6 ms·

The goal of the Pakistani government seems to be the complete obliteration of all private communications. But the only way to do that is by banning all communic

The goal of the Pakistani government seems to be the complete obliteration of all private communications. But the only way to do that is by banning all communication. With the ban on VPNs, steganographic[1] techniques that make encrypted traffic look like regular traffic will become more and more common. The troubling thing is the fact that these techniques are somewhat hungry for bandwidth. [1] http://en.wikipedia.org/wiki/Steganography http://en.wikipedia.org/wiki/Steganography

omouse 15y ago
Psh, you can still spread messages person to person, you know, in REAL LIFE. It's sad how we're all tied to the Internet and try to make it the first and foremost way in which we communicate.
- lallysingh 15y ago
  Most governments only go to controlling online activity after controlling real-life activity. I don't know about Pakistan specifically, but typically the domestic "security" organizations are rather adept at tracking down groups who organize in meatspace.
- ItsTrueYouKnow 15y ago
  Because anonymous, rapid, long distance communication is obviously easy to do person to person.
- Jach 15y ago
  Why do the cops win? A network of instant communication. If you can't communicate quickly, or at least as fast as your enemies, in many cases you might as well not communicate at all. There are benefits of sneakernets but they don't win on their own.
77ko 15y ago
Simple explanation of Steganography: http://www.economist.com/node/17248872 http://www.economist.com/node/17248872
cosgroveb 15y ago
Stego is detectable. They will move on to scanning for and flagging those communications eventually.
- waitwhat 15y ago
  Stego is detectable. Only in the sense that "Crypto is breakable." The entire point of steganography is that it isn't detectable. If it can be detected, you need a better algorithm.
  - blake8086 15y ago
    If you use steganography with plaintext, you're relying on security by obscurity. Governments aren't going to tell you when they've cracked your secret. If you're encrypting your steganographic messages, you're increasing the entropy of the plaintext message you're concealing it in.
    - andreasvc 15y ago
      Solution: don't use it with plain text, but with compressed files such as photos and movies which have high entropy by virtue of their compression (if it is effective, that is).
      - ItsTrueYouKnow 15y ago
        I believe that blake8086 was referring to the content of the hidden message when he said plain text. He is asserting that if you hide 'hidden message here' in something, you are using security by obscurity, but if you try to hide ENC('hidden message here', 'secret key goes here') you are going to make the detection of the presence of your secret message easier.
        andreasvc 15y ago
        I argued against the latter point: if you hide the encrypted message in something which is normally compressed such as JPEG or DivX, the encrypted message blends in with the rest of the data because compressed data has high entropy (the better the compression, the higher the entropy). I don't get your point about security by obscurity, that's pretty much the whole point of steganography I would suppose. Security by obscurity is mostly a slogan to criticize not publishing algorithms etc.
rwmj 15y ago
Is there a steganography package as easy to use as https or ssh?
- reginaldo 15y ago
  Not that I know of. What I know is that, as https is so easy to use, there are plans to make it serve covert traffic. So you would make a request to https://www.friendlyproxy.com https://www.friendlyproxy.com with an extra header somewhat like What-I-Want: http://www.bannedsite.com http://www.bannedsite.com and have "friendlyproxy.com" serve you the document you originally wanted. I forgot the name of the project, though. I believe it was from an American university Besides, with this new wave of government carrying MITM attacks, I don't know how useful this techniques will be. EDIT: I was able to find a link explaining the Telex project from University of Michigan: http://ns.umich.edu/htdocs/releases/story.php?id=8505 http://ns.umich.edu/htdocs/releases/story.php?id=8505
  - jrockway 15y ago
    I wrote something like this to circumvent our filtering proxy at work. I didn't open it up to the public because I was worried about being responsible for their traffic, though.
feral 15y ago
I disagree with the spirit of this comment. You don't need to ban all communication, to remove privacy in practice. Crypto is currently usable in practice. Its a bit hard for many users, but its doable, especially with modern VPN implementations. If any encrypted tunnel is allowed, you can put all your traffic through it, and no one knows whether you are surfing banned websites, or working on the corporate VPN. And you can be pretty confident your modern crypto implementation isn't going to be broken. But steganography isn't really usable, in practice. If nothing else, the government can do traffic analysis, and see suspiciously large traffic volumes going to a small collection of servers (which are accepting the steg'd communication, and proxying your requests, presumably). And even if the traffic looks like normal HTTP, with images in it, that's simply not good enough to use, in a regime where the secret police can arrest you if they suspect you are trying to hide your traffic content. And they will be able to find users, because eventually the servers accepting steg'd traffic, which the population are using, will become known. So, while I think it'd be very hard to remove the ability to send small amounts of text data, from the Internet, I think it'd be possible to make private communication unworkable, in practice, for most people. I don't see how this would be worked around, without building a massive distributed network of computers that all accepted and routed steg'd communication; something like if every webserver would accept, and onion-route, incoming steg'd traffic. That doesn't exist, so I think their initiative will work, if they push it enough; hopefully rules like this remain isolated to relatively repressive regimes, and not gain widespread adoption; the widespread commercial use of encrypted communications is probably the best defence against global crypto bans.
- reginaldo 15y ago
  You are right that, as steganography isn't really usable right now, you don't need to ban all communication to remove privacy in practice right now. But as governments adopt privacy-removing measures, the people will react devising privacy-enabling measures, and undetectable steganography might be possible in the future. Let us remember that normal HTTP traffic follows a power-law, with relatively few sites getting the majority of the traffic, so there might be a way, if many of the high-traffic sites on the internet collaborate, of making "covert" traffic look just like "innocent" traffic. that's simply not good enough to use, in a regime where the secret police can arrest you if they suspect you are trying to hide your traffic content Even if we accept the premise of undetectable steganography, which is not possible by any possible means today, the arrests will continue to happen. However, I hope they will tend to happen less, as the large number of false-positive arrests would certainly cause high commotion in the general population. * So, while I think it'd be very hard to remove the ability to send small amounts of text data, from the Internet, I think it'd be possible to make private communication unworkable, in practice, for most people.* You are correct. Under the current situation, it'll be hard to make all your communication private under the restrictions imposed by, for instance, the Pakistani government, but dissidents don't need all communication to be private, and small amounts of text data might be all that's needed.

omouse 15y ago

Psh, you can still spread messages person to person, you know, in REAL LIFE. It's sad how we're all tied to the Internet and try to make it the first and foremost way in which we communicate.

lallysingh 15y ago
Most governments only go to controlling online activity after controlling real-life activity. I don't know about Pakistan specifically, but typically the domestic "security" organizations are rather adept at tracking down groups who organize in meatspace.
ItsTrueYouKnow 15y ago
Because anonymous, rapid, long distance communication is obviously easy to do person to person.
Jach 15y ago
Why do the cops win? A network of instant communication. If you can't communicate quickly, or at least as fast as your enemies, in many cases you might as well not communicate at all. There are benefits of sneakernets but they don't win on their own.

77ko 15y ago

Simple explanation of Steganography: http://www.economist.com/node/17248872 http://www.economist.com/node/17248872

cosgroveb 15y ago

Stego is detectable. They will move on to scanning for and flagging those communications eventually.

waitwhat 15y ago
Stego is detectable. Only in the sense that "Crypto is breakable." The entire point of steganography is that it isn't detectable. If it can be detected, you need a better algorithm.
- blake8086 15y ago
  If you use steganography with plaintext, you're relying on security by obscurity. Governments aren't going to tell you when they've cracked your secret. If you're encrypting your steganographic messages, you're increasing the entropy of the plaintext message you're concealing it in.
  - andreasvc 15y ago
    Solution: don't use it with plain text, but with compressed files such as photos and movies which have high entropy by virtue of their compression (if it is effective, that is).
    - ItsTrueYouKnow 15y ago
      I believe that blake8086 was referring to the content of the hidden message when he said plain text. He is asserting that if you hide 'hidden message here' in something, you are using security by obscurity, but if you try to hide ENC('hidden message here', 'secret key goes here') you are going to make the detection of the presence of your secret message easier.
      - andreasvc 15y ago
        I argued against the latter point: if you hide the encrypted message in something which is normally compressed such as JPEG or DivX, the encrypted message blends in with the rest of the data because compressed data has high entropy (the better the compression, the higher the entropy). I don't get your point about security by obscurity, that's pretty much the whole point of steganography I would suppose. Security by obscurity is mostly a slogan to criticize not publishing algorithms etc.

rwmj 15y ago

Is there a steganography package as easy to use as https or ssh?

reginaldo 15y ago
Not that I know of. What I know is that, as https is so easy to use, there are plans to make it serve covert traffic. So you would make a request to https://www.friendlyproxy.com https://www.friendlyproxy.com with an extra header somewhat like What-I-Want: http://www.bannedsite.com http://www.bannedsite.com and have "friendlyproxy.com" serve you the document you originally wanted. I forgot the name of the project, though. I believe it was from an American university Besides, with this new wave of government carrying MITM attacks, I don't know how useful this techniques will be. EDIT: I was able to find a link explaining the Telex project from University of Michigan: http://ns.umich.edu/htdocs/releases/story.php?id=8505 http://ns.umich.edu/htdocs/releases/story.php?id=8505
- jrockway 15y ago
  I wrote something like this to circumvent our filtering proxy at work. I didn't open it up to the public because I was worried about being responsible for their traffic, though.

feral 15y ago

I disagree with the spirit of this comment. You don't need to ban all communication, to remove privacy in practice. Crypto is currently usable in practice. Its a bit hard for many users, but its doable, especially with modern VPN implementations. If any encrypted tunnel is allowed, you can put all your traffic through it, and no one knows whether you are surfing banned websites, or working on the corporate VPN. And you can be pretty confident your modern crypto implementation isn't going to be broken. But steganography isn't really usable, in practice. If nothing else, the government can do traffic analysis, and see suspiciously large traffic volumes going to a small collection of servers (which are accepting the steg'd communication, and proxying your requests, presumably). And even if the traffic looks like normal HTTP, with images in it, that's simply not good enough to use, in a regime where the secret police can arrest you if they suspect you are trying to hide your traffic content. And they will be able to find users, because eventually the servers accepting steg'd traffic, which the population are using, will become known. So, while I think it'd be very hard to remove the ability to send small amounts of text data, from the Internet, I think it'd be possible to make private communication unworkable, in practice, for most people. I don't see how this would be worked around, without building a massive distributed network of computers that all accepted and routed steg'd communication; something like if every webserver would accept, and onion-route, incoming steg'd traffic. That doesn't exist, so I think their initiative will work, if they push it enough; hopefully rules like this remain isolated to relatively repressive regimes, and not gain widespread adoption; the widespread commercial use of encrypted communications is probably the best defence against global crypto bans.

reginaldo 15y ago
You are right that, as steganography isn't really usable right now, you don't need to ban all communication to remove privacy in practice right now. But as governments adopt privacy-removing measures, the people will react devising privacy-enabling measures, and undetectable steganography might be possible in the future. Let us remember that normal HTTP traffic follows a power-law, with relatively few sites getting the majority of the traffic, so there might be a way, if many of the high-traffic sites on the internet collaborate, of making "covert" traffic look just like "innocent" traffic. that's simply not good enough to use, in a regime where the secret police can arrest you if they suspect you are trying to hide your traffic content Even if we accept the premise of undetectable steganography, which is not possible by any possible means today, the arrests will continue to happen. However, I hope they will tend to happen less, as the large number of false-positive arrests would certainly cause high commotion in the general population. * So, while I think it'd be very hard to remove the ability to send small amounts of text data, from the Internet, I think it'd be possible to make private communication unworkable, in practice, for most people.* You are correct. Under the current situation, it'll be hard to make all your communication private under the restrictions imposed by, for instance, the Pakistani government, but dissidents don't need all communication to be private, and small amounts of text data might be all that's needed.