How to catch someone leaking screenshots from a private forum?

[HJW]

There's one user out of almost 2k that is leaking screenshots from a private forum.

Any suggestions as to how to catch them?

I tried hiding the user ID in a similar colour, but jpeg compression made that fruitless unless the user id was obvious.

Maybe the userID can be encoded to make it two characters and that can be placed? Would that be simple to set in a template?

Currently working on something like this to catch a rough idea of the user id, although haven't worked out how to round up to a whole number

<xf:set var="$visid">{{{$xf.visitor.user_id} / 13}}</xf:set>

Or is there a much more obvious answer?

 

[Pepelepew]

What forum us it?

 

[Paul B]

Currently working on something like this to catch a rough idea of the user id

Where/how are you using that to work out who is taking screenshots?

Where are they posting them?

 

[mazzly]

There's one user out of almost 2k that is leaking screenshots from a private forum.

Any suggestions as to how to catch them?

I tried hiding the user ID in a similar colour, but jpeg compression made that fruitless unless the user id was obvious.

Maybe the userID can be encoded to make it two characters and that can be placed? Would that be simple to set in a template?

Currently working on something like this to catch a rough idea of the user id, although haven't worked out how to round up to a whole number

<xf:set var="$visid">{{{$xf.visitor.user_id} / 13}}</xf:set>

Or is there a much more obvious answer?

I read this yesterday, and slept on it.. And I think I might have come up with a way, but it is probably less than trivial to do

Also: I'm not 100% that the jpeg compression couldn't mess with it


Okay, so you take a an element on your page that has some specific background color, lets say the page background

Let's say the standard value of the background is rgb(200,200,200)

Now you take a userid, e.g. 1298 and split that into 3 chunks: 12,9,8. Modify the background rgb()-value by that = rgb(212, 209, 208)

When you find a screenshot, you should be able to reverse the color to a userid.

There are some "problems" with this solution:

• will jpeg compression be able to offset it? (it compresses neighboring pixels, so if enough are the same color, the "middle part" should average to same color)
• background color will be "slightly off" for your users, this might be annoying to some, others might not care
  • The first digit, could be hidden elsewhere (since it has a range of 00-19, which is a lot for the rgb-modification) and put into something else, e.g:
    1 (userid over 1000) = add a slight shadow to the usernames,
    0 (userid under 1000) = normal username
• This is not easy to just do

Maybe that will give you some ideas

 

[RobinHood]

Tell them they have until the end of the day to own up, or else you're banning the lot of them.

 

[HJW]

I read this yesterday, and slept on it.. And I think I might have come up with a way, but it is probably less than trivial to do

Also: I'm not 100% that the jpeg compression couldn't mess with it


Okay, so you take a an element on your page that has some specific background color, lets say the page background

Let's say the standard value of the background is rgb(200,200,200)

Now you take a userid, e.g. 1298 and split that into 3 chunks: 12,9,8. Modify the background rgb()-value by that = rgb(212, 209, 208)

When you find a screenshot, you should be able to reverse the color to a userid.

There are some "problems" with this solution:

• will jpeg compression be able to offset it? (it compresses neighboring pixels, so if enough are the same color, the "middle part" should average to same color)
• background color will be "slightly off" for your users, this might be annoying to some, others might not care
  • The first digit, could be hidden elsewhere (since it has a range of 00-19, which is a lot for the rgb-modification) and put into something else, e.g:
    1 (userid over 1000) = add a slight shadow to the usernames,
    0 (userid under 1000) = normal username
• This is not easy to just do

Maybe that will give you some ideas

Ah that's brilliant I didn't think of that, and changing such a big block to a different colour means it should be safer for JPEG

Will try it out now


I'd rather not say the name as then it would be easy to find the place they're being leaked!

 

[mazzly]

Ah that's brilliant I didn't think of that, and changing such a big block to a different colour means it should be safer for JPEG

Will try it out now


I'd rather not say the name as then it would be easy to find the place they're being leaked!

Good luck!

 

[valdet]

Maybe the userID can be encoded to make it two characters and that can be placed? Would that be simple to set in a template?

Currently working on something like this to catch a rough idea of the user id, although haven't worked out how to round up to a whole number

<xf:set var="$visid">{{{$xf.visitor.user_id} / 13}}</xf:set>

Or is there a much more obvious answer?

Ah that's brilliant I didn't think of that, and changing such a big block to a different colour means it should be safer for JPEG

Will try it out now

I was testing with this and I found the template code to be fairly simple.

For example I used it with random prime numbers to get a result which can be calculated back to a user ID (the one who is sharing those screenshots).

{{9 * ({$xf.visitor.user_id} + 23) - 2 * ({$xf.visitor.user_id} + 41) - 37 }}

You put that template code somewhere in post message template (maybe next or before the post number).

This simple math equation with addition, subtraction and multiplication is to simply throw them off about what that number is and not be able to connect it with their User ID or another known number.

In essence the above is a very simple math equation of

9 * ( X + 23 ) - 2 * ( X + 41 ) - 37 = Result number

Then it is a simple backward calculation to solve for X i.e. the resulting user ID.

USER ID = (Result - 88) / 7

 

[StarArmy]

Put a little Robohash robot somewhere in the page? https://robohash.org/

 

[Arantor]

If it’s obviously visible it can be edited out, scribbled over, otherwise hidden. If it’s not obviously visible JPEG compression is probably enough to obfuscate it...

Leaking screenshots is nothing new. Preventing it is likely an arms race you won’t win.