0

The point of steganography is to hide useful messages in other messages so that no one suspects the message to contain secrets and tries to crack the message.

The catch is that the recipient should know what that such a message is to be expected and how to decrypt it (find the hidden message).

Steganography helps protect the message while in transit.

In today's social networks and sharing websites like Reddit and Facebook, communication between two people is easily possible with private messages. These private messages are sent encrypted anyway and steganography isn't really the most reliable way to proceed with.

So how can steganography be really useful?

Is there a use-case where one posts a "steganographed" message on Reddit sub-reddit or a Facebook wall?

closed as too broad by TildalWave, Xander, Bob Brown, Jens Erat, RoraΖ Feb 9 '15 at 12:57

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    The NSA has access to Facebook. That very likely includes private messages. Now if I had to hide things from the NSA I wouldn't be using FB in the first place, but it would be a reason for steganography. – S.L. Barth Feb 8 '15 at 12:12
  • 2
    This question is very confused. You seem to assert that Steganography is useful and not useful, and then want us to answer how it can be really useful. It's hard to ascertain what you are really asking. – schroeder Feb 8 '15 at 22:24
  • "Steganography helps protect the message while in transit." Hm... No. Really, no. – Stephane Feb 9 '15 at 10:29
  • @Stephane, why not? – learner Feb 9 '15 at 12:52
2

Steganography is used to hide messages in plain sight. This is useful to do exactly what you say, "so that no one suspects the message to contain secrets and tries to crack the message."

You suggest that private messages could be used, but that violates the use case for Steg: a private message means that it is known that 2 parties communicated and is potentially interesting.

So, then, using your own words, the use case is simple: you can send a communication that is not known to be a message to someone and have that communication channel itself be unknown to 3rd parties.

  • This requires social engineering in order to work, i.e. the transmission to third-party intended recipient would be dependent on the availability of carrier, lack of suspicion by carrier, and a method of impressing third carrier with motive. To me this raises concern on multiple levels regarding legality of content in message and ethics related to 'tricking' the first recipient into spreading the steg. file. This appears commonly as a tactic to infect machines with malware as opposed to communicating securely. – user67862 Feb 9 '15 at 0:28
  • none of this comment makes sense - social engineering isn't required at all – schroeder Feb 9 '15 at 0:37
  • How will you get the person to transmit the message to a third party without them knowing they are? – user67862 Feb 9 '15 at 0:45
  • Facebook is designed to transmit messages .... – schroeder Feb 9 '15 at 0:48
  • 1
    No - there is only A, B, and Facebook. A posts publicly, B inspects the post for a hidden message. No one else needs to be involved. The message AND the channel is hidden from the public. This idea is known as a Dead Drop and has been used (in the pre-Internet world as well post-Internet) for legitimate spy communication. – schroeder Feb 9 '15 at 1:45
0

First and foremost, all facebook messages are maintained and are not deleted in the event that you delete your profile.

For steg. to be useful, multi-vector communication is necessary. For instance, Alice wants Bob to decrypt a message in picture P. Therefore Alice messages Bob through Facebook IM that P has been delivered privately to Bob's facebook inbox. This is not secure. Facebook maintains the right to analyze such communications for the purpose of security as well as marketing. If the message that P has been delivered is sent through a message on a different social network, the threat of it being discovered is still present, though it would take LEA's longer to track and find P.

For security practitioners and business operators I can see the need to use obfuscation techniques such as steg., but would never recommend it be handled in the way you've framed:

I would never send the message through any social media, and would not use an open form of communicating that P existed or had been delivered. As I've said, multi-vector approaches such as a direct phone call, encrypted email containing the steg. and a foreknowledge of delivery and key would be necessary.

  • "LEA"? what is that? – schroeder Feb 9 '15 at 0:39
  • Law Enforcement Agency – user67862 Feb 9 '15 at 0:45
  • I think you've missed an idea here. If Alice and Bob know that Alice will typically send messages via Facebook using publicly posted images, then any photo posted by Alice will be inspected by Bob for messages. It is not required that each message be specifically identified by Alice. This way, you have a totally out-of-band communication that steg is used. – schroeder Feb 9 '15 at 0:47
  • I would not use the same platform for continuous transmission of sensitive info....even with using steg. Also, that would not be an efficient way for steg. to be used given that all messages from Alice would require attention. – user67862 Feb 9 '15 at 0:49
0

The only use case for steganographic in a open channel such as facebook or reddit(by extention imgur) would be to hide data in posted images as a convert channel. Hidden messages in clear text is not posible because of web application firewalls and other filtering strategies.

Even then that is not a good use of these sites since Facebook for example is actively monitored by Infragard/FBI, NSA, CIA, and other security industry agencies along with Facebook's own staff. Ones data there is never deleted and as of late Facebook is working hard to become the centrial identy database for the web thus eliminating anonymitity within its own network.

Reddit and chan sites are a better option but are still monitored as well. There is another method combining of going about it with PKI and Steganography but that is part of a b-sides presentation I'm working on so will not go into full details on an open forum until after its release.

-1

Stetanography is by design wrong approach as it's simply "security by obscurity". This is by all means insufficient for "proper security", but it still can help a lot.

I think stetanography still has it's place in delivering secure messages, but the messages hidden in the media should be definitely encrypted prior to hiding them. Stetanography is so uncommon technique that I would consider it's use very good step towards secure communication - but not in it's plain form.

M.

Not the answer you're looking for? Browse other questions tagged or ask your own question.