The NYPost has an article on Hunter Biden emails. Critics claim that these don’t look like emails, and that there are errors with the fonts, thus showing they are forgeries. This is false. This is how Apple’s “Mail” app prints emails to a PDF file. The font errors are due to viewing PDF files within a web browser — you don’t see them in a PDF app.
In this blogpost, I prove this.
I’m going to do this by creating forged email. The point isn’t to prove the email wasn’t forged, it could easily have been — the NYPost didn’t do due diligence to prove they weren’t forged. The point is simply that that these inexplicable problems aren’t evidence of forgery. All emails printed by the Mail app to a PDF, then displayed with Scribd, will look the same way.
To start with, we are going to create a simple text file on the computer called “erratarob-conspire.eml”. That’s what email messages are at the core — text files. I use Apple’s “TextEdit” app on my MacBook to create the file.
The structure of an email is simple. It has a block of “metadata” consisting of fields separated by a colon “:” character. This block ends with a blank line, after which we have the contents of the email.
Clicking on the file launches Apple’s “Mail” app. It opens the email and renders it on the screen like this:
Notice how the “Mail” app has reformatted the metadata. In addition to displaying the email, it’s making it simple to click on the names to add them to your address book. That’s why there is a (VP) to the right on the screen — it creates a placeholder icon for every account in your address book. I note this because in my version of Mail, the (VP) doesn’t get printed to the PDF, but it does appear in the PDF on the NYPost site. I assume this is because their Mail app is 3 years older than mine.
One thing I can do with emails is to save them as a PDF document.
This creates a PDF file on the disk that we can view like any other PDF file. Note that yet again, the app has reformatted the metadata, different from both how it displayed it on the screen and how it appears in the original email text.
Sometimes web pages, such as this one, wants to display the PDF within the web page. The Scribd website can be used for this purpose, causing PDFs to appear like below:
Erratarob Conspire by asdfasdf
How this shows up on your screen will change depending on a lot of factors. For most people, though, they’ll see slight font problems, especially in the name “Hunter Biden”. Below is a screenshot of how it appears in my browser. You can clearly see how the ‘n’ and ‘t’ characters crowd each other in the name “Hunter”.
Again, while this is a fake email message, any real email message would show the same problems. It’s a consequence of the process of generating a PDF and using Scribd. You can just click through on Scribd to download the original PDF (either mine or the one on the NYPost site), and then use your favorite PDF viewing app. This gets rid of Scribd’s rendering errors.
Others have claimed that this isn’t how email works, that email clients always show brackets around email message, using the < and > characters. Usually, yes, but not in all cases. Here, Apple’s “Mail” app is clearly doing a lot more work to make things look pretty, not showing them.
There are some slight difference between what my 2020 MacBook produces and what the original NYPost article shows. As we can see from the metadata on their PDF, it was produced by a 2017 MacBook. My reproduction isn’t exact, but it’s pretty darn close that we don’t need to doubt it.
We would just apply Occam’s Razor here. Let’s assume that the emails were forged. Then the easiest way would be to create a text document like I’ve shown above and open it in an email client to print out the message. It took me less than a minute, including carefully typing an unfamiliar Russian name. The hardest way would be to use Photoshop or some other technique to manipulate pixels, causing those font errors. Therefore, if you see font problems, the most likely explanation is simply “something I don’t understand” and not “evidence of the conspiracy”.
The problem with conspiracy theories is that everything not explained is used to “prove” the conspiracy.
We see that happening here. If there are unexplained formatting errors in the information the NYPost published, and the only known theory that explains them is a conspiracy, then they prove the conspiracy.
That’s stupid. Unknown things may simply be unknown, that while you can’t explain them doesn’t mean they are unexplainable. That’s what we see here: people are have convinced themselves they have “proof” because of unexplainable formatting errors, when in fact, such formatting can be explained.
The NYPost story has many problems. It is data taken out of context in an attempt to misinform the reader. We know it’s a garbage story, even if all the emails are authentic. We don’t need to invent conspiracy theories to explain it.
Recent Articles By Author
*** This is a Security Bloggers Network syndicated blog from Errata Security authored by Robert Graham. Read the original post at: https://blog.erratasec.com/2020/10/no-font-errors-mean-nothing-in-that.html