[bilekas]

> Tl;dr: Stenography just helps with obfuscation as long as no-one is looking for it. The second someone looks it'll fail,

That was my 'playground' conclusion too. It has to be clandestine to work.

> In practice, both parties need to agree on the location

That is still a key by another term..

> but you'd get the same security by just encrypting everything with the same password.

Right, it feels like just a level of obfuscation at that point. Ironically what I was interested in was encypted payloads that could be `called` when loaded. Involves a ridiculous amount of 0days, but the idea of opening an image and having your browser/os touched.. It's interesting given today's lifestyle.