Open LasseMoench opened 4 years ago
I don't know if it's related to the obfuscated texts, i don't think so.
If you disable completely all JS, it's still obfuscated but without any paywall hints.
You get always new obfuscated parts by refreshing the page.
I guess the "clear" texts get randomly messed up to "encrypted" parts with no chance of rebuilding the "clear" texts after that because it's just some sort of random shifting.
But why would they need to send the obfuscated texts at all, if they don't get decrypted locally? Because they use it so that the blurred Text has the same shape as the cleartext?
I don't know ;-)
it's "lorem ipsum" to show something behind the blur layer. at worst they simply split the whole text at word boundaries and shuffle every word's letters randomly. that's undecryptable.
the surest way of "decrypting" this should be deshuffling every word using a dictionary or digraph/trigraph frequencies of the german language. it's probably a good idea to add the plain text parts of an article to whatever dictionary (for the purposes of decoding that one article).
related things: scrabble game, unscramble, jumble, Jumble algorithm,
example from an aspell dictionary applied to a random article
it's difficult to pick a single, or the right, word, especially thanks to case: "Genau" could be "Genua" and vice versa. casefolding isn't trivial and I don't care to find the right data set for that.
There seems to still be a way to publish premium content on social media, this article was posted on facebook (by AZ/AN) and is readable: https://www.aachener-nachrichten.de/lokales/aachen/fahrraddemo-durfte-doch-nicht-auf-die-autobahn_aid-54346883?hash=959859af10379340ca16696c4a9986e8c9f1b858a9bab1c7a9137e4992f39b8d&utm_source=facebook
However, some sort of hash (sha256?) is passed along, so if done properly this hash contains a secret that is unique to the article, that would probably still be impossible to crack.
As mentioned in your updated readme, the encryption changed. At the bottom of the page there is some obfuscated Javascript. This is what it looks like when it is un-obfuscated: