April 7, 2026
Secrets between the spaces
Show HN: Unicode Steganography
Hidden messages in plain text — and the comments go feral
TLDR: A demo shows how invisible characters can hide messages in normal text, raising alarms about AI models quietly passing notes. Commenters split between “cool but fragile” and “LLMs can already do covert signals,” trading Enigma jokes, GitHub links, and cryptic hints as they argue whether scanners or models win next.
An interactive demo shows how “invisible” characters and look‑alike letters can hide secret messages in normal text—spooking the crowd and igniting a comments brawl. The demo warns it’s fragile: most apps scrub these ghost characters, and simple scanners can catch them. But the community? Not buying the simplicity. One camp screams “AI whisper network,” with bo1024 claiming some folks already use language models to hide signals in their word choices, decodable by the same model. Another camp shrugs: if Slack and X erase the trick, how scary can it be?
Then the plot thickens. A cryptic flex drops—“variation selectors, low bytes”—and everyone clutches pearls. Meanwhile, old‑schoolers stroll in with receipts: sixhobbits links an earlier project hiding info in Telegram bot messages unisteg, basically saying, “kids, we’ve done this.” One commenter asks if this is just WWII Enigma with a modern coat of paint, setting off jokes about grandpa’s cipher box meeting GenAI. The safety angle keeps the heat on: if today’s scanners can spot these tricks, could a clever model invent new ones that slip past both humans and tools? That’s the real cliffhanger. Between memes about “haunted fonts” and “AI passing notes in class,” the vibe is half cool hack, half future‑of‑trust panic, and 100% popcorn‑worthy.
Key Points
- •The demo shows how invisible Unicode characters and lookalike symbols can hide messages in ordinary text.
- •Real-world pipelines often strip zero-width characters; platforms like Slack and Twitter/X commonly remove them, erasing hidden data.
- •Covert channels only work if systems preserve zero-width characters, which most do not.
- •Technique trade-offs exist: some survive naïve copy-paste but are vulnerable to NFC/NFKC normalization or dropped variation selectors.
- •Dedicated scanners can detect these methods: Unicode category checks (zero-width), homoglyph checks (Cyrillic substitutions), and code-point inspection (variation selectors).