- on a forum, if the post reads slightly different to each user, and one user “quotes” it, the quote will be of what that user saw, and other users will be able to identify the fingerprint from the quote.
- if the fingerprinting script modifies all posts on the forum, then a poster will be alarmed to see his words change.
There are clever ways around both of these issues (rewriting the quotes on render, and hiding the fingerprinting from the OP). But eventually the system gets pretty complicated, and ultimately you’re visibly presenting different text to different users, so it’s no longer an invisible fingerprint.
Not if the forum intelligently changes the quoted text :)
The hard part is going to be keeping the flow of the text, whilst brute forcing a thesaurus into it!
It's effectively a compression scheme built on-top of synonym replacement using "extra" available information to pack more bits in less words. This means even sentence long quotes in summary form are enough to compromise someone.
And I don't quite get how you can encode that much information in a sentence without it being completely garbled.
Here's 5 bits in that simple sentence. I'm sure others can do better.
http://failheap-challenge.com/showthread.php?16311-Taking-th...
Another is to alter the _frequency_ of certain letters occurring in the text to produce a unique watermark. For example the "number of i's" that occur in the text can be used to produce a unique text per user. This is a very hard attack to detect or do anything about because even _summaries_ of the associated text tend to carry letter and word frequencies forward.
These methods are also impervious to "screenshot" etc. And because the embedded value can simple be a 64bit key to lookup the users/session info with attacks that attempt to impersonate other are impossible.