[cobookman]

Am I the only one who redacts info, prints it out, then scans it back in? Or redacts, then takes a screenshot before sending out?

For some reason I just never trust the PDF tool (or human error on my end) actually redacting the info, even if I were to do a print to PDF.

[kortex]

Nope. That's called rebroadcast. It's also used to try to "launder" photo manipulations, like compositing. I helped work on some algorithms which could pick up artifacts even after rebroadcast.

I would absolutely not trust pdf not to leak metadata. Although now you risk metadata leak from the printer or scanner, which may or may not affect your threat model.

[sbierwagen]

Careful what printer you use to print it out, some of them add patterns of dots that can uniquely identify the print: https://en.wikipedia.org/wiki/Machine_Identification_Code

[KyeRussell]

When a coworker asked me for my recommended method of creating and publicly sharing redacted copies of documents which (in their unredacted forms) contained PII for children, I told them to do this, in no uncertain terms.

[dragonwriter]

> Am I the only one who redacts info, prints it out, then scans it back in?

if you have the source document, redacting from the source (by actually removing and replacing with an appropriate placeholder, not obscuring, the content) and regenerate the static (e.g., PDF) version.

If you are working from print, I think scan and redact by digital replacement (not overlay or otherwise obscure) would be sufficient. Redact->print->scan probably helps somewhat (especially if the scan is low quality) if you are using a bad redaction method to start with, but why do that?

[Markoff]

I do same, except scanning, why not just print it to PDF?

[Moru]

Because some tools might still put a text-layer under the printed so you can select text and copy.