2

Often while sharing information on social media, some people may hide PII and yet still allow some aspect of a barcode to leak.

Question

Is there any research that describes how a damaged/obscured barcode can

  1. Describe with certainty some information (Zipcode, but not address)
  2. Reduce the amount of guessing one has to do to recover that information... where there is a fact table that is processed. Any fact that ends in bits XYZ is a candidate for exposing PII

closed as unclear what you're asking by gowenfawr, Steffen Ullrich, Serge Ballesta, Xander, ThoriumBR Jan 19 '17 at 21:12

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 5
    What sort of barcode? On what? – Matthew Jan 19 '17 at 16:15
  • 1
    VTC because the sheer variety of bar codes that may or may not be present or not present with info that may or may not be shared on social or antisocial media is far too wide to answer this question with anything other than "It depends". – gowenfawr Jan 19 '17 at 16:47
  • Presumably you mean a postal barcode, but you should be clear about it. You should also say where you're thinking of (or "worst case") -- in the US POSTNET would expose the zipcode, in the UK RM4SCC would expose the postcode, which is much more granular (usually the street, often part of the street, sometimes the building) – Chris H Jan 19 '17 at 16:55
  • I've seen similar questions raised about barcodes on airline tickets, for loyalty cards, for parcel delivery, for some kinds of identity document, etc... – Matthew Jan 19 '17 at 17:10
  • @drewbenn fair enough, I only skimmed it as it was only for a comment asking for info - my postal assumption may turn out to be wrong. – Chris H Jan 19 '17 at 17:25
4

To directly answer your question, you can see some research on damaged QR codes here: http://datagenetics.com/blog/november12013/

A barcode is nothing more than a specialized font designed so that a computer can read reliably. It's much easier for a computer to recognize and read a pattern of stripes than it is for it to read Courier or Arial. And just like the Latin alphabet symbols you're looking at right now, the symbols have to be readable to the machine. Just as we all agree that the letter 'O' is represented to humans by an oval shape, barcodes follow standards that describe the meanings of the stripes and dots.

However, the text that is printed by the barcode is not nearly as standardized. Some barcodes, like the familiar UPC and EAN barcodes, are strictly numbers that identify a product, and these do follow a standard. But others, like QR-codes, allow free-form text. A valid QR-code may contain a URL with a web link, or a vCard with contact information, or just some random words like "Have a nice day."

So there are as many different kinds of barcodes as there are kinds of text to input. If you want to prevent online theft, treat pictures of barcodes the same way you would treat a picture of your credit card. Do not include photos of personal documents showing these numbers or barcodes. This includes event tickets, gift cards, driver's licenses, and airplane tickets. Otherwise, an online thief may make a copy and steal the value from you.

To more specifically answer your question using this information, imagine a linear barcode with left half obscured. This is the equivalent of obscuring the first half of a sentence or word printed on the page. The right half remains legible, although it may not contain enough information to fully convey the message.

Now picture a 2D barcode, such as a QR-code. Many 2D symbologies are designed to include redundancy permitting accurate reading of the barcode, even when parts of the barcode are obscured or damaged. This is needed because damage to barcodes is very common in normal handling. So when a QR-code is generated, you can specify a level from 1-4 of redundancy you need the code to embed. They use a Reed-Solomon algorithm to add more error recovery symbols. More redundancy allows for a greater portion of the barcode to be damaged while still maintaining readability.

  • minor aside: actual barcodes are more than fonts, they use math and extra "chars" not found in the source. – dandavis Jan 19 '17 at 19:10
  • @dandavis, you are absolutely correct; there are fiduciary marks, timing marks, checksums, significant white space, and other technical details that are way more than just characters, but they're irrelevant to the intent of the question and I thought that describing them would just make my answer less clear. (But for the record, I have created an actual 3 of 9 font, so I know some symbologies are literally that simple.) – John Deters Jan 19 '17 at 20:08
2

This question is broad, and can only be answered rigorously if both the encoding and the application of the barcode is known. Nonetheless, here are some examples of barcodes leaking information:

Receipt from a large storechain: this will often contain the store number in plaintext. It can be said for certain that person has visited that location and the assumption can be made that that is the closest building to their residence.

Medical bracelets would be very sensitive, but rare on photos. Same goes for air luggage tags.

There's a research paper out there on reconstructing barcodes from flawed imaging. In this case LADAR. What exactly do you mean by damaged? I assume the tag is physically damaged, but to what extent?

If you want useful information, reducing search space in a bit of data like that requires that you know the notation of the data. In other words, you'd have to identify what part of the code means what. In the case of the store receipt you'd get a similarly encoded sample and look for the store number in plaintext elsewhere on the receipt.

Not the answer you're looking for? Browse other questions tagged or ask your own question.