4 ms·
Nope. You would be painting a huge red target on yourself if you tried something like this. The purpose of steganography is not to get noticed in the first pla
by zepolud 13y ago
Nope. You would be painting a huge red target on yourself if you tried something like this.
The purpose of steganography is not to get noticed in the first place. It's orthogonal to regular cryptography.
- ozi 13y agoUnfortunately, common steganography algos used on images are easy to detect with statistical analysis.
- akkartik 13y agoCan you elaborate?
- knowaveragejoe 13y agohttp://en.wikipedia.org/wiki/Steganalysis http://en.wikipedia.org/wiki/Steganalysis
- DanBC 13y agoPeople read a book, they see a simple description of steganography, they whip up an implementation as a proof of concept, they share that code, other people think it's secure when it's not meant to be. (http://www.ifp.illinois.edu/~ywang11/paper/CISS04_204.pdf http://www.ifp.illinois.edu/~ywang11/paper/CISS04_204.pdf) (http://eprint.iacr.org/2005/305 http://eprint.iacr.org/2005/305) (http://vision.ece.ucsb.edu/publications/sullivan_ICIP06.pdf http://vision.ece.ucsb.edu/publications/sullivan_ICIP06.pdf)
- pkinsky 13y agoDoes this include f5? https://code.google.com/p/f5-steganography/ https://code.google.com/p/f5-steganography/
- zepolud 13y agoImages are just the lowest hanging fruit and attract a lot of sloppy schemes. You can encode information in pretty much anything as long as you are free to choose the message. You could even encode info in plain text by the lengths of non-whitespace characters, modulo 2. As an example, try using the so-defined scheme on the letters count of this very sentence; they're encoding, repeatingly, S.O.S. Posts of similar length as this one are enough to send a public key using ECDH and negotiate a shared secret for use with a block or stream cypher. You could then send short messages using this shared secret inconspicuously. Shannon entropy of English is about 1.5 bits per character so you could store quite a bit if you cared to compress it well before encrypting, preferably using a shared static dictionary.
- betterunix 13y agoSteganography suffers from the warden problem: being in possession of steganography software is suspicious regardless of whether or not you use it.
- finnw 13y agoIn that respect, is it any worse than being in possession of a copy of GPG?
- betterunix 13y agoNo, but it is not any better either. There are other issues to consider as well e.g. the lack of widely deployed public key stegosystems.
- jlgreco 13y agoThe noise level with GPG is fairly high. Anyone with a modern Linux distro install has a copy by default.
- PeterisP 13y agoA solution to this is to increase the "noise floor" by bundling steganography tools with common widely distributed software, so that obviously 99+% of people and computers with steganography software would be 'innocent'. For example, if Ubuntu default installation would create a small (10mb?) sized volume filled with random bits and install an appropriate steganography tool designed to write/read encrypted data there, then it would enable anyone to hide some arbitrary data while having a file/software setup that's not distinguishable from millions of others in any way.
- betterunix 13y ago"A solution to this is to increase the "noise floor" by bundling steganography tools with common widely distributed software, so that obviously 99+% of people and computers with steganography software would be 'innocent'." Good luck with that one. As a practical matter, this is unlikely to happen; hardly anyone requires steganography as part of their security solution (the MPAA stands out due to the use of watermarking). Email and online businesses were the killer app for public key cryptography; what killer app do you see for steganography?