New Obfuscation Method Dissolves Personal Data Records in Layer of Plausible Variants

A Russian information security researcher has proposed a data protection technique that renders stolen personal records unusable even after full compromise. The approach mixes real data such as phone numbers, emails, passports, addresses, INN and SNILS with vast numbers of semantically valid alternatives. Attackers receive nearly complete information including a 361-character message containing PIN codes and word order, yet lack the secret vector space and reconstruction algorithm required to identify the correct record. Without these components, brute-force attempts produce millions of plausible results with no architectural method to verify accuracy. The method is presented as an alternative to traditional encryption when data must remain accessible yet protected against extraction. A public sandbox is available for testing the approach.

HabrTranslated from Russian

Read at source

A novel data protection technique aims to neutralize the impact of complete personal data breaches by embedding real records inside an enormous set of plausible alternatives.

The proposed method addresses a worst-case scenario in which an attacker obtains a file containing fully dissolved personal information, including telephone numbers, email addresses, passport details, residential addresses, INN, and SNILS. In the demonstration, the message provides almost everything an attacker would need: 361 characters total, 317 characters without spaces, 45 words, the PIN code, and the original word order.

What remains hidden is the secret vector space and the assembly algorithm. According to the author, this absence renders all other data useless because exhaustive search becomes astronomically infeasible. Any attempt at reconstruction yields millions of semantically valid variants, yet the attacker has no way to determine which variant corresponds to the original record.

The technique is positioned as a practical defense for situations where traditional encryption is impractical or when data must stay usable by legitimate systems while remaining resistant to extraction. Interested parties can experiment with the approach through a dedicated sandbox environment.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Privacy & Surveillance

Maximizing iPhone Privacy: Essential Settings to Enable, Disable, and Verify Immediately
Top 10 Secure DNS Servers for Privacy, Threat Blocking and Ad Filtering in 2026
WebRTC IP Leaks Explained: Why Disabling the Protocol Harms Anonymity in Anti-Detect Browsers