Re: Can watermarking Unicode text using invisible differences sneak through Emacs, or can Emacs detect it?

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

Explanation to Eli: I understand that these 0-width characters have
legitimate, useful purposes.  It is good that we support them.

The issue I've raised, which was explained in the text I cited, is
that _allegedly_  it is possible to use them maliciously, by inserting
a sequence of them to function as a sort of watermark that users
normally won't even see.

  > You can highlight them like so:

  > (set-face-background 'glyphless-char "red")

  > I've had that configured ever since
  > https://debbugs.gnu.org/cgi/bugreport.cgi?bug=31194#40

  > If you're not expecting zero-width characters in text in general,
  > I think it's a good setting.

I think I will try that, just in case someone sends me some of those.
Thanks.

Should we make this the default?  I think it is likely that most Emacs users
will see only malicious zero-width characters, and not useful ones.

Is there a way we could detect automatically when these zero-width
characters are being used in a legit way for their intended purpose,
and in that case, display them as zero-width for real?

That way, they would work right when used properly, and ring an alarm
(metaphorically) when used in a fishy way.

  > Emacs by default displays ZWJ and ZWNJ characters (and any other
  > zero-width characters) as thin 1-pixel spaces on GUI frames, and as
  > simple spaces on TTY frames.  So Emacs users are likely to see these
  > "hidden" sequences of characters on display.

I wonder if we could do something clever to show when there is a
sequence of multiple different 1-pixel characters?  For instance,
maybe give different colors to different characters, so that a
sequence of several shows as a funny spectrum?

This could alert the user that "someone's messing with you here".

There are many possible variants of the details -- I don't know what
would be best, or what would be easy, but people could try various
methods.


-- 
Dr Richard Stallman (https://stallman.org)
Chief GNUisance of the GNU Project (https://gnu.org)
Founder, Free Software Foundation (https://fsf.org)
Internet Hall-of-Famer (https://internethalloffame.org)