5 ms·

Stealth circumvention tools are even harder to write than just plain old circumvention tools, which we already are struggling with. It's a disaster waiting to h

• gnosis 16y ago
  From Thomas' post: "Get circumvention at all wrong and you achieve the opposite of what the tool is intended for: you put a big red flag on people breaking their local laws. ... Don't build circumvention tools." That attitude is so wrongheaded I hardly know where to begin. First of all, anyone who uses something like TOR in China has already put a huge (and very very obvious) red flag on their communications stream. So, if those people are going to be trying to break through the firewall anyway, why should't they do so with the best tools available? Why shouldn't they try to hide their communication in a stream of innocuous traffic rather than obviously red-flagging it? And why shouldn't concerned programmers write tools to make the hiding of such information more effective? Look, many people are going to try to communicate even when they're forbidden from doing so, and they're going to try to circumvent censorship. So we can either try to make it easier for them, or harder. I'm on the side of making it easier. Sure, some people are going to get caught despite using steganographic software. But I'm willing to bet a lot fewer of them will get caught than using bare encryption systems like TOR.
  • tptacek 16y ago
    If you're going to put a big blinking red light on all your packets so that the largest, best-armed surveillance state in the world can collect and analyze them, I guess there's very little harm in waving rubber chickens over them too. Go ahead with the stego. You might want to read Neils Provos' stegdetect stuff, first. The world needs more fun grad student projects, and you wouldn't want people to have to rehash the same stuff he broke 10 years ago.
    • gnosis 16y ago
      Sure, steganography and steganalysis are in an arms race, just like encryption and cryptanalysis. But if the existence of such an arms race doesn't stop someone from using encryption it shouldn't stop them from using steganography. Of course, you need to be prudent about it. Use the most secure techniques available, and don't use methods you know have been broken. Finally, know that you are taking a risk, that nothing is 100% foolproof, and the more powerful and determined your adversary the more of a risk you're taking.
      • tptacek 16y ago
        We're talking about individuals versus nation states. You're handwaving.
        • gnosis 16y ago
          And your two-sentence reply that didn't specifically address a single point in my post is supposed to be some deep, thorough analysis? Pot, meet kettle. Despite this, I'll do you the kindness of actually addressing the point you made by giving you a big, "so what?" Activists and dissidents often go up against nation states. That's the nature of the business. And they knowingly take risks to do so. The question is, are they simply going to use bare encryption, thereby virtually guaranteeing to draw attention to themselves in a state like China? Or are they going to wrap their encrypted message in a layer of steganography, thus giving themselves at least a chance to avoid detection in the first place?
          • poet 16y ago
            How about a third option: they use a method of communication that wont get them killed. You're presenting a false dichotomy.
            • gnosis 16y ago
              "How about a third option: they use a method of communication that wont get them killed. You're presenting a false dichotomy." Got any suggestions? Because I know the millions of Chinese who attempt to circumvent China's firewall daily would love to hear about it. The point is that probably 90% of the time, these people aren't using anything better than bare encryption (if that), and they're drawing attention to themselves anyway. If they're going to do that anyway, I think it makes much more sense to hide the communication via stego. But if you've got a better idea, let's hear it.