[dragontamer]

Steganography is solidly a "security through obscurity" thing. Sure, we comp-sci people don't care about that, but spies do.

There was that Russian Spy who was transmitting data for years on her Facebook account through steganography pictures on her Facebook account.

http://www.technologyreview.com/view/419833/russian-spies-us...

The FBI didn't know about it until after she was caught. So believe it or not, Steganography _works_. If you're trying to hide the fact that you're a spy, encrypting all of your messages over TOR is a bad idea.

On the other hand, if you pretend to be a normal person and embed secret messages in your Facebook posts, you can be a spy for years and not get caught.

[pmoriarty]

"believe it or not, Steganography _works_"

I think one of the reasons stego works is because of the sheer amount of data being generated and shared in the modern world.

It's kind of a blessing and a curse for spy agencies. On the one hand, they love to collect data, and the more the better, since with more data to analyze, they can potentially learn more things. But the more data there is, the more computing power they have to throw at it to make sense of it.

So it's really not surprising that data can be hidden from spy agencies (possibly by relatively primitive means even), because they probably don't have the computing power (vast as their computing power is) to effectively run every possible detection algorithm and all their highly sophisticated (and probably computationally expensive) steganalysis software on so much data.

Videos, since they are so huge compared to other media files like text or audio, have always seemed like an ideal medium for stego to me. Of course, it's more difficult to preserve one's hidden data on sites like youtube that re-compress the videos that get uploaded to them, but any site that hosts original videos unmolested should be ripe for stego.

[SilasX]

>Steganography is solidly a "security through obscurity" thing.

Right, but that means it inherits all the problems of security by obscurity, like it breaking as soon as the public knows the technique, which they do now.

My other point was that this seems to be equivalent to traditional stego solutions but with a key size equal to the algorithm size.

(And I'm not sure why merely asking about they key size problem and obscurity problem hurt the discussion enough to get hammered so hard...)

[marcosdumay]

> Steganography is solidly a "security through obscurity" thing.

I never really understood why is it so.

Encrypted data must be indistinguishible from random, thus, if you replace any random projection of a file with your data, the result should be completely unrecognizable. It shouldn't really matter if your algorithms are public.

Is the problem that it's hard to get random projections from modern data? If so, why not use older formats?

[cjg]

People don't typically exchange randomised versions of their data.

[dllthomas]

I think "random projection", as used by the parent, can be things like "low bits of the pixels in this image". If the color depth provides greater resolution than the sensors, then you can expect to have some random data implicit in the image that it would be possible to change in ways that could be provably undetectable.

A tremendous caveat is that when we find ourselves shipping around lots of meaningless random bits, we often quickly reach for lossy compression that doesn't faithfully reproduce those bits, and that can break the scheme.

[AngrySkillzz]

Wow, that article is pretty bad.

[dragontamer]

Yeah... it was...

It was the first link on Google that seemed to mention the FBI / Russian Spy case. So take it as "proof the thing happened", but ignore the article.