Secret messages on the web: How to do steganography in JavaScript | Hacker News Reader

Secret messages on the web: How to do steganography in JavaScript

oakes.github.com

38 pointsgw15 comments

Here is a newly launched service for steganography in images, primarily lolcats:

I love how someone actually did this. drostie replied to my comment several months ago with some great analysis on my off-hand remark about potentially hiding your web traffic through sending lots of steg'd cat pictures: https://news.ycombinator.com/item?id=3575232

For extra security, it's good to provide the option of encrypting the message before hiding it in the image.

Doesn't encryption make it easier to detect hidden messages, because it generates a uniform pseudorandom output, something that an image without the hidden message doesn't have?

All images have some amount of random noise in them due to the thermal fluctuations of the sensor. With some clever techniques, I wonder if it could be possible to hide the pseudorandom encrypted message in the image to make it appear slightly noisier? Or maybe hide the message in images with already low SNR?

This paper recommends embedding AES using a thresholding algorithm: http://www.scribd.com/doc/62034623/A-Multi-Layered-Secure-Ro...

This paper is really good at explaining image steganography from a beginner's standpoint: https://docs.google.com/viewer?a=v&q=cache:kWVnLQVjyR0J:...

In my opinion, the whole point of embedding a "secret" message in an object is defeated if there's the possibility that the "secret" may be revealed. The math involved in cryptography is much harder to defeat than the art of detecting a structured message layered into an object, so I prefer to just pass a plain-old encrypted message. But if you want to prevent someone even thinking you're passing an encrypted message, embedding that encrypted message in an image or audio can be beneficial. And risking someone finding out the actual secret just because you thought they might be able to tell you're sending one is not worth it.

Thank you for the links! Indeed, I was thinking about applying some form of encryption that is harder to distinguish from image data than just AES in standard modes.

I haven't done much steganalysis so don't know what difference it will make for an attacker searching over large numbers of images, but it's at least useful if you're more worried of attackers who already suspect there is a hidden message.

I would have guessed the opposite - I would expect the least significant bits to have a random distribution (if the image is a photo from a camera, that is) so if the least significant bits of the image have a non random distribution that might be a hint that there is something hidden there.

Of course, all of this is moot if the image is lossily compressed.

Pretty cool, but I wonder if the author realizes that you can steganographically encode data in any format including HTML and even JS itself.

Bonus points if you can split the steganographic data into multiple domains, where building the original message requires finding and assembling the pieces in the canvas, HTML and JS sections.

Also, I believe there may be blurring techniques you can use to smooth out the dense randomness that is a signature of encryption.

Good point regarding text-based steganography. I've had a greater interest in hiding within binary files, though, because they tend to be larger and have highly varied contents. Also, it's very common to share images over email and other means, so doing so wouldn't inherently raise suspicion.

Interesting, but the obvious weak point is the browser environment itself. How can the code doing the steganography be sure it hasn't been interfered with?

Being client side JavaScript, you could save it locally and run it as a file:// URL if that is a concern.

Great method! I had ideas about doing something similar (although this technique is rather more advanced than mine) a while back, about being able to show messages based on character read from an HTML page. I wrote a little script for it: http://sprymedia.co.uk/article/Secret .

I wonder if a similar technique could be used to detect if a user has stylesheets enabled.

Hm, I thought this was about hiding data in JavaScript source code!

Reply on news.ycombinator.com