7 ms·
Show HN: Send Secret Messages over Twitter as Public Tweets
- dpapathanasiou 13y agoThis is a side project I've been working on for the Lisp in Summer Projects[1] contest. It's a text steganography app using a simple book cipher, written in Clojure. I welcome any feedback from HN so let me know what you think! [1] http://lispinsummerprojects.org/ http://lispinsummerprojects.org/
- zeckalpha 13y agoI could see an advertiser making interesting use of this. "Drink more ovaltine!" Have you thought about trying to do a public-key based version? People could list their key in their profile.
- coherentpony 13y agoThe problem there is the 140 char limit.
- a3n 13y agoYou can split a sentence across multiple tweets. V1.1?
- coherentpony 13y agoOh, cool!
- rhizome 13y agoTwitlonger isn't annoying enough?
- zeckalpha 13y agoThe keys would not be transmitted via tweets, just messages.
- dpapathanasiou 13y agoThe ad application is interesting; I hadn't been thinking along those lines at all... I considered using public keys, but I didn't want the resulting encoded tweet to be illegible or look like gibberish. The conceit here is that even a secret message looks completely innocent, something that no eavesdropper would notice as being out of the ordinary (though the middle dot marker does give it away, to people paying attention).
- akkartik 13y agoAnother idea: use a corpus of tweets to retweet.
- dpapathanasiou 13y agoYes, that's the simplest way to make the encoded tweets look natural, i.e., truly steganographic, but it's a fine balancing act between that and not making the corpus obvious.
- akkartik 13y agoIs it a big deal if it's obvious that the corpus is of tweets? There's many many ways to build one and order the tweets, right?
- dpapathanasiou 13y agoThe content of the corpus doesn't matter, so the answer to your first question is no, and yes, if you're clever in terms of how you've composed the corpus so that no one could re-create it easily, then it's ok (relatively speaking, of course).
- philwebster 13y agoFor those who aren't aware, "Drink more Ovaltine" is a reference to the movie A Christmas Story [1]. The boy in the story is excited to decode a message from the Ovaltine fan club using his decoder ring and is let down when the message is just "Be sure to drink your Ovaltine." [2] [1] http://www.imdb.com/title/tt0085334/ http://www.imdb.com/title/tt0085334/ [2] http://en.wikipedia.org/wiki/Secret_decoder_ring#Messages http://en.wikipedia.org/wiki/Secret_decoder_ring#Messages
- zeckalpha 13y agoActually, it predates the movie. https://en.wikipedia.org/wiki/Secret_decoder_ring https://en.wikipedia.org/wiki/Secret_decoder_ring
- orenmazor 13y agoThis is so cool. Well Done!
- andrewcooke 13y agoit's not steganography. the messages have little dots in them - they are very distinctive. it's trivial to find anyone using this. why not use a typo instead? switch the letter at that point to another letter (could be a different one for each sentence). use fuzzy matching (eg locality sensitive hash) to find the correct sentence. and construct the dictionary from previous tweets rather than books. then tweets look like tweets.
- dpapathanasiou 13y agoGood idea about using typos instead of a middle dot marker (TBH, it's not as unobtrusive as I would like, so perhaps it's better to rethink that part of the system).
- _sh 13y agoInstead of using a corpus, why not select tweets from a list of followers and re-tweet them? This would make your encoded messages more like a natural twitter stream. You could curate followers lists to be themed around a subject (tech, gardening) to make them more naturally align with the rest of your twitter stream. Edit: oops, this idea was already mentioned by akkatirk elsewhere in this thread.
- drakaal 13y agoThe big issue I see is that Twitter detects and delete gibberish as spam. So at best case your posts randomly get filtered when you use this. At worst case after posting a bunch of gibberish Twitter bans your account.
- cmsmith 13y agoCheck the bottom of the post. The tweets themselves are actual sentences from a book, not gibberish.
- drakaal 13y agoHow do you think Twitter tells the difference between a Bot and a human? I get that they are sentences, but they aren't contextually relevant, they don't look like tweets, they look like spam. If you randomly start posting "Four score and seven years ago" and the rest of the speech out of order you are going to get flagged. I used to build tweet spam bots, I am very familiar with how they get detected.
- omni 13y agoPut quotes around the whole thing and Twitter will think you're just another 13 year old girl who thinks she's clever by incessantly quoting literature.
- bolder88 13y ago> I used to build tweet spam bots, I am very familiar with how they get detected. I would have thought that the content of a tweet is quite low down on their detection list. IP address, user account, frequency of tweets etc would be much higher.
- dpapathanasiou 13y agoI wouldn't use this with a bot account, since, as you say, it would become easy to detect those as anomalies. Instead, I was thinking that you might intersperse these in between your normal tweets, in coordination with the people you're communicating with.
- alexharris66 13y agoCool. Much better than my secret twitter message project: http://www.twhatever.com/tweets http://www.twhatever.com/tweets :)
- danieldk 13y agoCool! One other fun approach may be to use syntactic transformation (topicalization, middle field ordering, etc.) or lexical variation (e.g. through synonyms): https://www.cerias.purdue.edu/assets/pdf/bibtex_archive/PSI000441.pdf https://www.cerias.purdue.edu/assets/pdf/bibtex_archive/PSI0... The advantage of such an approach is that you can use coherent text/messages.
- dpapathanasiou 13y agoThanks, I'll look into those suggestions, especially since I'm not really happy about using the middle dot (it's really not unobtrusive, and the entire system would work better if I didn't use it).
- gpsarakis 13y agoNice project. Considering a stream of tweets how can you find the beginning and the end of a sentence/message?
- dpapathanasiou 13y agoΕυχαριστώ! There's no obvious way of telling where a "secret" sequence would begin and end. For now, it might be best left as a coordination issue, similar to the choice of corpus: e.g., you know that you'll be tweeting secretly n times a day, at these specific times only, etc.
- cbr 13y agoFor this to be secure (one-time-pad) you can't reuse the corpus. That's a big enough pain that I doubt people will actually do it. Which means you can start decoding their tweets once you collect enough.
- dpapathanasiou 13y agoTrue, you shouldn't use the same corpus more than once, so there's always going to be a coordination issue between the sender and recipients.
- rw 13y agoI wrote a textual steganography library and CLI in 2011, called Plainsight: https://github.com/rw/plainsight https://github.com/rw/plainsight Additionally, @workmajj and I wrote TweetFS using Plainsight. It lets you recursively pack up directories and post them as an encoded linked list of Tweets to Twitter: https://github.com/rw/tweetfs https://github.com/rw/tweetfs I presented Plainsight at Hack'n'Tell NYC in 2011 and a video was recorded: http://bit.ly/pecGgW http://bit.ly/pecGgW Plainsight uses each byte of the input message to generate tokens. Bits are used to decide how to traverse the token tree, weighted by frequency. The drawbacks are 1) verbosity and 2) incorrect grammar. One of the lessons of writing Plainsight is that spam can be used to contain secret messages. Send enough gibberish to enough people, with your intended recipient included, and you'll look like a spammer--not a spy. I also wrote a fuzzing tool, called Shag, to find edge cases, e.g. for single-byte inputs: https://github.com/rw/shag/blob/master/shag.rb https://github.com/rw/shag/blob/master/shag.rb -- Example 1 (regular text) Type your message to encode: echo 'Meet at Union Square at noon. The password is FuriousGreen.' > cleartext Then, pipe it through Plainsight: cat cleartext | plainsight -m encipher -f sherlock.txt > ciphertext The output will be Doyle-esque gibberish: cat ciphertext | fold -s which was the case, of a light. And, his hand. "BALLARAT." only applicant?" decline be walking we do, the point of the little man in a strange, her husband's hand, going said road, path but you do know what I have heard of you, I found myself to get away from home and for the ventilator little cold night, and I he had left my friend Sherlock of our visitor and he had an idea was not to abuse step I of you, I knew what I was then the first signs it is the daughter, at least a fellow-countryman. had come. as I have already explained, the garden. what you can see a of importance. your hair. a picture upon of the money which had brought a you have a little good deal in way: out to my wife and hurry." made your hair. a charge me a series events, and excuse no sign his note-book has come away and in my old Sherlock was already down to do with the twisted Now, decipher that ciphertext: cat ciphertext | plainsight -m decipher -f sherlock.txt > deciphered cat deciphered Meet at Union Square at noon. The password is FuriousGreen. -- Example 2 (binary data) $ dd if=/dev/urandom of=/dev/stdout bs=1 count=10 | plainsight -m encipher -f 1984.txt 10+0 records in 10+0 records out 10 bytes (10 B) copied, 9e-05 s, 111 kB/s Adding models: Model: 1984.txt added in 0.89s (context == 2) input is "<stdin>", output is "<stdout>" enciphering: 100%|#####################################################################################################################################################################|474.67 B/s | Time: 0:00:00 which is a war is real, the proles used mind on the telescreen. He could see through all right to. You have read what said. 'Yes,' only in the Ministry
- brey 13y agoSteganography conceals the existence of the message, not just the contents. if David Miranda gets stopped at Heathrow and: On the following morning, the gener·al requested permission to return the emperor's visit, by waiting on him in his palace. A pitched battle follow·ed. But the pride of Iztapalapan, on which its lord had freely l·avished his care and his revenues, was its celebrated gardens. ... is in his twitter account, it's in no way plausible that they're just innocuous tweets, and he can be compelled to reveal the secret. A true steganographic message would have looked indistiguishable from any other tweet that he would have made normally. this is a cute system, but it's not steganography.
- dpapathanasiou 13y agoThe output is a function of the corpus. So if Miranda doesn't usually tweet about the history of Mexico, he can pick other texts (written by him or others) which would sound more plausible as something he might normally tweet. Having said that, the middle dot is not as unobtrusive as I would like, so perhaps it's better to rethink that part of the system, using some of the other suggestions in this thread.
- brey 13y agoeven ignoring the middle dot, just picking a more suitable corpus for that person isn't necessarily going to make this technique look innocuous - it's still a collection of excerpts taken from what looks like random positions within a document. it looks suspicious. you could imagine a system which uses entirely normal and habitual tweets, but encodes information in choices of synonyms used in the text, or whether or not punctuation was used in certain places, or the timing of the tweet's publication. lower bitrates, but plausibly deniable as to the message's existence.
- dpapathanasiou 13y agoI would posit that a stream of non-sequitir tweets is not necessarily suspicious (depending on the person/account in question, of course). The classic steganography methods you're describing may appear less obvious (for lack of a better term), but they're also easier to break once the pattern is discovered.
- netman21 13y agoOr you could use https://scrambls.com/ https://scrambls.com/ which uses strong crypto and works for facebook or any site. Keeping in mind that any short message protocol is vulnerable to cryptanalysis.
- timr 13y agoAt Twitter Peak Hype, when journalists were writing silly things like: "Twitter is nothing less than a new internet protocol!", I had a perverse fantasy of implementing TCP/T(weet). If someone were to do this, it would effectively subsume all further "I implemented $X on Twitter" posts. Sort of like showing that a language is Turing complete.
- dpapathanasiou 13y agoIsn't that what app.net is supposed to be?
- hhm 13y agoVery nice! I worked on a similar steganographic system (not for tweets though) that you can find here: https://github.com/hmoraldo/markovTextStego https://github.com/hmoraldo/markovTextStego There you'll find both the source code and a link to a paper explaining how it works and how it differs from other approaches.
- ctz 13y agoThe amusing thing about sending ciphertexts over twitter compared to english text is that you can actually fit in more information, assuming you do the encryption and ciphertext encoding right. That's because twitter transports 140 unicode code points. (This has nothing to do with steganography, but seems relevant nonetheless. )
- bzalasky 13y agoSo, horse_ebooks could have an ulterior motive?