Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I'm envisioning a piece of software that lets you IM folks, but with the messages steganographically embedded in emoticons and the cleartext messages autogenerated.


The more different types of traffic that messages could be hidden in, the better.

But, personally, I think the best place to hide them right now is video streams.

The thing about steganography is that the smaller your hidden message is and the larger the data it's hiding in is, the less of a chance there is of it being detected, and also the greater the cost of such detection will be.

Think of it this way:

How effective you are at hiding your message, and the cost of hostile detection are proportional to:

        size of covertext
  --------------------------
     size of hidden message
In my opinion, the ideal medium for two-way, realtime steganographic communication would be something like Skype, where large, bidirectional video streams are used. It might not be too hard to hack up some webcam filter that injects hidden messages in to the outgoing videostream and another filter to decode messages from the incoming videostream.

For one-way communication (or even two-way, delayed communication) any of the video hosting services like Youtube or Vimeo would be great. This should be even easier to implement than the Skype filters I describe above, as the processing can be done offline at your own leisure.

If using steganography to hide information in these videostreams becomes common, the cost to snoopers trying to find messages in them will become simply gigantic. And those costs will only increase as videostream sizes dramatically increase as they inevitably advance to offering higher resolutions (in the short-term), and even 3D-video (in the long-term).

An extra tip, if you're going to try something like this, is to make sure to use crappy/defective webcams that naturally inject noise in to the videostream anyway, and maybe film whatever you're filming on a nicely chaotic background like a closeup of trees billowing in the wind, ocean waves crashing on the shore, etc... that should hopefully provide plenty of chaos for your message to hide in.


This is silly. You can programatically detect e.g. anomalous keyframes from traffic today. Anything you do to try and embed messages in any rich media format (audio, lossy images, video, &c) can be reversed and turned into a filter. The filters won't even need to be accurate; they'll baseline, wait for you to trip a threshold, and then send people to your door to collect your machine.

I'm particularly amused by the comment about using complicated images of ocean waves and trees, as if computers were just mechanical humans trying to make sense of the shapes in the picture.


Two videos, X and Y, are uploaded to youtube.

X is a video of a completely featureless white screen.

Y is a video of a jungle canopy in the midst of a storm.

At some point in both videos, one pixel changes color slightly. Which video do you think it will be easier to spot the change in?

Of course, the amount of information that can be transmitted in the color change of one pixel is ridiculously small, so in a real life example more pixels (or perhaps some other data in the video) would need to be used to embed the message, but the video size can grow along with the size of the hidden message.

As for "anomaly detection", the thresholds at which such detectors function have to be tuned in such a way that they don't give too many false positives to make them useless.

And they're not magic. They can only detect certain types of anomalies, not any an all past or future steganographic techniques that could conceivably be used to hide the message.

Steganographic techniques can and have been designed to mimic expected statistical profiles. Take a look, for instance, at Peter Wayner's work on Mimic Functions:

http://en.wikipedia.org/wiki/Mimic_function

The other thing I should note is that even if it is (theoretically) possible to detect a message hidden via steganography, the cost of doing so goes up as the amount of data the message is hidden in increases.

Even detecting a message hidden with even the simplest steganographic technique will be much higher than detecting the use of bare encryption, which is already out in the open.

So widespread use of steganography in large datastreams like youtube videos and Skype will create a huge computational burden on the snoopers attempting steganalysis.


Steganalysis doesn't work by noticing a pixel gone awry in a video of a storm. Your notion of how this works seems drawn from movie plots, like the guys who sneak past motion detectors by moving real, real slow. Also, "the contributing editor of the Infoworld Test Labs and author of the Morgan Kaufman book _Disappearing Cryptography_, as summarized by Wikipedia" loses to academic crypto researchers. Sorry.


Come back when you have such a peer reviewed algorithm actually implemented in software. Until then you're just talking about a "sufficiently advanced compiler."




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: