6 ms·
Schneier made an interesting point at his talk at DEFCON last year. He suggested people use encryption from the big players, rather than more niche crypto prod
by cschmidt 10y ago
Schneier made an interesting point at his talk at DEFCON last year. He suggested people use encryption from the big players, rather than more niche crypto products. He said he thought the NSA etc. monitor users of those niche software closely, essentially getting lots of metadata about them. He suggested "hiding" in the mass of other people using big player products.
Maybe the NSA wants terrorists to switch, since it would make them stand out from the crowd, creating a much smaller pool of people (terrorists and crypto geeks) to watch.
- saiya-jin 10y agothis sort of hiding sounds a bit like desperate attempt to save a lost battle of credibility of major US IT companies... no, thank you
- Johnny555 10y agoSounds like the best solution is to use the niche encryption software to encrypt your data, then wrap it up in encryption by the big players, so you keep your everyday activity under wraps, but if they can break the big-player encryption, you have another layer of protection.
- chatmasta 10y agoThe best solution is probably to communicate via encrypted stetanography in open channels. For example a Twitter account posting a bunch of cat pics with (encrypted) messages encoded in them. This way your first layer of protection is the steganography (nobody knows the message even exists), and the second layer is the encryption. I've got a side project about 10% complete that's a "stegonographic social overlay network". Fully client side JS steganographic encoding of images that are then uploaded to a choice of social media sites, and then subscribed to like RSS feeds. I think it's a cool concept.
- deelowe 10y agoMaybe, but how hard is it to derive suspension of stenography in an image for some useful level of confidence (e.g 20%, 50%, 75%)? Not crack it, but know that there's perhaps something up? Surely, just knowing which accounts are posting "suspicious" communications is valuable enough in and of itself.
- poizan42 10y agoEvery picture contains some amount of noise. It should at least in theory be equivalent to the Halting problem to decide whether this noise was generated by an algorithm or truly random. But there's a lot of practical issues here. If you just add noise then it may raise suspicion merely by there being more noise than expected. So you may need to "move the existing noise around" or remove the existing noise which gets more problematic to do without leaving artifacts. And of course most of the noise may actually be following some patterns that means that the added/substituted noise must also correctly follow as not not raise suspicion.
- deelowe 10y agoExactly. I don't know enough about the topic personally, but I'm genuinely curious if stenography is detectable enough to provide a viable list of targets.
- Natanael_L 10y agoCouldn't you in theory solve it by using high quality originals and manipulate the compression algorithm to introduce controlled noise that then decodes to your message? That way you can make the noise look more natural than with approaches like modifying existing compressed files.
- smcgregor 10y agoThis [0] research paper sounds relevant to your "stegonographic social overlay network." [0] F. Beato, I. Ion, S. Capkun, M. Langheinrich, and B. P. (2013). For Some Eyes Only: Protecting Online Information Sharing. In ACM Conference on Data and Application Security and Privacy.
- nxzero 10y agoHard to believe Schneier would say something like that, are you sure that's what he said?
- cschmidt 10y agoI'm going by memory, but I'm pretty sure he made that point (that I'm paraphrasing, of course). Anyone else here his talk that would care to comment?
- cschmidt 10y agoThe talk is here: http://www.securitytube.net/video/14656?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SecurityTube+(SecurityTube.Net) http://www.securitytube.net/video/14656?utm_source=feedburne... He makes the point I was referring to at 12:53. The question starts about 11:45.