Live data from Hacker News

Entropy, a CLI that scans files to find high entropy lines (might be secrets)

github.com

31–40 of 141 posts

Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)

#31

Earlier quoted context omitted.

What you described sounds like a very cool idea - LLM-driven text steganography, basically - but intentional obfuscation is not the problem this tool is trying to solve. To your point about secrets with entropy similar to the surrounding text, however, I wonder if this can pick up BIP39 Seed Phrases or if whole word entropy fades into the background.

The LLM adds no value here. Procedural generation in a loop until some fitness function (perhaps a frequency analysis metric) is satisfied.

The LLM is the fitness function.

Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)

#32

Note that in an adversarial setting this will only be effective against careless opponents. If you properly encode your secret it will have the entropy of its surroundings. For example you can hide a string of entropy (presumably something encrypted) in text as a biased output of an LLM. To recover it you would use the same LLM and measure deviations from next-token probabilities. This will also fool humans examining…

The weights of the LLM become the private key (so it better be a pinned version of a model with open weights), and for most practical applications (i.e. unless you're willing to complicate your setup with fancy applied statistics and error correction) you'd have to use a temperature of 0 as baseline. Then, having done all that, such steganography may be detectable using this very tool by encoding the difference betwe…

You seem to be making some weird assumptions?

Here's how I would do this:

Use some LLM, the weights need to be know to both parties in the communication.

Producing text with the LLM means repeatedly feeding the LLM with the text-so-far to produce a probability distribution for the next token. You then use a random number generator to pick a token from that distribution.

If you want to turn this into steganography, you first take your cleartext and encrypt it with any old encryption system. The resulting bistream should be random-looking, if your encryption ain't broken. Now you take the LLM-mechanism I described above, but instead of sampling via a random number generator, you use your ciphertext as the source of entropy. (You need to use something like arithmetic coding to convert between your uniformly random-looking bitstream and the heavily weighted choices you make to sample your LLM. See https://en.wikipedia.org/wiki/Arithmetic_coding)

Almost any temperature will work, as long as it is known to both sender and receiver. (The 'temperature' parameter can be used to change the distribution, but it's still effectively a probability distribution at the end. And that's all that's required.)

Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)

#33
post #28
post #27

I didn't know what entropy means in software, so here's the definition[0]: ---- Software entropy is a measure of the disorder or complexity of a software system. It is a natural tendency for software entropy to increase over time, as new features are added and the codebase becomes more complex. High entropy in software development means that the code is difficult to understand, maintain, and extend. It is often chara…

thanks for the search. this is textual entropy however, I am not sure if definition is applicable

Yes, it's not applicable. See https://en.wikipedia.org/wiki/Entropy_(information_theory) for something more applicable.

Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)

#34

Gonna have to explain how a “high entropy line” is calculated and why it might be secrets.

Entropy of information is basically how well it can be compressed. Random noise usually doesn't compress much at all and thus has high entropy, whereas written natural language can usually be compressed quite a bit. Since many passwords and tokens will be randomly generated or at least nonsense, looking for high entropy might pick up on them. This package seems to be measuring entropy by counting the occurrences of e…

Of course, this heuristic fails for weak passwords.

And it fails for passphrases like 'correct battery horse staple', which have a large enough total entropy to be good passwords, but have a low entropy per character.

Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)

#37
Is there any good posts about the use of entropy for tasks like that? I am wondering for quite some time of how do people actually use it and if it is any effective, but never actually got to investigating the problem myself.

First of all, how to define "entropy" for text is a bit unclear in the first place. Here it's as simple as `-Sum(x log(x))` where x = countOccurences(char) / len(text). And that raises a lot of questions about how good this actually works. How long string needs to be for this to work? Is there a ≈constant entropy for natural languages? Is there a better approach? I mean, it seems there must be: "obviously" "vorpal" must have lower "entropy" than "hJ6&:a". You and I both "know" that because 1) the latter "seems" to use much larger character set than natural language; 2) even if it didn't, the ordering of characters matters, the former just "sounds" like a real word, despite being made up by Carroll. Yet this "entropy" everybody seems to use has no idea about any of it. Both will have exactly the same "entropy". So, ok, maybe this does work good enough for yet-another-github-password-searcher. But is there anything better? Is there more meaningful metric of randomness for text?

Dozens of projects like this, everybody using "entropy" as if it's something obvious, but I've never seen a proper research on the subject.

Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)

#39
post #34

Earlier quoted context omitted.

Entropy of information is basically how well it can be compressed. Random noise usually doesn't compress much at all and thus has high entropy, whereas written natural language can usually be compressed quite a bit. Since many passwords and tokens will be randomly generated or at least nonsense, looking for high entropy might pick up on them. This package seems to be measuring entropy by counting the occurrences of e…

Of course, this heuristic fails for weak passwords. And it fails for passphrases like 'correct battery horse staple', which have a large enough total entropy to be good passwords, but have a low entropy per character.

4 diceware words is hardly a good password. It's ~51 bits of entropy, about the same as 8 random ascii symbols. It could be trivially cracked in less than an hour. Your average variable name assigned to the result of an object name with a method name called with a couple parameter names has much more entropy.

Re: Entropy, a CLI that scans files to find high entropy lines (might be secrets)

#40
post #34

Earlier quoted context omitted.

Of course, this heuristic fails for weak passwords. And it fails for passphrases like 'correct battery horse staple', which have a large enough total entropy to be good passwords, but have a low entropy per character.

4 diceware words is hardly a good password. It's ~51 bits of entropy, about the same as 8 random ascii symbols. It could be trivially cracked in less than an hour. Your average variable name assigned to the result of an object name with a method name called with a couple parameter names has much more entropy.

If you can crack a single 52bit password in an hour, that's suggesting you can crack a 40bit password every second. That's 1 trillion hashes per second.
Post reply on HN