"REMINDER: IT APPEARS LIKELY THAT ALL RECENT COMMERCIAL COLOR LASER PRINTERS PRINT SOME KIND OF FORENSIC TRACKING CODES, NOT NECESSARILY USING YELLOW DOTS. THIS IS TRUE WHETHER OR NOT THOSE CODES ARE VISIBLE TO THE EYE AND WHETHER OR NOT THE PRINTER MODELS ARE LISTED HERE. THIS ALSO INCLUDES THE PRINTERS THAT ARE LISTED HERE AS NOT PRODUCING YELLOW DOTS.
This list is no longer being updated."
I wonder if it would be possible to reverse engineer the firmware, and remove the dot printing, similar to camera hacks that remove feature restrictions.
Anyone know the status of steganographic tracking / watermarking for scanners? Like when you scan to PDF. There might be something plain-text/easy that ends up in the PDF file to identify the make/model/serial number of the scanner that might be straightforward to strip. But are there more subtle yellow-dot like things that might be harder to strip?
Interesting question, but I suspect that there isn't such a convincing use case for this as forged currency is for tracking color printers. Does government use paper as a security boundary, and if that's the issue, wouldn't it suffice to have the scanners in the relevant offices log everything they are scanning (which I think they already do)?
Also, almost all such watermarks would be easily destroyed by bitonalization and despeckling, which is usually done anyway to reduce the file size (e.g. it's part of the default operation of https://github.com/4lex4/scantailor-advanced ). Arguably the same is true for yellow dots if one is leaking scanned printouts, but identifying leakers is not the main purpose of the dots...
If one really wanted to, one could try embedding little holes into certain letters and hope they survive the smoothing algorithms and don't stand out too much. Not sure how successful that would be, though.
> “REMINDER: IT APPEARS LIKELY THAT ALL RECENT COMMERCIAL COLOR LASER PRINTERS PRINT SOME KIND OF FORENSIC TRACKING CODES, NOT NECESSARILY USING YELLOW DOTS. THIS IS TRUE WHETHER OR NOT THOSE CODES ARE VISIBLE TO THE EYE AND WHETHER OR NOT THE PRINTER MODELS ARE LISTED HERE. THIS ALSO INCLUDES THE PRINTERS THAT ARE LISTED HERE AS NOT PRODUCING YELLOW DOTS.”
So the title is misleading; this list indicates whether dots have been observed, not whether they are present.
Good luck finding a color printer old and serviceable enough to use that doesn't print tracking dots.
Also, they're so rare now that it would be circumstantial proof of use if a color page lacked tracking dots and readily matched with the printer.
Your best bet for printing something without being caught is a burner printer: pay someone else to buy a printer out-of-state in a store with cash, do your business, and toss it.
With the highly-subsidised nature of printer (it's the razor model: provide the razors cheaply, make up on the blades), the burner route is actually reasonably affordable. Particularly if your one-time use is a high-volume printing.
The burner model provides little security in North America. Big box retailers record device serial number to prevent return fraud. It is known that retailers sell transaction information. It is also known that retailers use facial recognition, wifi, app location data, and bluetooth beacons to identify customers, even customers who pay in cash.
It stands to reason that retailers link transaction information--including serial number--to unique individual identifiers. It is possible this data is traded.
It is depressing that people in Western democracies have to worry about authorship identification via printers the same way people in the DDR had to worry about authorship identification via typewriter. But here we are.
There are numerous commodity markets in which indirect purchases are commonplace.
These might be informal (e.g., used appliances) or organised (straw purchasers or organised purchasing of burner phones, the latter was a subplot of The Wire.
Of course, utilising previously used devices might itself lead to traces for those printers, though that's probably a relatively low risk: the likelihood of any given printer producing output that's generally identifiable is relatively low.
That said, a fair point and consideration for anyone facing this threat model.
I did a quick study on an Epson Ecotank printer 3 or 4 years ago, and I found "random" colored pixels that were added (for example a single cyan dot in a large circle of pure cyan changed to a pure magenta dot... like that is a natural mistake if it occurs multiple times on a single page with different colors, and different positions), fuzzed black lines (not really fuzz, but holding data in the "noise"), and a few horizontal lines shifted by a few pixels every once in a while. So I believe that most of the other changes are real.
Edit: If you want to check your printer then: print something to a piece of really white paper, scan it, and then use a diff tool like in Gimp after resizing it to easily spot the differences. If you are using off white paper you can scan it also before you print on it, and attempt to remove the paper's natural color variations before "diff"ing it with the digital version.
I'd think this is not a good idea. You're essentially trying to break a stenographic code yourself. If you find nothing, was it not there or did you just not look hard enough?
If it matters if it's there or not, assume it's there. It's really the only safe option.
To answer the actual question though: how I'd start would be, scan a blank piece of paper. Print something small on it. Scan it again. Look for any differences using digital imaging tools. This should allow you to potentially find invisible differences.
You can also try to tell while it's printing if it does something to parts of the page that you didn't print to. Print at the bottom of the page only. Do the print heads engage anywhere else? Do the same thing with the middle.
There is an advantage if you are testing printers rather than reviewing a single scan as they describe - you can print the same content on two different printers and compare the output
It would be interesting to see a class action suit over this because it inflates toner sales. The main problem is damages are pretty limited, maybe $1 per class member. It would make printer makers disclose this though, and some people would get mailed notices telling them their printer has been tracking them.
Are there any open hardware printer projects? You could (almost) guarantee no tracking dots, although of course a totally custom printer might produce output that is unique enough to be unintentionally identifying.
As a side effect it might actually be repairable instead of disposable like most commercial printers seem to be.
Sort of a tangent, but I recall hearing that the early generations of HP LaserJets had much hardware commonality with Canon copiers.
I wonder if it makes sense to target used copiers as a baseline. They would be built to last and not screw people over on consumables, because the 99.9% business copier market is going to be way more TCO-sensitive than home users. I'm imagining some kit where you'd buy a minivan-sized copier, bolt a Rasbperry Pi onto a custom cable harness, and rip off all the scanning and controls stuff.
On the other hand, I'd suspect many of those devices are sold as having network-printer functionality already, so it may be moot.
28 comments
[ 2.7 ms ] story [ 70.2 ms ] thread"REMINDER: IT APPEARS LIKELY THAT ALL RECENT COMMERCIAL COLOR LASER PRINTERS PRINT SOME KIND OF FORENSIC TRACKING CODES, NOT NECESSARILY USING YELLOW DOTS. THIS IS TRUE WHETHER OR NOT THOSE CODES ARE VISIBLE TO THE EYE AND WHETHER OR NOT THE PRINTER MODELS ARE LISTED HERE. THIS ALSO INCLUDES THE PRINTERS THAT ARE LISTED HERE AS NOT PRODUCING YELLOW DOTS.
This list is no longer being updated."
I wonder if it would be possible to reverse engineer the firmware, and remove the dot printing, similar to camera hacks that remove feature restrictions.
Also, almost all such watermarks would be easily destroyed by bitonalization and despeckling, which is usually done anyway to reduce the file size (e.g. it's part of the default operation of https://github.com/4lex4/scantailor-advanced ). Arguably the same is true for yellow dots if one is leaking scanned printouts, but identifying leakers is not the main purpose of the dots...
If one really wanted to, one could try embedding little holes into certain letters and hope they survive the smoothing algorithms and don't stand out too much. Not sure how successful that would be, though.
So the title is misleading; this list indicates whether dots have been observed, not whether they are present.
List of Printers Which Do or Do Not Display Tracking Dots - https://news.ycombinator.com/item?id=14501894 - June 2017 (210 comments)
List of Printers Which Do or Do Not Display Tracking Dots - https://news.ycombinator.com/item?id=1408510 - June 2010 (27 comments)
Also, they're so rare now that it would be circumstantial proof of use if a color page lacked tracking dots and readily matched with the printer.
Your best bet for printing something without being caught is a burner printer: pay someone else to buy a printer out-of-state in a store with cash, do your business, and toss it.
It stands to reason that retailers link transaction information--including serial number--to unique individual identifiers. It is possible this data is traded.
It is depressing that people in Western democracies have to worry about authorship identification via printers the same way people in the DDR had to worry about authorship identification via typewriter. But here we are.
These might be informal (e.g., used appliances) or organised (straw purchasers or organised purchasing of burner phones, the latter was a subplot of The Wire.
Of course, utilising previously used devices might itself lead to traces for those printers, though that's probably a relatively low risk: the likelihood of any given printer producing output that's generally identifiable is relatively low.
That said, a fair point and consideration for anyone facing this threat model.
Both avoid store registration though.
Seemingly random pixel positions shift, brightness shift, density shift, etc.
These are all hypothetical though. We don't know if these techniques exist in the wild.
Edit: If you want to check your printer then: print something to a piece of really white paper, scan it, and then use a diff tool like in Gimp after resizing it to easily spot the differences. If you are using off white paper you can scan it also before you print on it, and attempt to remove the paper's natural color variations before "diff"ing it with the digital version.
If it matters if it's there or not, assume it's there. It's really the only safe option.
To answer the actual question though: how I'd start would be, scan a blank piece of paper. Print something small on it. Scan it again. Look for any differences using digital imaging tools. This should allow you to potentially find invisible differences.
You can also try to tell while it's printing if it does something to parts of the page that you didn't print to. Print at the bottom of the page only. Do the print heads engage anywhere else? Do the same thing with the middle.
There is an advantage if you are testing printers rather than reviewing a single scan as they describe - you can print the same content on two different printers and compare the output
As a side effect it might actually be repairable instead of disposable like most commercial printers seem to be.
I wonder if it makes sense to target used copiers as a baseline. They would be built to last and not screw people over on consumables, because the 99.9% business copier market is going to be way more TCO-sensitive than home users. I'm imagining some kit where you'd buy a minivan-sized copier, bolt a Rasbperry Pi onto a custom cable harness, and rip off all the scanning and controls stuff.
On the other hand, I'd suspect many of those devices are sold as having network-printer functionality already, so it may be moot.