3 ms·

Nobody in this thread is arguing that you shouldn't use obscurity. We're arguing that you shouldn't use obscurity ON THE KEY. MEMORIZE the key. Obscure the cip

by ohazi 6y ago

Nobody in this thread is arguing that you shouldn't use obscurity. We're arguing that you shouldn't use obscurity ON THE KEY. MEMORIZE the key. Obscure the ciphertext. You cannot hide a key effectively using steganography. It's not strong enough. The probability of intercept is way higher than the probability of successfully brute-forcing the key or the memorized passphrase used to generate the key when using a strong key-stretching algorithm (not chains-of-hashes). But there's also no reason to hide the key, because key-stretching allows you to memorize a passphrase instead. > What are my chances of being caught if I (for example) encode the private key into several emails using a scheme only I know? Zero. A cryptographer would actually work out a number here. It's a small number, but it isn't zero. Given the insane degree of protection that strong cryptography can provide, it's quite possible that that low number is still orders of magnitude higher than it would be if you just memorized the damn passphrase. > 100% guaranteed to work for me. That's not how cryptography works. It's provably correct, or it's broken.

umvi 6y ago
Even provably correct cryptography is easily broken with a waterboard (or worse), so again... when dealing with dystopian authoritarian regimes, obscurity (not getting caught) is 10x more important than the cryptography part.
- ohazi 6y ago
  But you can have both! Why are we even arguing about this? Nothing is preventing you from having both strong cryptography AND obscurity, except for your insistence that hiding the key is a reasonable thing to do. It isn't reasonable. You should never attempt to hide a key using steganography when you can memorize a passphrase instead. Hiding the key needlessly breaks the "strong cryptography" part. But you don't even need to hide the key. You can still have all the obscurity you want by hiding the ciphertext and memorizing the key. If you do it this way, you'll still have your obscurity, but you'll also get strong cryptographic guarantees for free.
  - umvi 6y ago
    I think we may be talking about different keys. The key I'm talking about is the bitcoin wallet private key. That needs to be hidden, preferably in encrypted form.

by ohazi 6y ago

umvi 6y ago

Even provably correct cryptography is easily broken with a waterboard (or worse), so again... when dealing with dystopian authoritarian regimes, obscurity (not getting caught) is 10x more important than the cryptography part.

ohazi 6y ago
But you can have both! Why are we even arguing about this? Nothing is preventing you from having both strong cryptography AND obscurity, except for your insistence that hiding the key is a reasonable thing to do. It isn't reasonable. You should never attempt to hide a key using steganography when you can memorize a passphrase instead. Hiding the key needlessly breaks the "strong cryptography" part. But you don't even need to hide the key. You can still have all the obscurity you want by hiding the ciphertext and memorizing the key. If you do it this way, you'll still have your obscurity, but you'll also get strong cryptographic guarantees for free.
- umvi 6y ago
  I think we may be talking about different keys. The key I'm talking about is the bitcoin wallet private key. That needs to be hidden, preferably in encrypted form.