I've doxxed my Reddit username on my Apple phone doing that exact thing. The black marker is not opaque, even after a few stripes over the username. You have to do it many more times.
Easier to select an area and delete it from the layer entirely so that a transparent hole is left. Then make sure you cleanup EXIF and other metadata or you may have the original image still in a thumbnail field at reduced fidelity.
I think there is a need for a dedicated image privacy offline program. On a technical level its very easy to preserve privacy, its just the tools people are using were built for other purposes (Non destructive editing is highly desirable in normal cases).
All the program has to do is scrub all exif data, have a censor box/brush that is 100% black and rencode the image so there is no remaining unneeded data.
I didn’t specify a program to use, but I did not know this. A step in my personal workflow I neglected to state is to flatten all layers but I’m not sure what the best way is, so I’ll just say I am open to ideas for better ways.
There should be a test suite for image editing applications which will validate the different ways of editing a file to see which ones work as expected and which do not. I’m thinking something similar to web standards test for browsers. Does something like this already exist?
Is PPM a safe round-trip format to remove all metadata and transparency? I'd like to recommend it to a friend and as far as I know it really only contains RGB as text and has no extensions for exif or similar. But after so many gotchas, as listed here in the thread, I'm somewhat paranoid...
ASCII PPM supports comments, so it is possible that EXIF or other identifying information would get written into the comments by some tool.
I have only ever observed PPM comments right at the start of the file, so you could open it in a text editor and remove the comments from the start. Maybe check the very end of the file as well.