27 votes

FBI Denver warns of online file converter scam

12 comments

  1. [11]
    chocobean
    Link
    This seems like one of those places where a single trusted source would reduce much harm. I'm a big government person. I can see this working so well with so little effort: make an official free...

    “The best way to thwart these fraudsters is to educate people so they don’t fall victim to these fraudsters in the first place,”

    This seems like one of those places where a single trusted source would reduce much harm. I'm a big government person. I can see this working so well with so little effort: make an official free document/file converter, and then proprietary companies would have to provide a reliable way of converting their locked documents into something at least readable. Say, for MS doc, plain text without formatting , and additionally a flat image without ability to edit.

    The alternative is to require businesses to do it built in, but doesn't that sound like even more government involvement and enforcement?

    19 votes
    1. [7]
      DeaconBlue
      Link Parent
      There isn't really a white hat way to do a lot of file conversions. An example: Converting a high resolution video to a low resolution video is not a technically difficult thing. Well, no more...

      There isn't really a white hat way to do a lot of file conversions.

      An example: Converting a high resolution video to a low resolution video is not a technically difficult thing. Well, no more technically difficult than anything else involving video. However, converting a video could count as piracy because you are changing the format of the thing (and legislation around this subject is all over the board and a lot of it has never been tested). Nobody is going to play that game.

      Additionally, sometimes changing file formats can be computationally expensive. Again with the video example, that is a winter sport for me because changing video formats uses a ton of computing power. Allowing people to convert arbitrary files to arbitrary files could get very expensive.

      12 votes
      1. [3]
        kacey
        Link Parent
        From the examples provided in the article, and what you mentioned here, it seems like everything could be done with some VLC/ffmpeg/imagemagick pipelines. Cross compiling those w/emscripten and...

        From the examples provided in the article, and what you mentioned here, it seems like everything could be done with some VLC/ffmpeg/imagemagick pipelines. Cross compiling those w/emscripten and hooking then up to the relevant browser APIs (eg VideoEncoder) would seemingly get you 80% of the way to a local conversion setup, which drops the cost of operating such a service to basically zero, assuming you let Cloudflare host the wasm binaries.

        Seems eminently doable, imo, just that there’s no motive to do it.

        6 votes
        1. [2]
          DeaconBlue
          Link Parent
          For images and videos yeah, the issue is legal rather than technical. But something like converting a Word document to TXT is very lossy because formatting can matter to the use case and there...

          For images and videos yeah, the issue is legal rather than technical.

          But something like converting a Word document to TXT is very lossy because formatting can matter to the use case and there needs to be some kind of decision on how much loss is acceptable.

          7 votes
          1. kacey
            Link Parent
            I could hear the argument that a hypothetical website operator wouldn’t want to be hit with threats of lawsuits, but afaik distributing tools that facilitate even piracy hasn’t been problematic...

            For images and videos yeah, the issue is legal rather than technical.

            I could hear the argument that a hypothetical website operator wouldn’t want to be hit with threats of lawsuits, but afaik distributing tools that facilitate even piracy hasn’t been problematic legally. Distribution of copyrighted material is frequently what gets people — in the US courts, at least — so operating entirely in the user’s browser should put you on the right side of any lawsuit.

            That said, it still costs money to defend yourself, even if the lawsuit is a slam dunk.

            But something like converting a Word document to TXT is very lossy because formatting can matter to the use case and there needs to be some kind of decision on how much loss is acceptable.

            Agreed, but the problem is clearly solvable, since all these awful websites already exist. I’d imagine they’re doing the dumbest possible thing in each case, but most users are clearly fine with getting what they paid for.

            My read on this thread is that the goal would be to do as well as the existing scam websites, but without scamming people. I don’t feel convinced that that’s either technically or legally difficult, hence my response to your response. Doing it well is another story, but that feels parallel to the thrust of this discussion.

            5 votes
      2. [3]
        chocobean
        Link Parent
        Interesting, I can understand video format being fraught with peril, and I would also assume changing music file formats, and ebooks also being problematic because of piracy.

        Interesting, I can understand video format being fraught with peril, and I would also assume changing music file formats, and ebooks also being problematic because of piracy.

        2 votes
        1. [2]
          DeaconBlue
          Link Parent
          Lots of formats end up with weird licensing issues, or with weird edge cases that need user decision on handling. It sounds like a lot more simple problem to solve than it actually is. Programs...

          Lots of formats end up with weird licensing issues, or with weird edge cases that need user decision on handling. It sounds like a lot more simple problem to solve than it actually is.

          Programs might not handle Unicode properly, for example. Do you strip it out when you convert? Do you display garbage? Maybe the program has custom glyphs and there is no Unicode equivalent going the other direction, do you accept the lossy translation?

          It is a very "here be dragons" part of software development.

          6 votes
          1. okiyama
            Link Parent
            In my experience, a large portion of software development is transforming data. It makes sense the most deeply defined data structures are gonna be either a huge huge huge pain to transform, or...

            In my experience, a large portion of software development is transforming data. It makes sense the most deeply defined data structures are gonna be either a huge huge huge pain to transform, or outright impossible.

            2 votes
    2. [3]
      hungariantoast
      (edited )
      Link Parent
      I think this is a very practical and good idea. Democracies need to develop better relationships with technology. We need legislators and regulators who are more experienced with, and have a...

      I think this is a very practical and good idea. Democracies need to develop better relationships with technology. We need legislators and regulators who are more experienced with, and have a better understanding of, information technology.

      So I think something like an open-source website that provides a variety of file conversion tools should be an easy, low-hanging-fruit problem. It's the sort of "micro project" I'd like to see the European Union tackle, for example. People talk about Europe's need for "tech independence" all the time. Providing tools to EU citizens, that allow them to convert proprietary American file formats to something more open, could be one stepping-stone solution to that grand problem.

      It's not even a technically difficult problem. File conversion websites already exist all over the place, with varying degrees of privacy, security, and openness. It's demonstrated that it's technically possible to convert almost any document file type to almost any other. I think the real challenge would of course come from capital, its endless resistance to being de-trenched and de-*opolized, and its co-option of laws, including copyright laws, as means to preserve its moat.

      The nice and terrible thing about democratic governments however, is that they excel at drawing out exceptions to rules, for all kinds of things. They do it all the time for capital, and every now and then they do it against capital's wishes as well.

      All that to say: this is a great idea. We need the representatives, workers, and organizations of democracies to be more intimate and capable of understanding technology, and there's no better way to accomplish that than by building. All of the problems such an idea may face along the way, whether they be technical or legal, aren't reasons to not build the thing. Those problems are opportunities waiting to be solved, and by solving them, we can "optimize" our societies just a little bit more towards providing for our needs.

      9 votes
      1. [2]
        balooga
        Link Parent
        I worry that the temptation to snoop would be too great for governments to resist. It would start with something innocuous like checking to make sure the file doesn’t contain CSAM. Then maybe get...

        I worry that the temptation to snoop would be too great for governments to resist. It would start with something innocuous like checking to make sure the file doesn’t contain CSAM. Then maybe get expanded to check for copyright violations, or other illegal content. Then the national security apparatus gets involved and starts logging “metadata” of every conversion. Maybe they run their own malware infection operation against certain IP ranges. Who knows.

        Ultimately, like any online service, it boils down to trust. Should you trust random sketchy yourfreefileconvertertool.info sites? Nope. Should you trust convert.gov? Eh… maybe not, either.

        What we need is trusted, independently audited open-source tools we can run locally on our own hardware. No third-party intermediary required.

        7 votes
        1. ShroudedScribe
          Link Parent
          Agreed. Unfortunately this doesn't solve all problem scenarios though. Many (hopefully most) enterprises do not allow employees to install software on their computers, or even run untrusted...

          What we need is trusted, independently audited open-source tools we can run locally on our own hardware.

          Agreed. Unfortunately this doesn't solve all problem scenarios though. Many (hopefully most) enterprises do not allow employees to install software on their computers, or even run untrusted executables. There's also often a lot of hurdles to get Acrobat Pro (or whatever they call it these days) which is needed for many PDF tasks.

          If someone's boss says they need a PDF edited, and all this employee has is MS Word, they're going to Google "pdf to word" and use one of these sites. At least a government-backed site has some level of trust behind it, even with the caveats you mentioned.

          4 votes
  2. pete_the_paper_boat
    Link
    I wonder how many people put confidential documents in those without second thought

    I wonder how many people put confidential documents in those without second thought

    6 votes