I'm wondering if it's safe to black out sensitive information from a picture just by using Microsoft Paint?
Let's take in this scenario that EXIF data are stripped and there is no thumbnail picture, so that no data can be leaked in such a way.
But I'm interested in whether there is any other attack, that can be used in order to retrieve hidden information from the picture?
As mentioned in the answers to a very similar question, scribbling over part of an image will destroy the original pixels, assuming that your editor doesn't store any layers or undo history in the saved image. (Paint doesn't.) There are some things to watch out for, though:
b and p)If you use a blur rather than a plain opaque rectangle/brush, a determined attacker could try lots of different possibilities in the image to see what text(s) get close to your image when blurred. Some effects can be undone almost perfectly, so make sure the one you use involves a lot of randomness or actual data destruction (e.g. a blocky pixellization). Of course, Paint doesn't have any special effects, so you should be fine.
One possible thing to be wary of is JPEG compression artifacts around the secret data, which could be used to get clues about the shape of the text. It never hurts to overwrite more information than necessary when you're concerned about secrecy. (This attack isn't a problem if the image never went through JPEG compression before your redaction.)
Ditto Ben N, but let me add a couple of points that are too long to fit as comments.
I'd emphasize the distinction between layered and un-layered data formats. Drawing a black box over a section of a GIF, JPG, or PNG image destroys the previous contents. Drawing a black box over a section of a Photoshop, Corel Draw, or Paint Shop Pro native image does not destroy the previous contents if it's on a different layer.
I'd be very cautious about blurring. You'd have to know how the software does the blur. If the blurring does not involve any randomness, if it's a deterministic algorithm, it may be possible to undo the blur with appropriate software. No way would I rely on it without thoroughly understanding the algorithm. Unless there was some very good reason to blur rather than black out, I just wouldn't do it.
Of course any attempt to redact with solid blocks must completely cover the original contents to be safe. You want to draw a black box, not scribble over it with a black pen that might leave gaps.
Some formats may keep an internal history log. Not quite the same thing, but I once had a case where my organization produced documents in PDF, another company edited those documents and then sent then back to us. We found that errors had been introduced in the documents and, to put it bluntly, blamed them. They claimed that the documents must have been like this to begin with because they didn't do it. Apparently they were unaware that PDF has an internal log of all changes, and I was able to identify exactly what text was changed and the exact time and date of every change.
When blacking out sensitive information in Paint the original pixels are destroyed. But using Inkscape to black out part of a vector image does not destroy the pixels, but instead covers them. If someone removes the black cover they can see the pixels. The same applies to things like Foxit Reader (I almost sent a document with sensitive information which had been covered with a black square).
So using MS Paint to black out sensitive information is safe. JPEG artifacts might show some of the text like @BenN says.
Just don't blur it if you don't blur enough and MS Paint doesn't support blur anyway.
As a raster image program that does not use layers nor contain an undo history after saving, overwriting sensitive pixels in Paint irrevocably changes them in the saved image.
More reasoning:
Microsoft Paint is a proven simple piece of software with a long history and great popularity that works natively in simple raster image file formats. Serious flaws in Paint's algorithms would have likely been uncovered by now.
When redacting information in a raster image file it's best to use a simple format such as .bmp, .jpg. Simple formats are much easier to inspect and historically have resisted such forensic attacks as data recovery.
Of course, any security method can only show that there isn't any known vulnerability. But I couldn't find proof of any successful recovery of blacked out or blanked out information in a raster image in the .bmp or .jpg file formats that were edited using Paint.
Blurred or pixelated image sanitization has shown vulnerability to data recovery techniques. But that is outside the scope of the question.
Already a few good answers here, saying Paint is safe. (I have no reason to believe otherwise.)
Just want to add that while blacking out a rectangle that fully covers the area and any surrounding areas (lists that information is part of etc) using a basic well studied image editing program should be fairly safe, just using any image editor might not be safe as shown by http://www.underhanded-c.org/_page_id_17.html
Some comments on previous answers (all good - Stack Exchange is like watching really good crossword puzzle players.) An interesting topic which occasionally might be life-and-death important. (My overactive imagination at work, but battered women at a shelter whose location is critical to keep secret are an example that come to mind).
Points that I hadn't considered that struck me as particularly important:
Redact spaces, and here's why: Always redact more rather than less. If I were trying to guess, I'd assume a short (i.e. one or two word) redaction to be a name or a date (as a first approximation). So redact longer if possible.
Try very hard to avoid redactions (particularly short ones) of the same length. Those would be likely to contain the same information.
All of the answers provided are true with the current version of Paint (or even a Photoshop image flattened and exported as bmp, png or jpg), but any update of Paint may suddenly introduce undo-through-save, or layers, or auto-backup. And Microsoft have actually introduced some new features in Paint in Windows 10.
Making sure that black is black is, as another poster pointed out, very important - an example that occurs immediately is scanned text (most often grayscale), but that's easy enough with Paint. Just make sure you're using the rectangle tool and both color selectors are set to actual black. (Although some artistry with the Paintbrush tool may give false information about ascenders and descenders. Whether this is ethical or legal I have no idea).
As a developer, it strikes me there might be a use for a redaction tool that takes all of this into account, or a search-and-redact macro in Word.
Obviously, redact even subtle contextual clues -- "his" or "her" eliminates 50% of the search pool (roughly). But that's drifting outside the scope of the question.
I'm not sure about the method redaction for legal purposes, but replacing the redacted text with [REDACTED] would leave almost no clues, if you have access to the original text. You could use this technique in Paint, as well, but disguising the length of the original text would involve a lot of cutting-and-pasting.
