Comment by gnosis | Hacker News Reader

Comment by gnosis | Hacker News Reader

Parent Full thread

From Thomas' post:

"Get circumvention at all wrong and you achieve the opposite of what the tool is intended for: you put a big red flag on people breaking their local laws. ... Don't build circumvention tools."

That attitude is so wrongheaded I hardly know where to begin.

First of all, anyone who uses something like TOR in China has already put a huge (and very very obvious) red flag on their communications stream.

So, if those people are going to be trying to break through the firewall anyway, why should't they do so with the best tools available? Why shouldn't they try to hide their communication in a stream of innocuous traffic rather than obviously red-flagging it?

And why shouldn't concerned programmers write tools to make the hiding of such information more effective?

Look, many people are going to try to communicate even when they're forbidden from doing so, and they're going to try to circumvent censorship. So we can either try to make it easier for them, or harder. I'm on the side of making it easier.

Sure, some people are going to get caught despite using steganographic software. But I'm willing to bet a lot fewer of them will get caught than using bare encryption systems like TOR.

If you're going to put a big blinking red light on all your packets so that the largest, best-armed surveillance state in the world can collect and analyze them, I guess there's very little harm in waving rubber chickens over them too. Go ahead with the stego.

You might want to read Neils Provos' stegdetect stuff, first. The world needs more fun grad student projects, and you wouldn't want people to have to rehash the same stuff he broke 10 years ago.

Sure, steganography and steganalysis are in an arms race, just like encryption and cryptanalysis.

But if the existence of such an arms race doesn't stop someone from using encryption it shouldn't stop them from using steganography.

Of course, you need to be prudent about it. Use the most secure techniques available, and don't use methods you know have been broken.

Finally, know that you are taking a risk, that nothing is 100% foolproof, and the more powerful and determined your adversary the more of a risk you're taking.

The difference is that with cryptography the actors are nation states v. nation states. With steganography the actors are activists v. nation states.

Also, what makes you think activists have the technical expertise available to know what the "most secure techniques available" are and what methods have been broken?

"The difference is that with cryptography the actors are nation states v. nation states. With steganography the actors are activists v. nation states."

I don't know where you got the idea that nation states are the only ones who use cryptography. Plenty of activists, along with other non-state actors do so all the time.

Plenty of cryptography is also designed by individuals not in the service of any nation state (as far as we know, anyway). In fact, some argue that such encryption is more trustworthy than encryption developed by nation states themselves.

"Also, what makes you think activists have the technical expertise available to know what the "most secure techniques available" are and what methods have been broken?"

I can't speak for any and all activists. It's really up to them to acquire such expertise or get advice from people who have such expertise.

That said, the problem here is no different from figuring out which encryption to use. So your criticism applies equally to encryption as it does to steganography.

I don't know where you got the idea that nation states are the only ones who use cryptography. Plenty of activists, along with other non-state actors do so all the time.

We're not talking about users, we're talking about attackers and developers. Why would users have anything to do with our discussion?

Plenty of cryptography is also designed by individuals not in the service of any nation state (as far as we know, anyway). In fact, some argue that such encryption is more trustworthy than encryption developed by nation states themselves.

Developed by academics, but tested by both academics and the government. The testing is the thing that's actually important.

I can't speak for any and all activists. It's really up to them to acquire such expertise or get advice from people who have such expertise.

The point is that the technical expertise is not available. It's not up to them. It's not available. What you suggest they do is not possible.

That said, the problem here is no different from figuring out which encryption to use. So your criticism applies equally to encryption as it does to steganography.

Nope. Get back to me when we get government backed standards and recommendations for anonymity (hint: we have them for crypto).

"We're not talking about users, we're talking about attackers and developers. Why would users have anything to do with our discussion?"

Actually, in the message you responded to, I was specifically talking about users. I've been talking about users of crypto/stego all along!

They're the ones who take virtually all of the risk. The people who write the crypto/stego often aren't even in the same country, and they do their development in countries where crypto/stego are perfectly legal.

So I don't know why you started talking about developers all of a sudden.

However, I thought you might have switched subjects, so I specifically addressed crypto development in my second paragraph.

"Developed by academics, but tested by both academics and the government. The testing is the thing that's actually important."

That testing is only worthwhile if your threat model does not include the government itself, which has a vested interest in breaking all encryption, whether or not it has been "certified" by them.

"The point is that the technical expertise is not available. It's not up to them. It's not available. What you suggest they do is not possible."

How is it not available? There are plenty of people who design and analyze stego. There's your expertise.

"Get back to me when we get government backed standards and recommendations for anonymity (hint: we have them for crypto)."

Get back to me when that actually matters.

That testing is only worthwhile if your threat model does not include the government itself, which has a vested interest in breaking all encryption, whether or not it has been "certified" by them.

The government also has a vested intrest that the cryptography used by itself and its citizens be reasonably secure, else industrial espionage and other similar activities become trivial. Note that the NSA approved AES for the protection of Top Secret information. If you want to argue the NSA deliberately let the majority of classified information in the United States be protected by a flawed algorithm you're going to have to provide some proof.

How is it not available? There are plenty of people who design and analyze stego. There's your expertise.

The people that are good at building and designing crypto and stego (Are there any good stego systems? Doubt it.) systems are outside the paygrade of most companies, nevermind activists. The expertise is not available.

--

Your arguments are disconnected from reality and don't really have any particularly notable knowledge of this domain. This conversation has been a net loss, and judging by your average of ~2 karma per comment, other people seem to agree. I'll let you have the last word if you'd like it, but please refrain from wasting so much space in the future.

We're talking about individuals versus nation states. You're handwaving.

And your two-sentence reply that didn't specifically address a single point in my post is supposed to be some deep, thorough analysis?

Pot, meet kettle.

Despite this, I'll do you the kindness of actually addressing the point you made by giving you a big, "so what?"

Activists and dissidents often go up against nation states. That's the nature of the business. And they knowingly take risks to do so.

The question is, are they simply going to use bare encryption, thereby virtually guaranteeing to draw attention to themselves in a state like China? Or are they going to wrap their encrypted message in a layer of steganography, thus giving themselves at least a chance to avoid detection in the first place?

You made an asinine comparison, between cryptography/cryptanalysis (where advances involve fundamental breakthroughs in mathematics and information theory) and stegonography/steganalysis (where advances have been made, recently, from simple measurement studies).

How in-depth do you want me to get with you? I gave you an actual (high-level, easy-to-read, summarized) academic source. You clearly haven't read it. Why not go take some time with it and come back not sounding like a crank?

How about a third option: they use a method of communication that wont get them killed. You're presenting a false dichotomy.

"How about a third option: they use a method of communication that wont get them killed. You're presenting a false dichotomy."

Got any suggestions? Because I know the millions of Chinese who attempt to circumvent China's firewall daily would love to hear about it.

The point is that probably 90% of the time, these people aren't using anything better than bare encryption (if that), and they're drawing attention to themselves anyway. If they're going to do that anyway, I think it makes much more sense to hide the communication via stego.

But if you've got a better idea, let's hear it.

Hard problems don't become easier just because they find social justice applications. Math doesn't care what China does to its dissidents, as Wang Xiaoyun has made pretty clear to us.

Reply on news.ycombinator.com