DissidentX – Censorship resistance tool by Bram Cohen • Hacker News Board

Re: DissidentX – Censorship resistance tool by Bram Cohen

#11

Post by mcphilip » Tue, Dec 03, 2013, 9:56 PM UTC

tsaoutourpants wrote: post #5

Stenography is one of the NSA's worst nightmares. Encrypted strings sent over the Internet they know are encrypted, and often know what algorithm and key length. But the fact that any image can contain an encrypted message, and there's know way to know whether or not something exists within, scares the shit out of them. So, good work.

Interestingly enough, stenography was already being decried pre 9/11 as a tool used by terrorists [1]:

>"Uncrackable encryption is allowing terrorists — Hamas, Hezbollah, al-Qaida and others — to communicate about their criminal intentions without fear of outside intrusion," FBI Director Louis Freeh said last March during closed-door testimony on terrorism before a Senate panel. "They're thwarting the efforts of law enforcement to detect, prevent and investigate illegal activities."

So law enforcement is fine with encryption so long as it's crackable...

[1]http://usatoday30.usatoday.com/tech/news/2001-02-05-binladen...

Re: DissidentX – Censorship resistance tool by Bram Cohen

#12

Post by tsaoutourpants » Tue, Dec 03, 2013, 10:01 PM UTC

MichaelGG wrote: post #9

tsaoutourpants wrote: post #5

Stenography is one of the NSA's worst nightmares. Encrypted strings sent over the Internet they know are encrypted, and often know what algorithm and key length. But the fact that any image can contain an encrypted message, and there's know way to know whether or not something exists within, scares the shit out of them. So, good work.

I was under the impression that undetectable steganography was extremely difficult. If commonplace steganography was widespread, no doubt they'd write analyzers to determine what things might be hiding data. On top of that, if steganography becomes widespread, it's likely the protocol will be a common one adopted by plenty of people. At that point, it reduces to encryption, does it not?

I don't see how it would be terribly difficult to undetectably (without key) hide a few bytes of data in the least significant bits of a .jpg.

There are likely trillions of images available on the Internet. I would imagine less than 0.001% of them have a hidden message. This increases the "haystack" so drastically for the NSA that, even if 100x as many people started using it, it's still a big-ass haystack.

Re: DissidentX – Censorship resistance tool by Bram Cohen

#13

Post by dmix » Tue, Dec 03, 2013, 10:03 PM UTC

mcphilip wrote: post #11

tsaoutourpants wrote: post #5

Stenography is one of the NSA's worst nightmares. Encrypted strings sent over the Internet they know are encrypted, and often know what algorithm and key length. But the fact that any image can contain an encrypted message, and there's know way to know whether or not something exists within, scares the shit out of them. So, good work.

Interestingly enough, stenography was already being decried pre 9/11 as a tool used by terrorists [1]: >"Uncrackable encryption is allowing terrorists — Hamas, Hezbollah, al-Qaida and others — to communicate about their criminal intentions without fear of outside intrusion," FBI Director Louis Freeh said last March during closed-door testimony on terrorism before a Senate panel. "They're thwarting the efforts of law…

The consensus in the infosec community seems to be that most (real) Islamic terrorists haven't been using email or cellphones since ~2003. So any mass-surveillance/SIGINT sales pitch about catching terrorists is mostly bullshit. If they do catch anyone, they are likely not the type of people who could have accomplished anything. It seems to be much more useful for catching other nation-state intelligence spies at work or catching aloof criminals.

Re: DissidentX – Censorship resistance tool by Bram Cohen

#14

Post by stuartcw » Tue, Dec 03, 2013, 10:04 PM UTC

Here's another fun steganographic tool: http://www.spammimic.com

Hide messages in SPAM Text:

Dear Decision maker , We know you are interested in receiving amazing intelligence . This is a one time mailing there is no need to request removal if you won't want any more . This mail is being sent in compliance with Senate bill 1625 ; Title 4 ; Section 302 . THIS IS NOT MULTI-LEVEL MARKETING ! Why work for somebody else when you can become rich as few as 33 days . Have you ever noticed people love convenience and more people than ever are surfing the web ! Well, now is your chance to capitalize on this ! WE will help YOU decrease perceived waiting time by 190% and increase customer response by 150% . You can begin at absolutely no cost to you . But don't believe us . Ms Ames of Washington tried us and says "I was skeptical but it worked for me" . We assure you that we operate within all applicable laws . We implore you - act now ! Sign up a friend and you get half off . God Bless !

Re: DissidentX – Censorship resistance tool by Bram Cohen

#15

Post by vezzy-fnord » Tue, Dec 03, 2013, 10:06 PM UTC

MichaelGG wrote: post #9

tsaoutourpants wrote: post #5

Stenography is one of the NSA's worst nightmares. Encrypted strings sent over the Internet they know are encrypted, and often know what algorithm and key length. But the fact that any image can contain an encrypted message, and there's know way to know whether or not something exists within, scares the shit out of them. So, good work.

I was under the impression that undetectable steganography was extremely difficult. If commonplace steganography was widespread, no doubt they'd write analyzers to determine what things might be hiding data. On top of that, if steganography becomes widespread, it's likely the protocol will be a common one adopted by plenty of people. At that point, it reduces to encryption, does it not?

It's true that many common forms of steganography (such as hiding information in the alpha channels of a given image) are easily detectable, and analyzers already exist, but in some aspects steganalysis is somewhat of an oxymoron, since the entire point of steganography is to conceal the fact that hidden information even exists in the first place.

I'm not sure exactly how you'd define a steganographic protocol. It's not quite as straightforward as cryptography, in fact it's yet again oxymoronic. Steganography (at least ideally) works somewhat like an archetypal spy's codebook. It sounds like everyday conversation to you, unless you're meant to know it's not, and that there's a hidden meaning. If you catch something off-guard, then the stego has failed.

Re: DissidentX – Censorship resistance tool by Bram Cohen

#16

Post by DanBC » Tue, Dec 03, 2013, 10:06 PM UTC

tsaoutourpants wrote: post #5

Stenography is one of the NSA's worst nightmares. Encrypted strings sent over the Internet they know are encrypted, and often know what algorithm and key length. But the fact that any image can contain an encrypted message, and there's know way to know whether or not something exists within, scares the shit out of them. So, good work.

Most steganography is trivially easy to detect.

Steganography that is implemented correctly then requires reasonable amounts of cover text, and small amounts of hidden text.

NSA fucking loves steganography because most of it is a toy implementation where someone hides text in the LSB of the bytes of a gif or jpeg. The ratio of cover:hidden text is terrible. And the implementer forgot to mention that it's just a toy and not to be used seriously.

The number of decently implemented steganography systems is small.

Re: DissidentX – Censorship resistance tool by Bram Cohen

#17

Post by MichaelGG » Tue, Dec 03, 2013, 10:09 PM UTC

tsaoutourpants wrote: post #12

MichaelGG wrote: post #9

Earlier quoted context omitted.

I was under the impression that undetectable steganography was extremely difficult. If commonplace steganography was widespread, no doubt they'd write analyzers to determine what things might be hiding data. On top of that, if steganography becomes widespread, it's likely the protocol will be a common one adopted by plenty of people. At that point, it reduces to encryption, does it not?

I don't see how it would be terribly difficult to undetectably (without key) hide a few bytes of data in the least significant bits of a .jpg. There are likely trillions of images available on the Internet. I would imagine less than 0.001% of them have a hidden message. This increases the "haystack" so drastically for the NSA that, even if 100x as many people started using it, it's still a big-ass haystack.

At some ratio of hidden data to visible data, I'm sure it can be undetectable. But transmitting reasonable amounts of data leaves a trace using LSB algorithms. Here's one paper. It shows the LSB part of the image, which leaves an obvious looking impression.

http://rahuldotgarg.appspot.com/data/steg.pdf

Re: DissidentX – Censorship resistance tool by Bram Cohen

#18

Post by swordswinger12 » Tue, Dec 03, 2013, 10:10 PM UTC

I feel like this is a good place to mention a similar project which aims to circumvent deep-packet inspection with some cool encoding techniques. It can even be used as a Tor plugin!

https://github.com/kpdyer/fteproxy https://fteproxy.org/

Re: DissidentX – Censorship resistance tool by Bram Cohen

#19

Post by jorgem » Tue, Dec 03, 2013, 10:11 PM UTC

dmix wrote: post #13

mcphilip wrote: post #11

Earlier quoted context omitted.

Interestingly enough, stenography was already being decried pre 9/11 as a tool used by terrorists [1]: >"Uncrackable encryption is allowing terrorists — Hamas, Hezbollah, al-Qaida and others — to communicate about their criminal intentions without fear of outside intrusion," FBI Director Louis Freeh said last March during closed-door testimony on terrorism before a Senate panel. "They're thwarting the efforts of law…

The consensus in the infosec community seems to be that most (real) Islamic terrorists haven't been using email or cellphones since ~2003. So any mass-surveillance/SIGINT sales pitch about catching terrorists is mostly bullshit. If they do catch anyone, they are likely not the type of people who could have accomplished anything. It seems to be much more useful for catching other nation-state intelligence spies at wor…

Interesting... source?

Re: DissidentX – Censorship resistance tool by Bram Cohen

#20

Post by dmix » Tue, Dec 03, 2013, 10:14 PM UTC

jorgem wrote: post #19

dmix wrote: post #13

Earlier quoted context omitted.

The consensus in the infosec community seems to be that most (real) Islamic terrorists haven't been using email or cellphones since ~2003. So any mass-surveillance/SIGINT sales pitch about catching terrorists is mostly bullshit. If they do catch anyone, they are likely not the type of people who could have accomplished anything. It seems to be much more useful for catching other nation-state intelligence spies at wor…

Interesting... source?

Here is one interesting discussion:

https://twitter.com/thegrugq/status/399352954060144640

The author has cited terrorists training manuals elsewhere on his blog, that are apparently available publicly online, dated from as early as 2003 with security guidelines to not use email or talk on cellphones.

TLDR: The adversary can easily stop using email/cellphones to discuss plans. Do they still use email/cellphones for other reasons? Sure most likely, as was shown in Zero Dark Thirty, but not in any meaningful way that can be usefully gleaned from a mass-surveillance approach. Therefore the large investment and privacy trade-offs to the greater society isn't worth it.