5 ms·

While you're in a gulag? I don't understand why you're doubling down on this. There's an easy, correct way to do this that doesn't have the same vulnerabilitie

by ohazi 6y ago

While you're in a gulag? I don't understand why you're doubling down on this. There's an easy, correct way to do this that doesn't have the same vulnerabilities as the method you're describing. The tools to do this already exist. Don't XOR your fucking key bits into a jpeg... it's more work, and the probability of doing it wrong is super high. You're just asking for trouble here.

umvi 6y ago
> While you're in a gulag? Well if you are in a gulag, your Bitcoins should be the least of your concerns. > There's an easy, correct way to do this that doesn't have the same vulnerabilities as the method you're describing Sorry, but I don't believe you. What is this "easy, correct" way of smuggling your bitcoins over the border that a) won't raise suspicion and get you thrown into a gulag b) doesn't require you to memorize the entire private key? Do whatever you want, you have to add obscurity layer(s) to the scheme at some point. It doesn't matter if you are using perfect crypto if said crypto draws attention to you at the border. What are my chances of being caught if I (for example) encode the private key into several emails using a scheme only I know? Zero. I'm not saying this will work at scale for everyone, but it is 100% guaranteed to work for me.
- ohazi 6y ago
  Nobody in this thread is arguing that you shouldn't use obscurity. We're arguing that you shouldn't use obscurity ON THE KEY. MEMORIZE the key. Obscure the ciphertext. You cannot hide a key effectively using steganography. It's not strong enough. The probability of intercept is way higher than the probability of successfully brute-forcing the key or the memorized passphrase used to generate the key when using a strong key-stretching algorithm (not chains-of-hashes). But there's also no reason to hide the key, because key-stretching allows you to memorize a passphrase instead. > What are my chances of being caught if I (for example) encode the private key into several emails using a scheme only I know? Zero. A cryptographer would actually work out a number here. It's a small number, but it isn't zero. Given the insane degree of protection that strong cryptography can provide, it's quite possible that that low number is still orders of magnitude higher than it would be if you just memorized the damn passphrase. > 100% guaranteed to work for me. That's not how cryptography works. It's provably correct, or it's broken.
  - umvi 6y ago
    Even provably correct cryptography is easily broken with a waterboard (or worse), so again... when dealing with dystopian authoritarian regimes, obscurity (not getting caught) is 10x more important than the cryptography part.
    - ohazi 6y ago
      But you can have both! Why are we even arguing about this? Nothing is preventing you from having both strong cryptography AND obscurity, except for your insistence that hiding the key is a reasonable thing to do. It isn't reasonable. You should never attempt to hide a key using steganography when you can memorize a passphrase instead. Hiding the key needlessly breaks the "strong cryptography" part. But you don't even need to hide the key. You can still have all the obscurity you want by hiding the ciphertext and memorizing the key. If you do it this way, you'll still have your obscurity, but you'll also get strong cryptographic guarantees for free.
      - umvi 6y ago
        I think we may be talking about different keys. The key I'm talking about is the bitcoin wallet private key. That needs to be hidden, preferably in encrypted form.

by ohazi 6y ago

umvi 6y ago

> While you're in a gulag? Well if you are in a gulag, your Bitcoins should be the least of your concerns. > There's an easy, correct way to do this that doesn't have the same vulnerabilities as the method you're describing Sorry, but I don't believe you. What is this "easy, correct" way of smuggling your bitcoins over the border that a) won't raise suspicion and get you thrown into a gulag b) doesn't require you to memorize the entire private key? Do whatever you want, you have to add obscurity layer(s) to the scheme at some point. It doesn't matter if you are using perfect crypto if said crypto draws attention to you at the border. What are my chances of being caught if I (for example) encode the private key into several emails using a scheme only I know? Zero. I'm not saying this will work at scale for everyone, but it is 100% guaranteed to work for me.

ohazi 6y ago
Nobody in this thread is arguing that you shouldn't use obscurity. We're arguing that you shouldn't use obscurity ON THE KEY. MEMORIZE the key. Obscure the ciphertext. You cannot hide a key effectively using steganography. It's not strong enough. The probability of intercept is way higher than the probability of successfully brute-forcing the key or the memorized passphrase used to generate the key when using a strong key-stretching algorithm (not chains-of-hashes). But there's also no reason to hide the key, because key-stretching allows you to memorize a passphrase instead. > What are my chances of being caught if I (for example) encode the private key into several emails using a scheme only I know? Zero. A cryptographer would actually work out a number here. It's a small number, but it isn't zero. Given the insane degree of protection that strong cryptography can provide, it's quite possible that that low number is still orders of magnitude higher than it would be if you just memorized the damn passphrase. > 100% guaranteed to work for me. That's not how cryptography works. It's provably correct, or it's broken.
- umvi 6y ago
  Even provably correct cryptography is easily broken with a waterboard (or worse), so again... when dealing with dystopian authoritarian regimes, obscurity (not getting caught) is 10x more important than the cryptography part.
  - ohazi 6y ago
    But you can have both! Why are we even arguing about this? Nothing is preventing you from having both strong cryptography AND obscurity, except for your insistence that hiding the key is a reasonable thing to do. It isn't reasonable. You should never attempt to hide a key using steganography when you can memorize a passphrase instead. Hiding the key needlessly breaks the "strong cryptography" part. But you don't even need to hide the key. You can still have all the obscurity you want by hiding the ciphertext and memorizing the key. If you do it this way, you'll still have your obscurity, but you'll also get strong cryptographic guarantees for free.
    - umvi 6y ago
      I think we may be talking about different keys. The key I'm talking about is the bitcoin wallet private key. That needs to be hidden, preferably in encrypted form.