4 ms·

The writing has been on the wall for some time that encryption is no longer sufficient and steganography is required to protect ourselves.

Circuitous 3y ago
[dead]
bilekas 3y ago
I'm super curious why you think of steganography specifically ? What's benefit to `steganography` and the current encryption tools, I'll admit I don't know a lot about steganography but I've always seen it as the receiver still needing the handshake.
- convery 3y ago
  Tl;dr: Stenography just helps with obfuscation as long as no-one is looking for it. The second someone looks it'll fail, and if it becomes a common practice; everyone will look for it. The theoretical idea is that the information could be hidden in a random location, e.g. extracting every Nth bit, such that the information would be indistinguishable from random noise. In practice, both parties need to agree on the location, so it has the same flaw as 'perfect encryption' methods like a one-time-pad, you need to transfer information IRL. One could make a case for a group/app using a custom scheme to add a layer of security until someone infiltrates the group / RE the app, but you'd get the same security by just encrypting everything with the same password.
  - bilekas 3y ago
    > Tl;dr: Stenography just helps with obfuscation as long as no-one is looking for it. The second someone looks it'll fail, That was my 'playground' conclusion too. It has to be clandestine to work. > In practice, both parties need to agree on the location That is still a key by another term.. > but you'd get the same security by just encrypting everything with the same password. Right, it feels like just a level of obfuscation at that point. Ironically what I was interested in was encypted payloads that could be `called` when loaded. Involves a ridiculous amount of 0days, but the idea of opening an image and having your browser/os touched.. It's interesting given today's lifestyle.
  - KETHERCORTEX 3y ago
    > Tl;dr: Stenography just helps with obfuscation as long as no-one is looking for it. The second someone looks it'll fail, and if it becomes a common practice; everyone will look for it. Not if the obfuscated payload is encrypted using end to end methods. This way obfuscated layer starts to look like trash. To decrypt such a message you need to seize the control over message receiving computer with user and no encryption has protection from this.
Nifty3929 3y ago
I think you're missing an important point - this is a legal issue, not a technical one. Private communication is becoming illegal, however you do it. You can call it "steganography," and the government will call it "20-to-life." The press will go along with the government and talk about you as a "hacker who is using sophisticated message hiding techniques to disguise their secret communications with conspirators." Even if you were just talking about dinner plans.
- derefr 3y ago
  They're not missing the point, they're taking your premise and accepting it, and then moving past it. They're saying: let's just forget about the possibility of encryption being something you can do legally — let's just instead concentrate on encryption that works whether it's legal or not, because it's impossible to determine that it's you doing it. (After all, much of what we've spent the last 40 years of cryptography research doing, is inventing new and creative ways to communicate or broadcast or participate in systems anonymously.)
  - GauntletWizard 3y ago
    It does not matter if it is you doing it or not, the oppressive governments of the world will just as happily jail you for facilitating it, even if you were unaware. These laws will be used as a cudgel against anyone whom they don't like. Technical solutions to lawfare are pointless.
    - derefr 3y ago
      If you're in an oppressive country, why would you facilitate an illegal activity any way other than anonymously? I do understand what you're trying to refer to — to things like "you can't tell it was me who connected to that darknet market" / "but we can tell that your IP address originated a Tor connection, and we now consider that illegal in-and-of-itself, even if it wasn't you doing it but you were just acting as an exit node for others." But again, we've spent a long time building various different cryptosystems that make different sets of guarantees that are useful in different situations. Tor is useful under one particular set of constraints, but that set of constraints is not "staying long-term under an oppressive regime that will arrest you for emitting Tor fingerprintable traffic." For a cryptosystem that is useful under this use-case, see: Freenet. Or NNTP numbers groups. Or MixMaster. (Though also, even Tor does work here, with modification. This is why Tor added bridges — precisely so that people in oppressed regimes could forward their traffic, in an innocuous-looking way, through bridge nodes hosted by people in non-oppressed regimes, where the IPs of these nodes are only handed out as needed to Tor users, one or two at a time, and so can't be blacklisted by country-level firewalls in advance.)
gary_0 3y ago
I wonder if LLMs and text-to-speech AIs would be useful for generating unique plausible conversations so you could hide encrypted data in the background noise of the audio stream. You could even train it on your own voice so there would be even less chance of tipping off the Thought Police AIs listening in. (I've read enough cyberpunk to be sufficiently prepared for this dark future.)
- mike_hock 3y ago
  I've read enough news to be sufficiently prepared for this dark future.

Circuitous 3y ago

[dead]

bilekas 3y ago

I'm super curious why you think of steganography specifically ? What's benefit to `steganography` and the current encryption tools, I'll admit I don't know a lot about steganography but I've always seen it as the receiver still needing the handshake.

convery 3y ago
Tl;dr: Stenography just helps with obfuscation as long as no-one is looking for it. The second someone looks it'll fail, and if it becomes a common practice; everyone will look for it. The theoretical idea is that the information could be hidden in a random location, e.g. extracting every Nth bit, such that the information would be indistinguishable from random noise. In practice, both parties need to agree on the location, so it has the same flaw as 'perfect encryption' methods like a one-time-pad, you need to transfer information IRL. One could make a case for a group/app using a custom scheme to add a layer of security until someone infiltrates the group / RE the app, but you'd get the same security by just encrypting everything with the same password.
- bilekas 3y ago
  > Tl;dr: Stenography just helps with obfuscation as long as no-one is looking for it. The second someone looks it'll fail, That was my 'playground' conclusion too. It has to be clandestine to work. > In practice, both parties need to agree on the location That is still a key by another term.. > but you'd get the same security by just encrypting everything with the same password. Right, it feels like just a level of obfuscation at that point. Ironically what I was interested in was encypted payloads that could be `called` when loaded. Involves a ridiculous amount of 0days, but the idea of opening an image and having your browser/os touched.. It's interesting given today's lifestyle.
- KETHERCORTEX 3y ago
  > Tl;dr: Stenography just helps with obfuscation as long as no-one is looking for it. The second someone looks it'll fail, and if it becomes a common practice; everyone will look for it. Not if the obfuscated payload is encrypted using end to end methods. This way obfuscated layer starts to look like trash. To decrypt such a message you need to seize the control over message receiving computer with user and no encryption has protection from this.

Nifty3929 3y ago

I think you're missing an important point - this is a legal issue, not a technical one. Private communication is becoming illegal, however you do it. You can call it "steganography," and the government will call it "20-to-life." The press will go along with the government and talk about you as a "hacker who is using sophisticated message hiding techniques to disguise their secret communications with conspirators." Even if you were just talking about dinner plans.

derefr 3y ago
They're not missing the point, they're taking your premise and accepting it, and then moving past it. They're saying: let's just forget about the possibility of encryption being something you can do legally — let's just instead concentrate on encryption that works whether it's legal or not, because it's impossible to determine that it's you doing it. (After all, much of what we've spent the last 40 years of cryptography research doing, is inventing new and creative ways to communicate or broadcast or participate in systems anonymously.)
- GauntletWizard 3y ago
  It does not matter if it is you doing it or not, the oppressive governments of the world will just as happily jail you for facilitating it, even if you were unaware. These laws will be used as a cudgel against anyone whom they don't like. Technical solutions to lawfare are pointless.
  - derefr 3y ago
    If you're in an oppressive country, why would you facilitate an illegal activity any way other than anonymously? I do understand what you're trying to refer to — to things like "you can't tell it was me who connected to that darknet market" / "but we can tell that your IP address originated a Tor connection, and we now consider that illegal in-and-of-itself, even if it wasn't you doing it but you were just acting as an exit node for others." But again, we've spent a long time building various different cryptosystems that make different sets of guarantees that are useful in different situations. Tor is useful under one particular set of constraints, but that set of constraints is not "staying long-term under an oppressive regime that will arrest you for emitting Tor fingerprintable traffic." For a cryptosystem that is useful under this use-case, see: Freenet. Or NNTP numbers groups. Or MixMaster. (Though also, even Tor does work here, with modification. This is why Tor added bridges — precisely so that people in oppressed regimes could forward their traffic, in an innocuous-looking way, through bridge nodes hosted by people in non-oppressed regimes, where the IPs of these nodes are only handed out as needed to Tor users, one or two at a time, and so can't be blacklisted by country-level firewalls in advance.)

gary_0 3y ago

I wonder if LLMs and text-to-speech AIs would be useful for generating unique plausible conversations so you could hide encrypted data in the background noise of the audio stream. You could even train it on your own voice so there would be even less chance of tipping off the Thought Police AIs listening in. (I've read enough cyberpunk to be sufficiently prepared for this dark future.)

mike_hock 3y ago
I've read enough news to be sufficiently prepared for this dark future.