5 ms·

This is why more people need to learn about and use steganography: http://en.wikipedia.org/wiki/Steganography http://en.wikipedia.org/wiki/Steganography Prope

by gnosis 16y ago

This is why more people need to learn about and use steganography: http://en.wikipedia.org/wiki/Steganography http://en.wikipedia.org/wiki/Steganography Properly used, good steganographic software will hide your use of encryption. Ideally, your communication stream will seem perfectly innocuous to all observers. Of course, in real life nothing is perfect. So there's always a chance your use of encryption will be detected. But using steganography properly should still reduce that chance to well below that of obviously encrypted systems like TOR, Freenet, etc. Also, just as importantly, the more people use steganography, the greater the cost of widespread monitoring will become. As pointed out in other replies in this thread, when you use regular encryption or systems like TOR, you're effectively raising a big red flag for anyone who cares to monitor your communication. So detection is really easy. But if you use steganography, the snoopers will have to work much harder to even stand a chance of detecting that there's anything unusual about your communication. Multiply this by thousands or millions of people using steganography (especially if it's embedded in huge data transfers, like video streams) and the resource drain for effective, widespread monitoring could become unsustainable. Right now the snoopers can go after the low-hanging fruit of obviously encrypted communications, and then maybe use rubber hose cryptanalysis to decrypt it, or simply block it. Steganography has the potential change the game drastically. Here's some steganographic software for you: http://freshmeat.net/search/?q=steganography&section=projects http://freshmeat.net/search/?q=steganography&section=pro... http://www.jjtc.com/Steganography/tools.html http://www.jjtc.com/Steganography/tools.html http://www.cotse.com/tools/stega.htm http://www.cotse.com/tools/stega.htm

poet 16y ago
Stealth circumvention tools are even harder to write than just plain old circumvention tools, which we already are struggling with. It's a disaster waiting to happen. See Haystack and this comment by Thomas: http://news.ycombinator.com/item?id=1690871 http://news.ycombinator.com/item?id=1690871.
- gnosis 16y ago
  From Thomas' post: "Get circumvention at all wrong and you achieve the opposite of what the tool is intended for: you put a big red flag on people breaking their local laws. ... Don't build circumvention tools." That attitude is so wrongheaded I hardly know where to begin. First of all, anyone who uses something like TOR in China has already put a huge (and very very obvious) red flag on their communications stream. So, if those people are going to be trying to break through the firewall anyway, why should't they do so with the best tools available? Why shouldn't they try to hide their communication in a stream of innocuous traffic rather than obviously red-flagging it? And why shouldn't concerned programmers write tools to make the hiding of such information more effective? Look, many people are going to try to communicate even when they're forbidden from doing so, and they're going to try to circumvent censorship. So we can either try to make it easier for them, or harder. I'm on the side of making it easier. Sure, some people are going to get caught despite using steganographic software. But I'm willing to bet a lot fewer of them will get caught than using bare encryption systems like TOR.
  - tptacek 16y ago
    If you're going to put a big blinking red light on all your packets so that the largest, best-armed surveillance state in the world can collect and analyze them, I guess there's very little harm in waving rubber chickens over them too. Go ahead with the stego. You might want to read Neils Provos' stegdetect stuff, first. The world needs more fun grad student projects, and you wouldn't want people to have to rehash the same stuff he broke 10 years ago.
    - gnosis 16y ago
      Sure, steganography and steganalysis are in an arms race, just like encryption and cryptanalysis. But if the existence of such an arms race doesn't stop someone from using encryption it shouldn't stop them from using steganography. Of course, you need to be prudent about it. Use the most secure techniques available, and don't use methods you know have been broken. Finally, know that you are taking a risk, that nothing is 100% foolproof, and the more powerful and determined your adversary the more of a risk you're taking.
jonprins 16y ago
I'm envisioning a piece of software that lets you IM folks, but with the messages steganographically embedded in emoticons and the cleartext messages autogenerated.
- gnosis 16y ago
  The more different types of traffic that messages could be hidden in, the better. But, personally, I think the best place to hide them right now is video streams. The thing about steganography is that the smaller your hidden message is and the larger the data it's hiding in is, the less of a chance there is of it being detected, and also the greater the cost of such detection will be. Think of it this way: How effective you are at hiding your message, and the cost of hostile detection are proportional to: size of covertext -------------------------- size of hidden message In my opinion, the ideal medium for two-way, realtime steganographic communication would be something like Skype, where large, bidirectional video streams are used. It might not be too hard to hack up some webcam filter that injects hidden messages in to the outgoing videostream and another filter to decode messages from the incoming videostream. For one-way communication (or even two-way, delayed communication) any of the video hosting services like Youtube or Vimeo would be great. This should be even easier to implement than the Skype filters I describe above, as the processing can be done offline at your own leisure. If using steganography to hide information in these videostreams becomes common, the cost to snoopers trying to find messages in them will become simply gigantic. And those costs will only increase as videostream sizes dramatically increase as they inevitably advance to offering higher resolutions (in the short-term), and even 3D-video (in the long-term). An extra tip, if you're going to try something like this, is to make sure to use crappy/defective webcams that naturally inject noise in to the videostream anyway, and maybe film whatever you're filming on a nicely chaotic background like a closeup of trees billowing in the wind, ocean waves crashing on the shore, etc... that should hopefully provide plenty of chaos for your message to hide in.
  - tptacek 16y ago
    This is silly. You can programatically detect e.g. anomalous keyframes from traffic today. Anything you do to try and embed messages in any rich media format (audio, lossy images, video, &c) can be reversed and turned into a filter. The filters won't even need to be accurate; they'll baseline, wait for you to trip a threshold, and then send people to your door to collect your machine. I'm particularly amused by the comment about using complicated images of ocean waves and trees, as if computers were just mechanical humans trying to make sense of the shapes in the picture.

by gnosis 16y ago

poet 16y ago

Stealth circumvention tools are even harder to write than just plain old circumvention tools, which we already are struggling with. It's a disaster waiting to happen. See Haystack and this comment by Thomas: http://news.ycombinator.com/item?id=1690871 http://news.ycombinator.com/item?id=1690871.

gnosis 16y ago
From Thomas' post: "Get circumvention at all wrong and you achieve the opposite of what the tool is intended for: you put a big red flag on people breaking their local laws. ... Don't build circumvention tools." That attitude is so wrongheaded I hardly know where to begin. First of all, anyone who uses something like TOR in China has already put a huge (and very very obvious) red flag on their communications stream. So, if those people are going to be trying to break through the firewall anyway, why should't they do so with the best tools available? Why shouldn't they try to hide their communication in a stream of innocuous traffic rather than obviously red-flagging it? And why shouldn't concerned programmers write tools to make the hiding of such information more effective? Look, many people are going to try to communicate even when they're forbidden from doing so, and they're going to try to circumvent censorship. So we can either try to make it easier for them, or harder. I'm on the side of making it easier. Sure, some people are going to get caught despite using steganographic software. But I'm willing to bet a lot fewer of them will get caught than using bare encryption systems like TOR.
- tptacek 16y ago
  If you're going to put a big blinking red light on all your packets so that the largest, best-armed surveillance state in the world can collect and analyze them, I guess there's very little harm in waving rubber chickens over them too. Go ahead with the stego. You might want to read Neils Provos' stegdetect stuff, first. The world needs more fun grad student projects, and you wouldn't want people to have to rehash the same stuff he broke 10 years ago.
  - gnosis 16y ago
    Sure, steganography and steganalysis are in an arms race, just like encryption and cryptanalysis. But if the existence of such an arms race doesn't stop someone from using encryption it shouldn't stop them from using steganography. Of course, you need to be prudent about it. Use the most secure techniques available, and don't use methods you know have been broken. Finally, know that you are taking a risk, that nothing is 100% foolproof, and the more powerful and determined your adversary the more of a risk you're taking.

jonprins 16y ago

I'm envisioning a piece of software that lets you IM folks, but with the messages steganographically embedded in emoticons and the cleartext messages autogenerated.

gnosis 16y ago
The more different types of traffic that messages could be hidden in, the better. But, personally, I think the best place to hide them right now is video streams. The thing about steganography is that the smaller your hidden message is and the larger the data it's hiding in is, the less of a chance there is of it being detected, and also the greater the cost of such detection will be. Think of it this way: How effective you are at hiding your message, and the cost of hostile detection are proportional to: size of covertext -------------------------- size of hidden message In my opinion, the ideal medium for two-way, realtime steganographic communication would be something like Skype, where large, bidirectional video streams are used. It might not be too hard to hack up some webcam filter that injects hidden messages in to the outgoing videostream and another filter to decode messages from the incoming videostream. For one-way communication (or even two-way, delayed communication) any of the video hosting services like Youtube or Vimeo would be great. This should be even easier to implement than the Skype filters I describe above, as the processing can be done offline at your own leisure. If using steganography to hide information in these videostreams becomes common, the cost to snoopers trying to find messages in them will become simply gigantic. And those costs will only increase as videostream sizes dramatically increase as they inevitably advance to offering higher resolutions (in the short-term), and even 3D-video (in the long-term). An extra tip, if you're going to try something like this, is to make sure to use crappy/defective webcams that naturally inject noise in to the videostream anyway, and maybe film whatever you're filming on a nicely chaotic background like a closeup of trees billowing in the wind, ocean waves crashing on the shore, etc... that should hopefully provide plenty of chaos for your message to hide in.
- tptacek 16y ago
  This is silly. You can programatically detect e.g. anomalous keyframes from traffic today. Anything you do to try and embed messages in any rich media format (audio, lossy images, video, &c) can be reversed and turned into a filter. The filters won't even need to be accurate; they'll baseline, wait for you to trip a threshold, and then send people to your door to collect your machine. I'm particularly amused by the comment about using complicated images of ocean waves and trees, as if computers were just mechanical humans trying to make sense of the shapes in the picture.