Schneier made an interesting point at his talk at DEFCON last year. He suggested people use encryption from the big players, rather than more niche crypto products. He said he thought the NSA etc. monitor users of those niche software closely, essentially getting lots of metadata about them. He suggested "hiding" in the mass of other people using big player products.
Maybe the NSA wants terrorists to switch, since it would make them stand out from the crowd, creating a much smaller pool of people (terrorists and crypto geeks) to watch.
Sounds like the best solution is to use the niche encryption software to encrypt your data, then wrap it up in encryption by the big players, so you keep your everyday activity under wraps, but if they can break the big-player encryption, you have another layer of protection.
The best solution is probably to communicate via encrypted stetanography in open channels. For example a Twitter account posting a bunch of cat pics with (encrypted) messages encoded in them. This way your first layer of protection is the steganography (nobody knows the message even exists), and the second layer is the encryption.
I've got a side project about 10% complete that's a "stegonographic social overlay network". Fully client side JS steganographic encoding of images that are then uploaded to a choice of social media sites, and then subscribed to like RSS feeds. I think it's a cool concept.
Maybe, but how hard is it to derive suspension of stenography in an image for some useful level of confidence (e.g 20%, 50%, 75%)? Not crack it, but know that there's perhaps something up?
Surely, just knowing which accounts are posting "suspicious" communications is valuable enough in and of itself.
Every picture contains some amount of noise. It should at least in theory be equivalent to the Halting problem to decide whether this noise was generated by an algorithm or truly random.
But there's a lot of practical issues here. If you just add noise then it may raise suspicion merely by there being more noise than expected. So you may need to "move the existing noise around" or remove the existing noise which gets more problematic to do without leaving artifacts. And of course most of the noise may actually be following some patterns that means that the added/substituted noise must also correctly follow as not not raise suspicion.
Couldn't you in theory solve it by using high quality originals and manipulate the compression algorithm to introduce controlled noise that then decodes to your message? That way you can make the noise look more natural than with approaches like modifying existing compressed files.
Exactly. I don't know enough about the topic personally, but I'm genuinely curious if stenography is detectable enough to provide a viable list of targets.
This [0] research paper sounds relevant to your "stegonographic social overlay network."
[0] F. Beato, I. Ion, S. Capkun, M. Langheinrich, and B. P. (2013). For Some Eyes Only: Protecting Online Information Sharing. In ACM Conference on Data and Application Security and Privacy.
Maybe the NSA wants terrorists to switch, since it would make them stand out from the crowd, creating a much smaller pool of people (terrorists and crypto geeks) to watch.