Watch out: your emails may reveal text hidden in Microsoft Word

Watch out: your emails may reveal text hidden in Microsoft Word

Summary: If you paste text from Microsoft Word into an email, you may not see what the recipient will see, and this includes hidden text. Microsoft ought to fix this in Outlook.com. Until it does, the solution is 'Inspect Document', which also lets you remove hidden personal information.

SHARE:
TOPICS: Software
20

If you must hide text in Microsoft Word, watch out: both Gmail and Outlook.com will show Hidden Text in plain view, and with Outlook.com, you won't even know until it's too late.

I learned this the hard way, even though I never use Word's hidden text feature. Someone claimed that one of my articles hadn't arrived, but I knew this was wrong, because I always send a bcc: (blind copy) to one of my own email addresses. However, when I went to Gmail to confirm it, I was disconcerted to see several spurious bits of text in the opening.

These extra lines weren't visible in my original Word.rtf (Rich Text File) document. They weren't visible in the original email, sent from my Outlook.com address. So where had they come from?

Hidden_text-1a
Setting Hidden Text in Word

After some head scratching, I figured out that the spurious lines had been marked as hidden text in the original document. This is a little-used feature of Microsoft Word. To hide something, you highlight it, go to the Home tab, and select Font to get the properties sheet. The central part of the sheet offers check-boxes for a number of effects such as Strikethrough and Subscript. The last one is Hidden Text.

I'd never actually used Hidden Text, but that hadn't stopped hidden texts from appearing in my document. That's an unsolved mystery. Either way, the first point is: watch out for Hidden Text. The second point is that Outlook.com and Gmail behave differently, and I think Outlook.com's behaviour is illogical at best.

Outlook.com hides Hidden Text if you copy-and-paste from Word into a Rich text email. Unfortunately, it also hides Hidden Text if you paste into a Plain text email, even though it's clearly visible when you look at the same email in the Sent folder. That's not logical. Outlook.com should show Hidden Text when you paste it into a plain text email, so that you can see exactly what you are sending.

Gmail shows Hidden Text if you paste it into a plain text email, and does not show Hidden Text if you paste it into a rich text email. That is logical but not very helpful, because both Outlook.com and Gmail show Hidden Text to the person who receives the email, whether it was marked as Hidden Text or not. That's bad.

Anything that's hidden from the sender should also be hidden from the recipient.

In my view, both Gmail and Outlook.com should show Hidden Text in both rich-text and plain-text emails, and if they don't do that, they should strip it out.

Fortunately, there is a simple solution, and it's also one that's important for removing other possibly-sensitive data.

Inspect Document screen grab
Inspect Document will find hidden text and other information you may not know is there...

Clicking the Orb (aka Office Button) in Microsoft Word 2007 or later brings up a familiar menu for opening, saving or printing documents. Further down the list is another item: Prepare. This lets you encrypt or protect a document, among other things. It also lets you inspect it. Inspect Document looks for comments and revisions, personal metadata (author, time taken etc), watermarks and … Hidden Text.

So, I'm adding a new item to my production routine: Inspect Document before sending it.

This is a particularly good idea if you're sending a Word document to the sort of person who might look for hidden comments and other information, eg me.

Some people may be curious about other text effects, such as Strikethrough. The good news is that if you send Strikethrough as rich text, it arrives as Strikethrough. If you send it as plain text, it doesn't. The bad news is that, as with Hidden Text, Outlook.com shows Strikethrough when you're sending plain text, but doesn't actually send it.

Topic: Software

Jack Schofield

About Jack Schofield

Jack Schofield spent the 1970s editing photography magazines before becoming editor of an early UK computer magazine, Practical Computing. In 1983, he started writing a weekly computer column for the Guardian, and joined the staff to launch the newspaper's weekly computer supplement in 1985. This section launched the Guardian’s first website and, in 2001, its first real blog. When the printed section was dropped after 25 years and a couple of reincarnations, he felt it was a time for a change....

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

20 comments
Log in or register to join the discussion
  • This will be very important information

    For people who use Office 2007, hide text, and save it in Rich Text Format.
    WebSiteManager
    • True...

      ... Probably more of a business issue than peronal.
      MarknWill
      • It's simply foolish to use MS Products

        Time and time this is proven, yet there are those that all do.

        Want to be smart? avoid MS Products when possible and don't pay the MS tax, if does not matter if it's Android or something else, just avoid it and you have a better chance of living a care free life.
        Uralbas
        • overreact much?

          this was an interesting article on a pretty obscure problem. I actually tried to duplicate it, but couldn't. But even if it was there, your comment reflects an ignorant bias rather than a reasoned opinion. If you're going to share an opinion, why not enlighten us poor MS suckers with some reason for your opinion. I use word, excel, publisher, powerpoint and I have a wonderfully care free life and what's more, those products actually help me!
          larsonjs
  • Hidden Text?

    I agree this should be fixed, but I don't think it is widespread problem with pasting from Word. I can't think of a user case why you would even want to hide text in a Word doc? Certainly in Excel, I could see hiding text if you want to use it in a formula, but not have anyone readily see it.
    toph36
    • Re: I can't think of a [reason] to hide text in a Word doc

      At least, I think that's what you mean. If so, I can think of many good reasons for hiding text, including the following situations.

      If I were writing an article or report for a non-specialist audience, I might want to assert something, without including footnotes or references to back it up; But I'd still want those citations stored somewhere. One convenient place to store this information might be as hidden text – provided the hidden text remained hidden.

      Similarly, if I were writing for a specialist audience, and was up against a length limit, I might make a one line claim, which required half a page of detailed argument to substantiate it, and leave it to the reader to fill in the gaps. In such a case, I'd like to record the fact that I had thought the argument through carefully, without including actually including the (hidden) argument.

      (Articles in maths journals are notorious for this sort of thing. The phrase "from this, it clearly follows that.." may indicate that the author has omitted several pages of difficult mathematical arguments, which might take the reader several days to reproduce.)

      Finally, if I were writing an article that said "the average was x%" – an average that I'd had to calculate myself – then I could hide the original data metadata, and just include the quoted average.
      Slurry
  • It is a good idea to clean Word's copy/paste first for a lot of reasons

    There's also the wild HTML pollution you get from copying from Word... a lot of fairly un-standard tags. Most email clients can read them, but it is really rough looking.

    I usually copy and paste into Notepad first as a transitory step, then into Outlook or whatever.
    Mac_PC_FenceSitter
    • Yes, past to Gedit etc., first will

      clean any unwanted html tags, hidden text, etc.. Been in the habit for quite a few years now.
      WhoRUKiddin
    • I use notepad before pasting anything from Word

      I never directly copy anything directly from Word first. If it is image it goes into Paint.NET, if it is text, it goes into Notepad and if it is hyperlink or hypermedia, it goes into Expression and then goes into destination.
      Ram U
  • Yet another security issue with word...

    being another covert communication channel...
    jessepollard
    • Did you read the article?

      ForeverCookie
      • yes.

        Did you?

        And do you remember all the problems with the history recorded in Office files?
        jessepollard
    • Oh, yes - Yet another "post" by jesse

      doing the bidding of others received over another covert communication channel...
      William.Farrel
      • So you agree with me.

        Though I know of no others...

        I do know of a lot of security problems with Word...
        jessepollard
  • Paste without formatting

    The problem isn't with Outlook.com or Gmail, the issue is with Word and the ridiculous way it renders formatting.

    Paste without formatting might be a good option.

    Ctrl-Shift-V on Windows or Cmd-Shift-V on Mac
    @...
  • Thoughts

    "If you must hide text in Microsoft Word"

    . . . encrypt it, don't hide it. Nobody should EVER rely on this feature for security. That's not really its purpose. For the most part, I think it's there to help display the document differently under certain circumstances. It's not there to hide PII from prying eyes, because it doesn't really encrypt or remove the text.

    "I'd never actually used Hidden Text, but that hadn't stopped hidden texts from appearing in my document. That's an unsolved mystery."

    Is there a common theme in the hidden text? Stuff that you cut and paste elsewhere in the document while editing it, perhaps?

    Sounds like Word may be using it for its own internal purposes, in which case perhaps the feature shouldn't be able to be accessed via a formatting option.

    It also really sounds as if Outlook.com's behavior is broken: *ALL* formatting should be stripped when sending stuff as plain text. That's how plain text is defined in email: Without formatting.

    If Outlook.com is formatting text when you switch it to plain text, yeah it's broken.
    CobraA1
  • I tested this...

    I opened Word Home & Student 2010, typed "This is hidden text" and then hid the word "hidden".

    I copied this and pasted it into a Gmail message. "This is text" was displayed. I saved it as a draft, reopened the message and "This is hidden text" was displayed.

    I then went back to the Word document and pasted the clipboard on a new line using the Keep Text Only option. "This is text" was displayed.

    I then copied this line and pasted it into the Gmail draft. "This is text" was displayed. I saved it as a draft, reopened the message and "This is text" was displayed.

    Thunderbird displayed "This is text" in the original message and the re-opened draft.

    I use Outlook on an Exchange server at work so I'll see how that handles it.
    sf362
  • disable rich text emails

    One of my pet peeves is rich text emails.
    If you disable rich text in your email client or outlook then you will see exactly what you are sending.
    Email protocol was not meant to have rich text until MS started doing it in outlook express in the 90's.
    If you want to send rich rext, send it as an attachment.
    If only everybody did this.....
    warboat
  • Word is insidious and flat out menacing

    Words crazy and often inscrutable way of hiding text or worse revealing hidden or even deleted text not only is a source of constant fear but also contributes to a very odd working style. Sending Word documents is decidedly perilous and taking measures to avoid an embarrassing incident takes a whole lot of knowledge and time.

    Best way is to convert Word documents into PDFs and proofread them.
    EnticingHavoc
  • sending word files as attachments is my standard

    When I have formatted text, I will send the word files as an attachment. If it is sensitive, I encrypt it. I'm not exactly a spy, so honestly, I'm not sure what people would gain by gaining entrance to my messages, but I've never had a problem (I too send bcc to myself) with files not matching what I sent.
    larsonjs