4 ms·

RE: "These messages are hidden in photos so they cannot be detected by Facebook, Governments or prying friends." I think this claim is overly broad and not par

RE: "These messages are hidden in photos so they cannot be detected by Facebook, Governments or prying friends." I think this claim is overly broad and not particularly true. The NSA surely knows about steganography too. It's been around for a while.

owencm 14y ago
Good point. I've rephrased this sentence to be less strong. The gist is that although they could theoretically be detected it would be computationally infeasible for Facebook to do the scanning since they receive 300+ million new photos a day and with a database of about 250 billion photos even if the NSA could get access, they could never feasibly scan them all.
- goodside 14y ago
  "Never" is a long time, and it's plausible the NSA might be interested in a list of names of people who have gone to extremes to hide from them. Is the detection process so difficult that Facebook couldn't integrate it into the upload processing of all new images? There's obviously no need to retroactively check images that were uploaded before your algorithm was written.
  - owencm 14y ago
    The retrospective scanning is a great point - I hadn't considered that. The detection process is certainly not going to be built into the Facebook upload process unless really serious (and seriously public) usage of these techniques takes off such as wide-spread use by terrorists. But theoretically, yes detecting could be integrated with uploading. That said, steganography algorithms and detectors generally play a cat and mouse game so as long as extension providers can move faster than Facebook in implementing new algorithms this risk is mitigated.
- gallerytungsten 14y ago
  They don't have to scan them all. Only the ones uploaded by the people on their target list. As for access, I'm sure they have it. Regarding computational power, the NSA is generally reputed to have enough supercomputers to fill a football field. I'm sure their new data center in Utah will be greatly enlarging their capabilities. I'd suggest you read James Bamford's three books on the NSA for further insight. (The Puzzle Palace, Body of Secrets, and The Shadow Factory.) http://en.wikipedia.org/wiki/James_Bamford#Books http://en.wikipedia.org/wiki/James_Bamford#Books
  - owencm 14y ago
    Fundamentally you're correct. Honestly, if I thought this extension was going to be useful to terrorists I wouldn't have released it! In my write-up (linked at the bottom of the article) and also in the instructions it is clear that this is a toy application for hobbyists and is not appropriate for serious security uses. Also, those books do look interesting, might go pick one up..!
97-109-107 14y ago
I think everybody here would agree with your correction to that claim. Unless, however, we'd interpret that a bit differently. My take on this approach (coming from developing a similar extension to the one by Owen) - and what I believe Owen meant there - is that you might be relatively save as long as you 'fly under the radar'. It might be based on the naive believe if that if you aren't yet directly targeted, attempts like these can go unnoticed.

owencm 14y ago

Good point. I've rephrased this sentence to be less strong. The gist is that although they could theoretically be detected it would be computationally infeasible for Facebook to do the scanning since they receive 300+ million new photos a day and with a database of about 250 billion photos even if the NSA could get access, they could never feasibly scan them all.

goodside 14y ago
"Never" is a long time, and it's plausible the NSA might be interested in a list of names of people who have gone to extremes to hide from them. Is the detection process so difficult that Facebook couldn't integrate it into the upload processing of all new images? There's obviously no need to retroactively check images that were uploaded before your algorithm was written.
- owencm 14y ago
  The retrospective scanning is a great point - I hadn't considered that. The detection process is certainly not going to be built into the Facebook upload process unless really serious (and seriously public) usage of these techniques takes off such as wide-spread use by terrorists. But theoretically, yes detecting could be integrated with uploading. That said, steganography algorithms and detectors generally play a cat and mouse game so as long as extension providers can move faster than Facebook in implementing new algorithms this risk is mitigated.
gallerytungsten 14y ago
They don't have to scan them all. Only the ones uploaded by the people on their target list. As for access, I'm sure they have it. Regarding computational power, the NSA is generally reputed to have enough supercomputers to fill a football field. I'm sure their new data center in Utah will be greatly enlarging their capabilities. I'd suggest you read James Bamford's three books on the NSA for further insight. (The Puzzle Palace, Body of Secrets, and The Shadow Factory.) http://en.wikipedia.org/wiki/James_Bamford#Books http://en.wikipedia.org/wiki/James_Bamford#Books
- owencm 14y ago
  Fundamentally you're correct. Honestly, if I thought this extension was going to be useful to terrorists I wouldn't have released it! In my write-up (linked at the bottom of the article) and also in the instructions it is clear that this is a toy application for hobbyists and is not appropriate for serious security uses. Also, those books do look interesting, might go pick one up..!

97-109-107 14y ago

I think everybody here would agree with your correction to that claim. Unless, however, we'd interpret that a bit differently. My take on this approach (coming from developing a similar extension to the one by Owen) - and what I believe Owen meant there - is that you might be relatively save as long as you 'fly under the radar'. It might be based on the naive believe if that if you aren't yet directly targeted, attempts like these can go unnoticed.