Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DissidentX – Censorship resistance tool by Bram Cohen

github.com

Post reply on HN
Print view View original

41–50 of 93 posts

Re: DissidentX – Censorship resistance tool by Bram Cohen

#41

Post by bramcohen »

mcphilip wrote: post #11
tsaoutourpants wrote: post #5

Stenography is one of the NSA's worst nightmares. Encrypted strings sent over the Internet they know are encrypted, and often know what algorithm and key length. But the fact that any image can contain an encrypted message, and there's know way to know whether or not something exists within, scares the shit out of them. So, good work.

Interestingly enough, stenography was already being decried pre 9/11 as a tool used by terrorists [1]: >"Uncrackable encryption is allowing terrorists — Hamas, Hezbollah, al-Qaida and others — to communicate about their criminal intentions without fear of outside intrusion," FBI Director Louis Freeh said last March during closed-door testimony on terrorism before a Senate panel. "They're thwarting the efforts of law…

There was a CIA contractor who outright defrauded them claiming that he had tools which were detecting steganographic messages used by terrorists on the internet. He didn't get prosecuted because they were too embarrassed to admit that they'd been completely bamboozled.

Re: DissidentX – Censorship resistance tool by Bram Cohen

#42

Post by sillysaurus2 »

bramcohen wrote: post #40
sillysaurus2 wrote: post #21

Judging by the claims and the code, this is a tool created by someone who hasn't read any prior research about steganography. If you trust this, don't be surprised when law enforcement detects that you're using it. I'm surprised to see someone of Bram Cohen's caliber releasing something like this. No one has any business coding security tools unless they've taken time to read forensics whitepapers to look for reasons…

This is a framework for steganographic schemes, not a specific steganographic scheme. The specific ones thrown in are just for demonstration purposes. The versatility of this approach is a major step forward in defeating statistical detection schemes. You of course don't know this, because you haven't read through the page and figured out what the code does.

You of course don't know this, because you haven't read through the page and figured out what the code does.

Let's not get personal. I only mentioned your name because it was in the headline, not to bully anyone.

I know this is a framework. But the problem with stego is that as soon as you release your code, you make it almost trivial for law enforcement to detect that you're using stego. It's a catch-22: you want people using the code, but you don't want law enforcement knowing what code you're using, because then they can just use the same code to detect that you're using stego, which defeats the purpose of stego.

This isn't theoretical. Each time someone releases a new stego tool out into the wild, forensics companies add it to their own frameworks for detecting stego.

Let me be clear: I want you to succeed, and I think it's a great thing that so much effort is being put into developing these sorts of tools. But you have to say something like "Don't use this tool yet! It's not ready for production!" ... The way it was presented here made it sound as if it's ready to be used, but anyone who uses it in its current state will be swiftly detected by law enforcement.

Let's put it another way. Do you think the 120 people who upvoted this did so because they understood this is "just a framework / reference," or because they were hopeful this actually works? It's not fair to them not to include a disclaimer saying this shouldn't be used. The way the README is written makes it sound like you're encouraging people to use it, even though it's not intended to be used.

Re: DissidentX – Censorship resistance tool by Bram Cohen

#43

Post by Crito »

simbolit wrote: post #36
blueblob wrote: post #26

I love the question in the FAQ: Q. Why can't it be given more than two alternates for one position to encode more information? A. Because of math. See Explanation.txt for a bit more detail. Because of math hilarious

i was actually thinking that the "of" was superfluous. since reading [0] on hn (discussion: [1]) i am more and more seeing the use of "because" without preposition. so i was expecting "Q. Why can't it be given more than two alternates for one position to encode more information? A. Because math. See Explanation.txt for a bit more detail." [0] http://www.theatlantic.com/technology/archive/2013/11/englis... [1] https:/…

The use of the word "math" (and "science") seems to be changing as well, I think this usage is an example of an unconventional use of the word "math"( rather than an example of the new use of "because"*.

Re: DissidentX – Censorship resistance tool by Bram Cohen

#44

Post by bramcohen »

sillysaurus2 wrote: post #42
bramcohen wrote: post #40

Earlier quoted context omitted.

This is a framework for steganographic schemes, not a specific steganographic scheme. The specific ones thrown in are just for demonstration purposes. The versatility of this approach is a major step forward in defeating statistical detection schemes. You of course don't know this, because you haven't read through the page and figured out what the code does.

You of course don't know this, because you haven't read through the page and figured out what the code does. Let's not get personal. I only mentioned your name because it was in the headline, not to bully anyone. I know this is a framework. But the problem with stego is that as soon as you release your code, you make it almost trivial for law enforcement to detect that you're using stego. It's a catch-22: you want pe…

This tool allows for the specifics of how the encoding is done to be changed without the decoding algorithm needing to be changed ever, so yes in fact it is ready to be used, although better encoders are both easy to write and welcome.

Re: DissidentX – Censorship resistance tool by Bram Cohen

#46

Post by DigitalJack »

phil_2-0 wrote: post #38
mcphilip wrote: post #11

Earlier quoted context omitted.

Interestingly enough, stenography was already being decried pre 9/11 as a tool used by terrorists [1]: >"Uncrackable encryption is allowing terrorists — Hamas, Hezbollah, al-Qaida and others — to communicate about their criminal intentions without fear of outside intrusion," FBI Director Louis Freeh said last March during closed-door testimony on terrorism before a Senate panel. "They're thwarting the efforts of law…

> "Uncrackable encryption is allowing terrorists — Hamas, Hezbollah, al-Qaida and others — to communicate about their criminal intentions without fear of outside intrusion, You succeeded to put 3 different ethnic groups - I should say 2, the last one being an US product - in the same bag and doing then, a misleading association, fucking idiot!

It was a quote.

Re: DissidentX – Censorship resistance tool by Bram Cohen

#47

Post by sillysaurus2 »

bramcohen wrote: post #44
sillysaurus2 wrote: post #42

Earlier quoted context omitted.

You of course don't know this, because you haven't read through the page and figured out what the code does. Let's not get personal. I only mentioned your name because it was in the headline, not to bully anyone. I know this is a framework. But the problem with stego is that as soon as you release your code, you make it almost trivial for law enforcement to detect that you're using stego. It's a catch-22: you want pe…

This tool allows for the specifics of how the encoding is done to be changed without the decoding algorithm needing to be changed ever, so yes in fact it is ready to be used, although better encoders are both easy to write and welcome.

There are two possibilities. Either you've created a tool which enables people to covertly send messages without being detected, which every publicly-released stego tool thus far has failed to do, or you haven't.

Have you spent much time researching why current stego tools have all failed? The way you're endorsing this makes it sound like you haven't, and you're putting people in danger by pretending like law enforcement is incompetent.

Remember, law enforcement somehow managed to acquire an image of Silk Road's server, even though they were running it as a Tor Hidden Service, and they also managed to recover >100k bitcoins from DPR. All of this was done through forensics. Are you claiming that this tool is secure against such an adversary?

Hopefully someone will write a program called "DissidentXDetector" before law enforcement does. The myth that this generates undetectable messages needs to be debunked before people start trusting this.

Re: DissidentX – Censorship resistance tool by Bram Cohen

#48

Post by yid »

stuartcw wrote: post #14

Here's another fun steganographic tool: http://www.spammimic.com Hide messages in SPAM Text: Dear Decision maker , We know you are interested in receiving amazing intelligence . This is a one time mailing there is no need to request removal if you won't want any more . This mail is being sent in compliance with Senate bill 1625 ; Title 4 ; Section 302 . THIS IS NOT MULTI-LEVEL MARKETING ! Why work for somebody else w…

That is actually remarkably clever. Spam would indeed seem to be an excellent vector for sending hidden messages!

Re: DissidentX – Censorship resistance tool by Bram Cohen

#49

Post by Gnewt »

DanBC wrote: post #23
tsaoutourpants wrote: post #12

Earlier quoted context omitted.

I don't see how it would be terribly difficult to undetectably (without key) hide a few bytes of data in the least significant bits of a .jpg. There are likely trillions of images available on the Internet. I would imagine less than 0.001% of them have a hidden message. This increases the "haystack" so drastically for the NSA that, even if 100x as many people started using it, it's still a big-ass haystack.

This is one of the worst, easiest to detect, form of steganography. Publishers like Springer Verlag have many papers and books about detecting that type of steganography. While analysis (breaking) of steganography is long lived there hasn't been much work on creating new better forms. Just as things like PGP are still hard for regular people to use, and there's no real encrypted chat, there's not much in the way of s…

> and there's no real encrypted chat

What about OTP? One of the easiest things to set up and use imo, users just need to know to exchange key fingerprints over a third party medium (in person being the foolproof way).

Re: DissidentX – Censorship resistance tool by Bram Cohen

#50

Post by skunkworks »

sillysaurus2 wrote: post #42
bramcohen wrote: post #40

Earlier quoted context omitted.

This is a framework for steganographic schemes, not a specific steganographic scheme. The specific ones thrown in are just for demonstration purposes. The versatility of this approach is a major step forward in defeating statistical detection schemes. You of course don't know this, because you haven't read through the page and figured out what the code does.

You of course don't know this, because you haven't read through the page and figured out what the code does. Let's not get personal. I only mentioned your name because it was in the headline, not to bully anyone. I know this is a framework. But the problem with stego is that as soon as you release your code, you make it almost trivial for law enforcement to detect that you're using stego. It's a catch-22: you want pe…

There's great irony in you saying

> Let's not get personal.

right after saying

> I'm surprised to see someone of Bram Cohen's caliber releasing something like this.

Post reply on HN