eliminate the possibility of recovery.

[TucknDar]

Damn, I bet that Screenshot Captor author speculates in getting all our personal information!! 

[f0dder]

Damn, I bet that Screenshot Captor author speculates in getting all our personal information!! 

-TucknDar (January 08, 2007, 01:00 PM)

Yeah... do take a look at the alpha channels of those .png pictures!

[mouser]

Yeah... do take a look at the alpha channels of those .png pictures!

i don't get it.

ps.
please keep in mind this is how rumours get started - so might want to make clearer when you are joking about such stuff. 

[f0dder]

Good point, mouser - so to make it clear: yes, I'm joking, I'd be very surprised if mouser did anything backdoorish in any of his apps.

Anyway, alpha channels - tyically 8 bit of information per pixel, used for transparency, but theoretically you could put anything there (although the pictures would render funnily in programs that support alpha; I don't know if you can somehow specify a PNG file that has the alpha channel but set to "don't use").