3 ms·

Sure, steganography and steganalysis are in an arms race, just like encryption and cryptanalysis. But if the existence of such an arms race doesn't stop someon

by gnosis 16y ago

Sure, steganography and steganalysis are in an arms race, just like encryption and cryptanalysis. But if the existence of such an arms race doesn't stop someone from using encryption it shouldn't stop them from using steganography. Of course, you need to be prudent about it. Use the most secure techniques available, and don't use methods you know have been broken. Finally, know that you are taking a risk, that nothing is 100% foolproof, and the more powerful and determined your adversary the more of a risk you're taking.

tptacek 16y ago
We're talking about individuals versus nation states. You're handwaving.
- gnosis 16y ago
  And your two-sentence reply that didn't specifically address a single point in my post is supposed to be some deep, thorough analysis? Pot, meet kettle. Despite this, I'll do you the kindness of actually addressing the point you made by giving you a big, "so what?" Activists and dissidents often go up against nation states. That's the nature of the business. And they knowingly take risks to do so. The question is, are they simply going to use bare encryption, thereby virtually guaranteeing to draw attention to themselves in a state like China? Or are they going to wrap their encrypted message in a layer of steganography, thus giving themselves at least a chance to avoid detection in the first place?
  - poet 16y ago
    How about a third option: they use a method of communication that wont get them killed. You're presenting a false dichotomy.
    - gnosis 16y ago
      "How about a third option: they use a method of communication that wont get them killed. You're presenting a false dichotomy." Got any suggestions? Because I know the millions of Chinese who attempt to circumvent China's firewall daily would love to hear about it. The point is that probably 90% of the time, these people aren't using anything better than bare encryption (if that), and they're drawing attention to themselves anyway. If they're going to do that anyway, I think it makes much more sense to hide the communication via stego. But if you've got a better idea, let's hear it.
      - tptacek 16y ago
        Hard problems don't become easier just because they find social justice applications. Math doesn't care what China does to its dissidents, as Wang Xiaoyun has made pretty clear to us.
  - tptacek 16y ago
    You made an asinine comparison, between cryptography/cryptanalysis (where advances involve fundamental breakthroughs in mathematics and information theory) and stegonography/steganalysis (where advances have been made, recently, from simple measurement studies). How in-depth do you want me to get with you? I gave you an actual (high-level, easy-to-read, summarized) academic source. You clearly haven't read it. Why not go take some time with it and come back not sounding like a crank?
poet 16y ago
The difference is that with cryptography the actors are nation states v. nation states. With steganography the actors are activists v. nation states. Also, what makes you think activists have the technical expertise available to know what the "most secure techniques available" are and what methods have been broken?
- gnosis 16y ago
  "The difference is that with cryptography the actors are nation states v. nation states. With steganography the actors are activists v. nation states." I don't know where you got the idea that nation states are the only ones who use cryptography. Plenty of activists, along with other non-state actors do so all the time. Plenty of cryptography is also designed by individuals not in the service of any nation state (as far as we know, anyway). In fact, some argue that such encryption is more trustworthy than encryption developed by nation states themselves. "Also, what makes you think activists have the technical expertise available to know what the "most secure techniques available" are and what methods have been broken?" I can't speak for any and all activists. It's really up to them to acquire such expertise or get advice from people who have such expertise. That said, the problem here is no different from figuring out which encryption to use. So your criticism applies equally to encryption as it does to steganography.
  - poet 16y ago
    I don't know where you got the idea that nation states are the only ones who use cryptography. Plenty of activists, along with other non-state actors do so all the time. We're not talking about users, we're talking about attackers and developers. Why would users have anything to do with our discussion? Plenty of cryptography is also designed by individuals not in the service of any nation state (as far as we know, anyway). In fact, some argue that such encryption is more trustworthy than encryption developed by nation states themselves. Developed by academics, but tested by both academics and the government. The testing is the thing that's actually important. I can't speak for any and all activists. It's really up to them to acquire such expertise or get advice from people who have such expertise. The point is that the technical expertise is not available. It's not up to them. It's not available. What you suggest they do is not possible. That said, the problem here is no different from figuring out which encryption to use. So your criticism applies equally to encryption as it does to steganography. Nope. Get back to me when we get government backed standards and recommendations for anonymity (hint: we have them for crypto).

by gnosis 16y ago

tptacek 16y ago

We're talking about individuals versus nation states. You're handwaving.

gnosis 16y ago
And your two-sentence reply that didn't specifically address a single point in my post is supposed to be some deep, thorough analysis? Pot, meet kettle. Despite this, I'll do you the kindness of actually addressing the point you made by giving you a big, "so what?" Activists and dissidents often go up against nation states. That's the nature of the business. And they knowingly take risks to do so. The question is, are they simply going to use bare encryption, thereby virtually guaranteeing to draw attention to themselves in a state like China? Or are they going to wrap their encrypted message in a layer of steganography, thus giving themselves at least a chance to avoid detection in the first place?
- poet 16y ago
  How about a third option: they use a method of communication that wont get them killed. You're presenting a false dichotomy.
  - gnosis 16y ago
    "How about a third option: they use a method of communication that wont get them killed. You're presenting a false dichotomy." Got any suggestions? Because I know the millions of Chinese who attempt to circumvent China's firewall daily would love to hear about it. The point is that probably 90% of the time, these people aren't using anything better than bare encryption (if that), and they're drawing attention to themselves anyway. If they're going to do that anyway, I think it makes much more sense to hide the communication via stego. But if you've got a better idea, let's hear it.
    - tptacek 16y ago
      Hard problems don't become easier just because they find social justice applications. Math doesn't care what China does to its dissidents, as Wang Xiaoyun has made pretty clear to us.
- tptacek 16y ago
  You made an asinine comparison, between cryptography/cryptanalysis (where advances involve fundamental breakthroughs in mathematics and information theory) and stegonography/steganalysis (where advances have been made, recently, from simple measurement studies). How in-depth do you want me to get with you? I gave you an actual (high-level, easy-to-read, summarized) academic source. You clearly haven't read it. Why not go take some time with it and come back not sounding like a crank?

poet 16y ago

The difference is that with cryptography the actors are nation states v. nation states. With steganography the actors are activists v. nation states. Also, what makes you think activists have the technical expertise available to know what the "most secure techniques available" are and what methods have been broken?

gnosis 16y ago
"The difference is that with cryptography the actors are nation states v. nation states. With steganography the actors are activists v. nation states." I don't know where you got the idea that nation states are the only ones who use cryptography. Plenty of activists, along with other non-state actors do so all the time. Plenty of cryptography is also designed by individuals not in the service of any nation state (as far as we know, anyway). In fact, some argue that such encryption is more trustworthy than encryption developed by nation states themselves. "Also, what makes you think activists have the technical expertise available to know what the "most secure techniques available" are and what methods have been broken?" I can't speak for any and all activists. It's really up to them to acquire such expertise or get advice from people who have such expertise. That said, the problem here is no different from figuring out which encryption to use. So your criticism applies equally to encryption as it does to steganography.
- poet 16y ago
  I don't know where you got the idea that nation states are the only ones who use cryptography. Plenty of activists, along with other non-state actors do so all the time. We're not talking about users, we're talking about attackers and developers. Why would users have anything to do with our discussion? Plenty of cryptography is also designed by individuals not in the service of any nation state (as far as we know, anyway). In fact, some argue that such encryption is more trustworthy than encryption developed by nation states themselves. Developed by academics, but tested by both academics and the government. The testing is the thing that's actually important. I can't speak for any and all activists. It's really up to them to acquire such expertise or get advice from people who have such expertise. The point is that the technical expertise is not available. It's not up to them. It's not available. What you suggest they do is not possible. That said, the problem here is no different from figuring out which encryption to use. So your criticism applies equally to encryption as it does to steganography. Nope. Get back to me when we get government backed standards and recommendations for anonymity (hint: we have them for crypto).