Why our covers can't be undone.
We attacked our own app and read back what our blur was hiding. Then we rebuilt every cover, and made the same attack part of every build. This is the whole story, with the numbers.
01What a blur hides, and what it keeps
A blur averages the pixels it covers. That hides text from a person and from text recognition. It does not remove the information: every character still nudges the averaged pixels in its own way. Pixelation works the same way, which security researchers showed in 2022 by reading pixelated text back.
So the question is not “can you read it?” but “can a program that knows how the blur works find the text that produces exactly this smear?”
02We attacked our own app
The attacker has AnonyMax, knows the font, and can see where the cover is. The program types a guess, covers it the same way, and compares the two pictures. It changes one character at a time and keeps whatever makes the pictures more alike.
| Secret | Look | Read back in full |
|---|---|---|
| 16-digit card number in a screenshot | Blur, default | 2 of 2 |
| Same | Blur, maximum | 2 of 3 |
| Same | Pixelate, default | 5 of 5 |
| Same, re-saved as JPEG at 80 % | Blur, default | 1 of 3 |
| Licence plate, head-on, known font | Blur, default | 3 of 3 |
| Same | Pixelate, default | 3 of 3 |
Each card number took about a minute. Our own self-check said “nothing readable remains” every time. Blind guessing gets about 1.6 of 16 digits right.
To be fair to blur: this is the attacker's best case. Crisp screen text, a known font, the same tool, a lossless file. That is exactly what a screenshot is. A real plate photographed at an angle, with dirt and noise, is much harder, and we know of no documented case of a blurred plate being read back in the wild. But a privacy tool should not depend on the attacker having a bad day.
03What we changed
The old blur and pixelate are gone, from every edition. Every cover AnonyMax makes now follows one rule: it never uses the pixels it hides.
- Plain (Free): a solid, designed cover. A fixed colour, nothing else.
- Natural, mosaic and colour-matched (Pro): built only from the pixels around the secret, plus fresh randomness from the system's secure random source. No fixed seed, no repeating pattern.
- The secret is drawn generously, with a margin, and every one of its pixels is fully covered. A half-covered edge pixel counts as a leak.
- The strength slider only changes the look. Every strength is equally safe.
The test for this is exact: two different secrets, the same random numbers, must give the same pixels. Measured on a card number and a plate, in all four looks: 0 bytes differ. The old blur fails the same test, which shows the test can catch a leak.
04The proof
The same attack, run against every cover AnonyMax ships. Three secrets per look, up to about 8,000 guesses each.
| Look | Card number | Licence plate |
|---|---|---|
| Plain | 0 of 3 · 3 of 48 digits | 0 of 3 · 1 of 21 characters |
| Natural | 0 of 3 · 6 of 48 digits | 0 of 3 · 4 of 21 characters |
| Mosaic | 0 of 3 · 7 of 48 digits | 0 of 3 · 0 of 21 characters |
| Colour match | 0 of 3 · 7 of 48 digits | 0 of 3 · 4 of 21 characters |
Blind guessing gets about 5 of 48 digits and 3 of 21 characters. Every cover is at chance.
These checks are part of building the app. If a change ever lets a secret leak again, the build stops and the app is not made.
05Also fixed along the way
- Cut-off readings. Large images are read in tiles. A tile could cut a line in half, and the shorter reading won, so the last digit of a phone number stayed visible in one of our own samples. Overlapping readings are now merged into one box that covers all of them.
- Hidden data. A saved copy used to keep a photographer's name, address, captions and the names of people tagged. Now a copy starts from nothing and keeps only what a picture needs to display: orientation, colour profile, size and resolution.
- The self-check. It used to look only inside each cover. Now it scans the whole finished picture again with the full detector, and says exactly what it checked.
06What a cover can't hide
- The size and shape of a covered area still show. A long cover means a long number. That is true of any cover, including a black marker.
- A covered face hides the face, not the person. Hair, clothes and the place can still give someone away.
- AnonyMax finds what it can see. Look at the result before you share. It always shows you everything it found, and lets you add your own covers.
07It's not only the GPS
Most big social apps already remove a photo's location from what other people see. Files sent as files usually keep it: email attachments, documents in messengers, cloud links. AnonyMax removes it either way.
But almost every documented case of real harm came from what was visible in a picture: a booking code on a boarding pass, a barcode on a ticket, a code in the background of a press photo. That is why AnonyMax looks at the picture first.
08Check it yourself
We are preparing to publish the engine and these tests as open source, under the Apache 2.0 licence, so anyone can run the attack. We will link the public repository here once it is published.