Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If you want to dork with Facebook and see pictures of your neighbor's cat, that's fine, but in my opinion, it's not worth the risk (if any), and it's useless to want/expect meaningful security. I don't even know if seeing pictures of cats is a problem in Iran. :-)

If you want to communicate with other people securely, then, in my opinion, then everyone in that communications group needs to consider learning information security and operational security, and then applying it. It's not simple, it's not easy, but if you want to be secure, you're going to have to plan to be serious.



It's a catch 22 when it comes to repressive regimes. You've swapped keys and are communicating with all your friends on a perfectly secure network. Now you and your friends are in jail on charges of conspiracy.

The only solution I can think of is a false door method, where you send some fake communication over one channel and somehow hide the encrypted channel.


Image steganography? It's available to almost anyone, a plain-sight method with an expected amount of natural noise. If you use a small enough payload, it is essentially deniable and undetectable.


And the bonus is then you can still use your social network to look at pictures of cats!


>The only solution I can think of is a false door method, where you send some fake communication over one channel and somehow hide the encrypted channel.

That's steganography, and there are some open source programs for that. Steghide[1], for example, can hide encrypted data in JPEG images.

[1]: http://steghide.sourceforge.net/


An alternative to steganography is 'chaffing and winnowing'. Ronald Rivest describes the technique in this paper: http://people.csail.mit.edu/rivest/Chaffing.txt


Stego's actually great here. Stay on the insecure or 'fake-secure' (ala this MITM) links and put out a cover story for yourself. Then communicate for realsies on stego.

And.. if your cover gives reason for you to put out a lot of data in forms that are easily stego'd, you're in good shape.


I assure you, I don't pretend to have a guide to security in this sort of situation. But I am utterly certain that you have to take it seriously.

edit: You refer to something that is either steganography or something in that class of communication.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: