Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Entropy, a CLI that scans files to find high entropy lines (might be secrets)

github.com

Post reply on HN
Print view View original

11–20 of 141 posts

Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)

#11

Post by buildbot »

coppsilgold wrote: post #7

Note that in an adversarial setting this will only be effective against careless opponents. If you properly encode your secret it will have the entropy of its surroundings. For example you can hide a string of entropy (presumably something encrypted) in text as a biased output of an LLM. To recover it you would use the same LLM and measure deviations from next-token probabilities. This will also fool humans examining…

In general (for those unaware) this is called stenography. You can hide an image in the lower bits of another image for example too.

Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)

#13

Post by textninja »

coppsilgold wrote: post #7

Note that in an adversarial setting this will only be effective against careless opponents. If you properly encode your secret it will have the entropy of its surroundings. For example you can hide a string of entropy (presumably something encrypted) in text as a biased output of an LLM. To recover it you would use the same LLM and measure deviations from next-token probabilities. This will also fool humans examining…

The weights of the LLM become the private key (so it better be a pinned version of a model with open weights), and for most practical applications (i.e. unless you're willing to complicate your setup with fancy applied statistics and error correction) you'd have to use a temperature of 0 as baseline.

Then, having done all that, such steganography may be detectable using this very tool by encoding the difference between the LLM's prediction and ground truth, but searching for substrings with low entropy instead!

Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)

#14

Post by dragonwriter »

buildbot wrote: post #11
coppsilgold wrote: post #7

Note that in an adversarial setting this will only be effective against careless opponents. If you properly encode your secret it will have the entropy of its surroundings. For example you can hide a string of entropy (presumably something encrypted) in text as a biased output of an LLM. To recover it you would use the same LLM and measure deviations from next-token probabilities. This will also fool humans examining…

In general (for those unaware) this is called stenography. You can hide an image in the lower bits of another image for example too.

Steganography; stenography is completely different.

Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)

#15

Post by alexchantavy »

thsksbd wrote: post #6

This is very cool, but I have a thought - I see this as a last line of defense, and I am concerned that this would this give a false sense of security leading people to be more reckless with secrets.

The pie in the sky goal for any security org is to have a cred rotation process that is so smooth that you’re able to not worry about leaked creds because it’s so fast and easy to rotate them. If the rotation is automated and if it’s cheap and frictionless to do so, heck why not just rotate them multiple times a day.

Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)

#16

Post by __MatrixMan__ »

coppsilgold wrote: post #7

Note that in an adversarial setting this will only be effective against careless opponents. If you properly encode your secret it will have the entropy of its surroundings. For example you can hide a string of entropy (presumably something encrypted) in text as a biased output of an LLM. To recover it you would use the same LLM and measure deviations from next-token probabilities. This will also fool humans examining…

I imagine a social media site full of bots chatting about nonsense. Hidden in the nonsense are humans chatting about different nonsense. This way, server costs get paid for by advertisers, but its really only bots that see the ads anyway.

Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)

#17

Post by spullara »

__MatrixMan__ wrote: post #16
coppsilgold wrote: post #7

Note that in an adversarial setting this will only be effective against careless opponents. If you properly encode your secret it will have the entropy of its surroundings. For example you can hide a string of entropy (presumably something encrypted) in text as a biased output of an LLM. To recover it you would use the same LLM and measure deviations from next-token probabilities. This will also fool humans examining…

I imagine a social media site full of bots chatting about nonsense. Hidden in the nonsense are humans chatting about different nonsense. This way, server costs get paid for by advertisers, but its really only bots that see the ads anyway.

if the ads aren't effective people won't buy them

Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)

#18

Post by dools »

coppsilgold wrote: post #7

Note that in an adversarial setting this will only be effective against careless opponents. If you properly encode your secret it will have the entropy of its surroundings. For example you can hide a string of entropy (presumably something encrypted) in text as a biased output of an LLM. To recover it you would use the same LLM and measure deviations from next-token probabilities. This will also fool humans examining…

I think the opponent in the proposed use case for this tool is the gun you’re pointing at your foot, and this tool prevents you from pulling the trigger.

Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)

#19

Post by bongodongobob »

thsksbd wrote: post #6

This is very cool, but I have a thought - I see this as a last line of defense, and I am concerned that this would this give a false sense of security leading people to be more reckless with secrets.

No, it's a way to audit and see the modes that your security policy is failing. At least that's how I look at it.
Post reply on HN