Slashdot Mirror
Digital Voices From Rogue Nations?
cscrutinizer asks: "I have a friend in Iran who is producing a Web site newsletter (in English) that advocates women's rights there. She is looking for ways to fund her operations and was wanting to add a donation section as well as a section to sell e-books of some Iranian authors who can't get their stuff out to the rest of the world. As we started to talk about how to do it, a myriad of issues came up with regards to credit card transactions, the transfer of funds, the use of encryption, where to host (currently in the U.S.), copyright laws, how to avoid political reprisals, etc. What is the best path for someone living in an embargoed nation?"
BillEGoat writes "A friend of ours is visiting China to do some work that is not in keeping with their government's ideals. We need to know the kinds of e-mail interception techniques China's government and universities use, and if encrypted e-mail will get detected or blocked. Obviously the idea is to communicate without anyone knowing. The real risk is arrest and detention or deportation of our friend if caught. What encryption techniques can we use that are hard to detect and break?"
To get real communication - get encrypted irc. This will eventually come out in a while - and I bet no firewall can block all of encrypted protocols. Chat is the future for communication - E-Mail may be good, but with IRC/chat you get a meeting table or face-to-face experince - Email would be same as a Penfriend from China. Get an IRC server setup, possible SSH up to it, or wait a little for encrypted irc solutions :) (which will come )
-Stskeeps, http://unrealircd.com
I'm kinda glad that there are someplaces safe in the world from the internet. Even if they do resemble hell for people.
Step 1: Download Gnu Privacy Guard.
Step 2: Exchange keys
Step 3: Communicate to your heart's content.
The great thing about strong encrytion is that the transmission medium can be completely insecure; Hell, you could yell the symbols out in a crowded room, and nobody will know what you're saying.
Of course, getting caught with those tools might be a ticket to a concrete vacation somewheres with lots of bugs and bad food. (Resist temptation to poke fun at Carnival)
..don't panic
Perhaps a better way of exchange emails would be through the use of stenography(hiding the content in other data). Send images of your pets(not the images of course) back and forth via email and have a light discussion in the email, when you both know that the real content is in the image itself.
And to be on the safe side encrypt your message before running it through a stenograhy tool, so there won't be a big glaring header saying, "hey..look at me..i'm hiding something".
I think its dangerous to assume that only those "fascist countries over there" are being monitered, especially after the discovery of Carnivore and even the local police taking part as seen in this article from wired.
$_='while(read+STDIN,$_,2048){$a=29;$b=73;$c=142;
If they're really worried about reprisals, and if the government really is oppressive and arbitrary, then just using encrypted data when you communicate may not be enough. If the censors can see that there is encrypted data flowing between you and them, that may be enough to be suspicion of comitting a crime against the state which may be enough to warrant arrest.
[TMB]
BillEGoat, take a look at some steganography tools out on the net.
For those unaware, steganography is the embedding of useful information in other data, for example encoding text in the least-significant-bit(s) of an image.
As a hypothetical: Your friend wants to send email with sensitive information. He encrypts it (just to be extra safe) and then burries the ciphertext in a large TIFF file of the Chinese Wall. He compresses the image with ZIP and attaches it to an innocuous e-mail "Having a great time, wish you were here"...
The government spooks intercept, decode and conclude ' another happy tourist spending dollars '.
You receive the message, reverse the process and learn that the attack is being launched at dawn.
-- What you do today will cost you a day of your life.
A friend of mine was always kicking around the idea of hiding messages in digital images by changing certain pixels. This would have the advantage that it would look innocuous to anyone who intercepted it, yet have as strong an encryption as you want. Of course it would be very inefficient but, unless someone was specifically looking for it, probably undetectable. So have your friend take his/her digital camera along and snap some pictures of Tiananmen Square then hide pro-democracy messages in them.
Physics, Cosmology and
I repeat, Steganography to also hide the fact that any encrypted comm is even taking place. Put the payload in Islamic and Chinese art, etc.
try { do() || do_not(); } catch (JediException err) { yoda(err); }
What would you do if you had to privately communicate with people in countries like China or Iran where communications are possibly monitored and knowledge of what you are discussing could get the person on the other end in trouble with his or her own government? Is it possible to quietly and privately use the Internet to communicate with these people?
That's not up to the user, but to the foreign government in terms of their policies regarding the internet, privacy and how badly do they want to monitor it. Any encryption available to most people could probably be broken given a sufficeint amount of time and resources which many governments have. They probably also monitor phones and mail, so this would be no different - just that it would take more time.
Being with you, it's just one epiphany after another
China seems to me like a country on the verge of radical change. We all remember the kid standing in front of the tank, throwing rocks... but when you look at the way they handled the annexation of Hong Kong (by changing almost nothing), there's room for hope.
If I'm wrong, we (by which I mean most of the world) will probably end up at war with them over Taiwan (or something) within the next decade or two. The old Chinese curse about living in interesting times seems to apply.
Information wants to be anthropomorphized.
What we really need is some way of obscuring text so that "outsiders" can't read it. I suggest wrapping a long strip of paper around a rod, writing your message vertically, unwrapping and sending the strip (but not the rod) to the person you want to talk to. You will have to setup a rod-size with them beforehand, of course.
--
Linux MAPI Server!
http://www.openone.com/software/MailOne/
(Exchange Migration HOWTO coming soon)
I'd use ssh; get everyone on the same server in a "safe" country. And be paranoid.
:)
...or if you're the kind of person who keeps all your money stuffed in your bed, you could go the other route, and find a seedy bar somewhere, and talk in a dark corner. Better atmosphere.
---
pb Reply or e-mail; don't vaguely moderate.
pb Reply or e-mail; don't vaguely moderate.
Hi, I'm planning on writing from a free country (Canada) to a correspondent in one of the worst Rogue Nations in the world. I am afraid that my friend's political opinions will get him into trouble in his home nation (he's a communist and they've been persecuted there in the past from the illegal blacklisting of them from their jobs to their electrocution on trumped up spying charges). This country will stick at nothing and carries out acts of terrorism all over the world with no repercussions ( a short list of countries that they've bombed and invaded illegally includes Nicaragua, Vietnam, Cambodia, Laos, Iraq, Sudan, Libya and Cuba and they provide training and arms to ruthless, sadistic terrorists in Nicaragua, Columbia, El Salvador, Indonesia, Turkey, Afghanistan, Iran and many other nations).
So, how should I communicate with my U.S. friend in a manner that will make sure that he will not be persecuted by this government which has been condemned by the democratically constituted United Nations?
thanks,
Crush
Another thing, not all Americans are right wing hypocrites...just our national government and the NRA and ...
GeneralKael -- Slacker Extraordinaire
See "Wired China" at The Economist.
Among other things the article demonstrates that Bill Clinton's dream of the Internet bringing democracy to China will face some serious challenges. Apparently the Communist leadership sees the Internet as a great way to keep tabs on people and to nip dissent in the bud.
sig semper tyrannis!
Don't blame *me* if you spend your oh-so precious time replying to posts on Slashdot. You obviously have even more time to waste than me.
nuf said
Things you think are in the Constitution, but are not.
Though cryptography solves the problem of communicating with someone in a country where the communications pathway is insecure, it does not allow you to communicate securely with a 'compromised endpoint.' If your target works at a university and has access to the Internet only through university supplied computers, and Big Brother controls the university, if he decrypts your email on that machine, its now been read by The Man.
The ethical question is, "assuming your peer's communications are tapped (encrypted or not) what do you do then?"
Places like China want to be able to see what you're sending. While they don't have (yet) the capacity to review everyone's e-mail, if you are unlucky they'll run across yours in their random searching.
What are the chances of being so unlucky? What percentage of all e-mail in China gets scanned?
Even if you were to encrypt your e-mail, the fact that it was encrypted would draw attention. Almost certainly the kind of attention the e-mail wants to avoid. The sender wants not only to not have the e-mail read, but also wants to avoid the police showing up on their doorstep demanding the plain text of the message.
And that is the crux of the problem in countries like Iran or China.
The strongest encryption cannot prevent the government tracing the e-mail, eventually, even through anonymous accounts, to a location and extracting the key from the user by other than cryptographic means.
Encode your voice message into wave format, and reverse it and then convert it to mp3 and put it on Napster!
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
You must not be detected. Use stenography and other tech to hide the communication. We are talking about countries that can arrest you for no reason.
here - Outguess (haven't tried it, going to now) - Unix source tarball, BSD license.
try { do() || do_not(); } catch (JediException err) { yoda(err); }
At least the UK is more consistent on the issue: they don't hold free speech as sacrosanct, instead choosing to promote free speech as long as it doesn't promote hatred. The US has no such thing. And so, free speech becomes something claimed left and right for something as stupid as the right to broadcast publicity, and is encouraged by everyone as long as it fits their own view of the world.
Free speech in America has become a flag of convenience waved whenever one wants to encourage their own view of the world with impunity. How come free speech is never about the right to speak hatred, or to speak for the system that represses women in Iran or encourages crass communism in China? What about the right to treat others as inferior human beings? Get your facts straight. Free speech, along with gun control, is only a tool to constitutionally crush and intimidate others.
Too many images floating back and forth, or accidently using an image thats available elsewhere (so the oppressor can do a comparason and determine that stego is being used) and the opposition is likely to use what I believe Bruce Schneier termed "Rubber Hose Cryptography"... That is where they get a rubber hose and beat the key (or the message) out of you.
With stego, deniability becomes the most important aspect, that that a much harder to measure factor.
Hopefully, one day, anonymous communications mechanisms like Zero Knowledge's Freedom system will become common enough that we can all find solace somewhere.
(Note: There are no x's in my email address.)
luckman
luckman
I don't involve myself with flames, much less know how to bait one.
this is exactly the sort of thing Freenet is intended for... whether it's actually ready to do it or not, I'm not sure... can anyone else judge whether freenet would be useful for this yet?
It *must* be true! Consider the evidence:
Today's post was done in an eerie, Katzian style. For example:
"Over the past five years, we have watched the Internet shrink distances and bridge the gaps between the international community of nations."
"Community of nations"? The internet "shrinking" distances and "bridging" gaps? All very Katzian, IMHO...
and
"However, despite this social benefit from what is the world's growing global network, there are still places where the boon that is Internet communcation is frowned upon, even dangerous."
Note the classic Katz style. First clause: "the internet is wonderful, it is bridging econonic gaps, creating world peace, and bringing your childhood puppy back from the grave." Second clause: "Yet amidst this utopia, geeks are being persecuted on the internet. How can this be??"
Also, consider that:
1) We've never seen Jon Katz and Cliff in the same chat room. Coincidence? I think not!
2) It's easy to hide identity on the internet. Or, (paraphrased) "On the internet, nobody knows you're a Katz."
I think it should be clear from the above evidence that Jon Katz and Cliff are one and the same. Feel free to provide evidence that I have missed.
Let's try not to let fact interfere with our speculation here, OK?
I suggest the posters of the original questions find someone from a country that doesn't have such restrictions to sponser them. Your only problem is the exchanging of goods and services across the borders of your home country. If the site and management of the site is abroad the amount of stuff that needs to be transfered (money, emails, intellectual property, etc) is minimized.
-- Moondog
Why not just get a big yellow t-shirt that reads FLAME ME! PS It might help if you knew the difference between right and left wing(such as it is in america).
---
This sig has been temporarily disconnected or is no longer in service
Everyone here who's been advising you to use steganography is well-intentioned, but missing the point. If the secret police suspect your target of receiving subversive information, then they'll likely look for steganography.
It's not hard to flip the low-order bit in an image file. In fact, it's trivial. They'll be expecting that and they'll intercept it. Don't try it.
Encryption is also not the answer. In Iraq and Syria, for instance, using encryption is a capital offense. Sure, your communications with your friend might remain secure, but your friend would be executed--whoops!
Another naieve way to handle things is to encrypt your steganography. "It'll look like random noise!", they claim. Well, yes... and that's exactly what it must not look like. You'd have to find some bizarre cipher with outputs specifically tailored to match the statistical patterns of image files. I don't know of any which can do this.
One possibility--and I am not reccommending this without a heck of a lot more peer review--is to start an email dialogue about esoteric mathematics. Include a big ol' table of random numbers and do some real mathematical analysis of it. If the email gets intercepted, the secret police will check the table for randomness (it's random, all right--passes every test!), they'll check your email to see if it's sensible (yep--you're doing actual mathematical research!), etc.
Of course, your friend knows that it's a one-time pad. (Not really a one-time pad--if you and your friend both have a cipher, a shared key and a shared IV, you can run the cipher in OFB mode to generate a lot of statistically random data. You generate the random data, then use it as a one-time pad for your message; your friend re-generates the one-time pad on his/her end, then reverses the one-time pad. Strictly speaking, this is just OFB encryption, not a OTP.)
Of course, the secret police will know that it's an encrypted message... but they won't be able to prove it. Whether or not that stops them depends on just how totalitarian the state is. Some states will just shoot you in the back of the head and get it over with. Others, such as China, must at least make an attempt at a fair trial in order to soothe Western critics.
I guess, like Frued, they are a victim of their own enviorment.
Who's the black private dick, who's a sex machine for all the chicks?
you raise a good point re: what percentage of Chinese e-mail is scanned. Having been in China for the past year I often wondered the same thing. While sending e-mail to friends in the US, I never felt any threat or menace I always wondered if I was being followed, my mail was being read etc. However, if this was the case they were doing a good job at it as I never once noticed a thing. Altogether, I have the feeling that as long as one does nothing suspicious, the government cares less than the american media would have you believe...
I like cake
---
This sig has been temporarily disconnected or is no longer in service
Everyone is shouting "Steganography". I was about to shout "SSH" or "PGP", which I think is more realistic, but not much.
:)
Keep in mind -- Most of these rogue nations also have pretty poor pipes. Maybe Iran and China are getting getting better, but what about seriously rogue states -- North Korea, Vietnam, Cuba, much of Africa, etc. where pipes are small (if not nonexistent).
It might be okay to put small messages inside of images, but how practical is it for people in countries with small pipes to send MIME-encoded JPEGs over email? A relatively few countries benefit from DSL, ISDN, 56K or even 28.8 modems.
Perhaps a simple message as "I'm going to shoot the king" will be relatively practical to steganographize for these people. It sounds like we are all saying "well, if *I* was in the Congo, with my P333 laptop, Gnome suite, and 33.6 cell modem, I'd do _this_" -- but that isn't always available. We're talking about areas of the world where FidoNet is considered efficient and practical.
On the other hand, these rogue nations are by no means technocracies (being effectively or partially shut out of the western world is a big barrier to that), so I bet some simple encryption would suffice for these people. I doubt it even has to be complicated. Establish your code phrases, and sprinkle your friendly correspondence with them.
Hey, in Spies Like Us, they managed to fool the Russians with pig latin.
Terrorists can attack freedom, but only Congress can destroy it.
Or you could use a much lower tech communication. Set the characters across the email to something standard like 80 and specify that a given sequence of characters is the real meassage. For example every fourth letter is is the real message or better yet the third letter of every word more than six characters long. Even possible to set up different sequences by use of salutation. Even possible to have a letter equal to another letter (i.e. a=c, b=d, et cetera). Would be small files to send out on limited bandwith, and if one has a good memory possible to send on compromised systems with out fear of reprisal.
Just a Tuna in the Sea of Life
No one's mentioned this yet, so I will. HushMail is very cool. Web/Java-based, highly encrypted (1024 bits between HushMail boxes, IIRC), and reliable.
This isn't as much "normalization" as it is "don't take so many drugs when you're designing tables."
Here's your $5, kiddo. Now leave your mom and me alone. She's gotta earn that crack, after all.
either SILC (go look on Freshmeat) for encrypted chat or GPG/PGP for email can be used for secure online communications. both are entirely private. if possession of cryptographic tools is against the law, however, you're screwed. there's no encryption tool that can stop Big Brother if he's really out to get you.
> What would you do if you had to privately
> communicate with people in countries like
> China or Iran where communications are possibly
> monitored and knowledge of what you are
> discussing could get the person on the
> other end in trouble with his or her own
> government?
Forget China and Iran. Let's talk about the
United States. Or more specifically conversations
between persons in the United States and Germany.
If you say the "wrong" thing or voice the "wrong"
opinion such as, for example, not agreeing with
the orthodox account of the Holocaust (TM) then
maybe you might be getting some visits from
government representatives who are more than
willing to help you see the truth of the matter
by sending you to a sensitivity training camp.
Of course if that doesn't work they will seize
your assets. And, if that doesn't work, well,
maybe they will deport you to Israel because
someone there thinks you kind of look like a
'Death Camp'(TM) guard they saw once about
45 years ago.
Land of the Free and Home of the Brave...
At least until you do or say something that
big-business, the controlled media, or the
government doesn't like. This cabal will make
anyone's life a veritable hell if you don't get
on board that multi-cultural love train. Just
as John Rocker. Well, at least he only got sent
to sensitivity training camp and not deported
to stand trial. Well not yet any way... can you
say U.N. International Criminal Court. Its only
a matter of time... You can kiss your Constitution
goodbye.
to this problem is this:
1) build a secret underground, EMI proof dome
2) buy a stolen laptop with an acoustic coupler from an underground, black market contact
3) dial up to a proprietary satellite link from a cellular phone(cloned, to make sure the cell company can't do anything)
4) strong encrypt, use stenography and write in code(the hawk flies at midnight)
5) only transmit on the second sunday of each month on your private satelite network
This solution will only cost ~ $7 Billion US (763.5 Billion yen) and will guarentee privacy.
see also: here and here
-Superb0wl
-Superb0wl
It's not that I'm lazy....it's that I just don't care.
Funny, but also Insightful.
Given the specific need, the people involve can standardize on a meta-encoding. If it's a nature scene that's being sent, it's good news (decode for details), if it's an architectural one, it's bad news, if it's a GIF is about business and if it's a PNG it's about freedom. If a sound file of bird-calls is sent then it means something else entirely.
This way, depending on the attachment, the message is relayed to the appropriate department, for decoding. Or the media format suggests the crypto method used in the payload. If it's a pictore of a blow-fish, that's how the message is coded (Blowfish-II).
I'm very surprised to see this question even being asked, the combinations are endless. The hard part of course is standardizing on a meta-code. If it can be done securely, great! Otherwise... Well... It's all very cloak and dagger.
-- What you do today will cost you a day of your life.
Until Canada can wash it's hand of Quebec as a whole, I don't thing you should be slinging stones, Crush. There is no such thing as a free country. Not in the U.S., not in Canada. The concept of government necessarily dictates removal of freedoms. And, really now, even if I let you dodge the Celine Dion bullet, I still can't forgive you for Bryan Adams or William Shatner.
Yes, there is a high probability that naively encrypted e-mail will be detected, if not now, then in the foreseeable future... and they're not going to announce when they develop that capability. If it's detected, then you want to hope it's blocked, since if they don't block it, it probably means they're investigating you and planning something nasty.
People have suggested steganography. It's a good idea, but it is detectable. Present steganographic methods will not protect you against anybody who's investigating you specifically and has any real sophistication. You can tell if a message has been watermarked into an image, for instance.
And, as somebody else pointed out, even a pattern of large images passing back and forth is suspicious if you're visible enough to be watched at all. Eventually, they might get bulk techniques for detecting most kinds of steganography. Use with extreme caution.
Somebody suggested an offshore drop. Probably the safest thing, but use with caution.
Whatever crypto or steganographic software you use, make sure you know the consequences of getting caught with the software itself. I don't know what they are, but I'd suspect there might be some, especially if they wanted an excuse to nail you.
Iran
It depends on who you want to collect donations from. If you really want to take credit cards, it can be tricky to get a merchant account. One trick is to use a Web shopping-cart billing service, although they'll skim a lot of money from you.
Where to host: How about HavenCo? They're giving out free hosting for qualified human rights people. They should be pretty hard to get at.
It shouldn't be too difficult to get the money into a US bank account, perhaps in the name of a local sympathizer. It's probably a bad idea to put her own real name on the account.
Transfer of funds is the hard part. Setting up some kind of bogus commercial transaction might work. Probably not enough money there to make it worthwhile to smuggle cash, and that's mondo expensive, anyway. Be careful about running into US (or wherever) "money laundering" authorities... they have very sophisticated surveillance on this, and I wouldn't put it past them to let the information fall into the hands of the Iranian government.
There are specialists in this sort of thing. It's a good idea to seek out a good one. I've probably already said more than I'm competent to say.
I don't see any copyright issue as long as you have the author's permission (assuming the author hasn't sold the rights to anybody else).
All the comments about communication for China apply, only more so.
this is true however when I was there I didn't notice much either
I like cake
Don't Encrypt. That draws attention.
What is needed is an effective way to send data that doesn't appear as data. Pictures perhaps?
Use Mao's/Komeaney's picture and embed data into it with an easy way to extract the data?
Send to friend in China/Iran who knows how to extract the data.
People who think they have the right to tell everyone how to think and use the power of the state to enforce that will always be defeated in time. Just takes time and being a little more clever than the fundamentalist enforcers.
Wovon man nicht sprechen kann, darueber muss man schweigen. Ludwig Wittgenstein
There is no Left wing in America. There is All-The-Way-To-The-Extreme-Right-Now-Pass-The-Gun and Just-A-Bit-More-Toward-The-Centre-So-We-Tolerate-G ays-But-That's-It.
There are no more 'Rogue Nations', only 'Countries of Concern'. I know it's true 'cuz Maddy Albright said so.
Nath? I don't like mentioning my bitch in public forums. She gets turned on by it, and keeps begging for anal sex. You know how tiring that is?
If you transfer money to someone in Iran, you could be sent to prison. There is an office in the Department of the Treasury called the Office of Foreign Assets Control, or OFAC for short.
The purpose of that office is to enforce trade embaros against enemies of the United States. That list of enemies can include countries like Iraq, or persons like Osama Bin Ladin.
Each country has its own restrictions. Specifically to answer questions about Iran, Americans are prohibited from importing anything at all, including rugs of Iranian origin either directly from Iran, or through a third country. There is an exception made for books and other Iranian publications. There is some question about how you could go about this. I doubt anyone in the US will care if you bring texts from Iran, but to actually set up a business is a different story. I know for a fact that credit card companies, including one I used to work for, set up filters based on databases built from OFAC sources by Thompson Financials to catch funds going to or coming from OFAC listed countries. Those assets are frozen, and everyone involved in the transaction loses their money or goes to prison. You may not be able to set up a cash based business either, because customs will eventually intercept the physical money you're trying to send to Iran to buy the books.
If tits were wings it'd be flying around.
In this thread, some people want to hide communications from a monitoring agency tasked with finding such communications. Most respondents barely considered the issue and responded "stenography!" Don't ya think that the technical & intelligence professionals monitoring the communications channels KNOW about stenography? And that they've developed techniques for detecting it? Frankly, I'd suggest that the main covert-communications methods to avoid would be precisely the ones that are so readily suggested on a forum like this: such methods are well-known even to the lamest geeks, and are thus unquestionably watched for by the pros.
Can we get a "-1 Wrong" moderation option?
given the amount of resources the Chinese government is dumping/has dumped on sensorship and what not, and that the government is using their own flavor of Linux, why do you suppose that they are not monitoring Slashdot? Heck, for all I know, the one who asked might be someone from the government. (How do you know I'm not a spy? I hold a Chinese Citizenship)
I'm sure by now, they'll have a team of people working on something that'll block sternography, if they haven't done so already...
What I've been wondering is, how can the government monitor say emails sent via hotmail or any other online email services?
I think you mean _steganography._
... maybe all those personal homepages at Yahoo/Geocities are plotting to overthrow the WTO or the WWF or something... :)
Seriously, that wouldn't be all that bad - maybe even using Slashdot - post something on one of the hidden discussion boards or in one of the articles as a certain user or even as an AC - could work...
Then again, Slashdot is free speech so maybe somewhere else...
All browsers' default homepage should read: Don't Panic...
If your paranoid about having encryption, and don't need very long messages (a handful of words), just use the solitaire cipher from Cryptonomicon (originally in Bruce Schneier's book Applied Cryptography). All it needs is a deck of cards, and it is approximately 96bit strength (if I remember correctly), which makes it _really_ hard to crack without the key (of course, barring some unpublished attack on the algorithm...) It works for encoding a handful of words at a time. How to get the encrypted messages there is another question. Steganography (SP?) is one solution, but for the truly paranoid, try a variant on it: you're not sending that many words anyway, so try encoding it as something like each bit of each character (5 bit characters!) is encoded as whether each line of an email has an even or odd number of letters. Its common enough for people to hand-wrap email text, yours has a pattern to how its wrapped... Be prepared to write long emails about your tourism, though!
- whip out some pseudo-random numbers based on your key and a sequence (maybe the name of the file). Using this,
- select some reasonable number of pixels in which to
- encode your encrypted message; leave the remainder alone.
The statistical properties of the picture won't change as much (as little as you like), making it much harder to detect the manipulation. At the other end, you feed the filename into the crypto-system to initialize the PRNG, get the list of pixels generated in step 2, extract their LSB's to regenerate the message put in them in step 3, and decrypt as normal. Just make sure you never use the same filename twice.This would be even safer to use if the authorities are not comprehensively scanning the contents of CD-RW's, and you don't need real-time communications. You could carry a megabyte or more of encrypted communications per disc, all safely hidden in harmless pictures. Heck, if the authorities are letting discs in without scanning them, you can just use a one-time pad and burn your discs as you use them. Even you can't regenerate the plaintext from the cyphertext until you get home again!
--
Time is Nature's way of keeping everything from happening at once... the bitch.
this?
Hmm... And I bet you're the one who wiped his hands on my living room curtains, you fuck. If you ever come close to my house again, you are so dead.
Let's see some discussion on how to help women become more free, rather than how to help a person who might be conducting some incredibly questionable tactics.
www.eissq.com/BandP.html Ball and Plate System. Amuse your friends. Crush your enemies.
I thought Mbuto Sasisako died years ago, in less Laurant Cabila decided to let Angola and Zimbabwe have a huge chunk of his People's Republic and give it back it's old name... :)
Be Seeing You,
Jeffrey.
Time Lord, Dark Horse: The Techno Mage of Gallifrey
A possible solution is to move your web site offshore.
Montreal based ZeroKnowledge company (www.zeroknowledge.com) is producing a software called Freedom which should be usefull for people living in countries without freedom of speech. I think it routes your traffic through a dynamic network of secured sites.
Seems to be good.
http://www.blackhat.org/stego.html
I've been reading some of the other posts here and Images are not the only way to hide the data. Data can be hidden in images, audio files, headers, and ASCII white space.
One of the programs listed on that page (Snow) will embed the text as tabs and spaces in any text you provide. This is a great solution because most ASCII viewers will ignore the whitespace and just display the text. This would be good to embed in a web page because they would have to view the source in order see the spaces. The program will also encrypt your message before it converts it to whitespace, adding extra security. It is however a proprietary encryption scheme, so I don't know how well it works. In any case, the whole scheme seems pretty good!
You guys forget that you're talking to normal user. They don't want to do what you're talking about...
Private communication via the internet to China would be possible, if it wasn't for Washington. Comeon, everyone knows that both parties are in Bejing's corner. And as long as China's wallet is open, our friends at 3Com, Bay, and Cisco are happy to set up all the privacy intrusion technology for the Great FireWall of China. The only way to communicate secretly is has been the only way. Only the medium has changed. For example: The weather in Bejing is stormy today. Meaning : The communists are going to kill demonstrators. Cabish?
Back about 3 or 4 years ago someone on the Scary Devil Monastery got mad at all the lusers posting with line lenghts longer then 72 charicters. So he made all the line lenghs of his next few posts exactly that. The neat thing was he did it by hand, without inserting extra spaces. Those posts made gramitical sense and were intellegent.
So with practice you should be able to set up a low bandwidth code based on line lenghts. Shorter then 72 is a 0, longer is a 1 (or maybe encode 2 bits in a line...)
Of course the point is that you need to communicate without rasing suspition. Thus you need a pen-pal that you can write long letters to often, on innocent subjects. (Talk about your girl friend, go into detail about your date at a restaruant - someplace they can quickly verify that you really were in). If keep sending pictures of the mona-lisa around slightly altered, then you better be talking a email class on gimp filters. (This is what I came up with when doing a blur to the nose - and then embed your message in the least significant bits of the nose area only.)
encryption is great for hiding the exact content of your communications, but it will draw lots of attention. if you were to use it I would recommend removing the begin and end tags before and after as the Chinese government is most certainly sophisticated enough to do large keyword searches and that would be one of the things that will set off alarms. in fact the absence of actual words like [in Chinese] the, and [no longer in Chinese] will raise some eyebrows as well. the Chinese government is just as sophisticated as the Canadian and European governments and well near the Americans. don't be fooled by the massive poverty and over all lack of tech that the many people must suffer there. they have so little because the government is a parasite that, instead of feeding its people / supporting an economy where they could feed themselves, buys expensive data surveillance equipment. your best bet, and the negotiation of this code is really the hardest part, is to develop a plaintext communication method that resembles normal meaningless conversation (not devoid of meaning but meaningless in the sense of being very mundane and boring). it must be close enough that it would get past scrutiny. I would suggest routing any mail through a server in a country that is not seen as threatening. this way you would have an excuse for speaking whatever language (choose one that is not common in china (English, French-Canadian, polish, whatever)) so when your messages seem strange and semi-suspicious it will just seem like you have a poor grasp of the language. but remember while this is not strong encryption which is great for thwarting aggressive governments from actually knowing what you are saying and will only get you killed, it can be very hard to crack. the trick is to avoid detection so that you are not scrutinized. as this is impossible because if you send more then three emails you will be scrutinized, the mail must be able to pass the scrutiny. another good option would be to go to a server somewhere the Chinese government will not worry about and hop from there to another server that is in a 'safe' country and do all your business there. don't let data leave that server either. it would totally defeat the idea if you went through all of this and then just transferred all the data back home to china.
You can encrypt to your heart's content but if they see you encrypting information suspicions will be raised immediately. If you are a foreigner anything could happen from simply being put on the next plane to being tried as a spy. If you are a citizen they will probably torture anything they want out of you.
A friend of mine was in a communist country in Asia recently and knew he was being monitored. He didn't know quite how much until one day he was using the internet to chat with a friend in North America. He was suddenly cut off. The phone rang a second later and an official questioned him regarding his conversation.
Many people in non-democratic countries use only mail hand carried by trusted sources in order to get information in and out of the country. If you must use your computer, well, save the stuff to disk. Chatting this way won't be in realtime but it will be the safest way.
Another option that is becoming more viable is satelite. Bypass the county's ISP's altogether. The equipment needed is getting smaller and cheaper all of the time and it should be fairly difficult to detect and intercept. Should have handheld satelite phones again in a few months.
Sig. Sig. Sig. Sig. Sig.
Free 128bit-encrypted e-mail. 'nuff
"...[treat] every man after his desert, and who should 'scape whipping?"
--
Time is Nature's way of keeping everything from happening at once... the bitch.
Implicate government oficials as being involved in "treasonous" matters even if they're not. Not that I would take any joy in seeing people being hurt and destroyed who did no wrong. But that's the whole point, isn't it - it's better for people who oppress freedom to oppress each others freedom rather than people who wan't none of it IMHO.
--
Time is Nature's way of keeping everything from happening at once... the bitch.
For someone who's just visiting China temporarily and needs to send something like status updates, you may be trying overkill by writing messages on the fly and trying to smuggle them out. Instead you could try a more classic technique using a code instead of encryption. You simply have a series of code phrases or words, each of which has a specific meaning. You just sprinkle the codeword into an otherwise boring message.
As an example, you might only be interested in sending back three or four different status updates. So you just change your closing in the letter you send to indicate your mesage:
This scheme is obviously something that you could modify fairly easily. Just send a letter with no hidden content at all and hide the message in who you send it to, or discuss different topics depending on what message you want to send. The code can't be broken by technical means, only by getting the code book (which might be small enough to memorize) or getting a member of the group to spill the beans. Of course the range of messages you can send is comparatively small- with a bit of work you could probably arrange 50 or 100 canned messages- but if that fits with your mission it's an approach that can't be beat.
There's no point in questioning authority if you aren't going to listen to the answers.
1. As you say, you have to create a standard system for this that can't be reverse-engineered - and a working cover story.
2. The other challenge, as noted elsewhere in this thread, is to avoid getting the attention of the authorities that you're doing this. One if by land, two if by sea works with ordinary lanterns that one would expect to see - but if the Continentals had shot off fireworks, for example, the Redcoats might have noticed. So don't send architectural drawings if you're not already an architecture fan.
sulli
sulli
RTFJ.
We may well all remember the kid standing in front of a tank but I'm pretty sure he wasn't throwing any rocks.
As my visual recollection serves, he was carrying a bag which he didn't put down. He sure as hell wasn't lobbing masonry. It might not have been such an evocative image if he had been.
The problems adressed in this topic are occuring everywhere; think Echelon and the RIP bill currently going through the UK Parliament.
RMS wrote a very good article about the RIP bill a while ago. If only I could find a link...
The point about holy wars and persecution is true, though.
You'll get to add the USA to that list soon, if it doesn't already qualify.
Just because it CAN be done, doesn't mean it should!
Go back and read the posts here again -- I don't believe anyone has seriously suggested encrypting steganography. What would be the point of that? The whole idea of steganography is to hide a coded message in otherwise intelligible data, whereas the point of encryption is to turn intelligble data into something statistically indistinguishable from random noise. Performing encryption on steganography would simply negate its purpose.
Yes, and this is why encryption should be performed before steganography. That way, if the authorities apply in reverse the means of stenography to the data, they end up with seemingly random data -- that is, much the same result they'd get if there had been no stenography performed in the first place.
What you are proposing is an extremely weak form of steganography, and it is even more obvious than the methods that others have previously set forth. If the secret police know that you're transmitting encrypted data, what was the point in sending it to begin with? For the purposes given by the original posters, the data needs to be innocuous-looking, not suspicion-arousing. Steganography is certainly the best way of ensuring this.
Regards,
I heard about a Chinese dissident group that collected every email address they could in China, and then sent their newsletter as spam to everyone on it.
It made traffic analysis impossible, although I imagine having the messages on your computer, undeleted, would still be seen as incriminating.
I guess even evil technologies (like spam-automation software) can (possibly) have good uses.
read the above message.
In this case, they may presume that you are doing more than you actually are, and my convict you in a kangaroo court of espionage when it's really something much more minor.
On the issue of surrendering keys---the government can then claim that ANYTHING is what was encrypted, since they have hte power to create it with your keys now.
--
japan = no military.
singapore = no military
australia = small military
russia = recently been very close with China, probably on China's side (against us hegemony)
who's left. India? (doesn't like china much at all...) small military
besides western powers, there's only
south korea = _big_ military
that can do anything. Plus, with the north korea situation (and nk being so close to China) they might not want to super jeopardize themselves either).
Sanctions yes, military action? looks shaky.
there is no thing
what else could you want?
ahem... USE PGP! Jeez, if you don't want the governments of rouge nations spying on you and whatnot, using it with e-mail is a sufficient medium for communication. Legality and arms trafficking violations be damned! If you aren't allowed to download strong encryption from the U.S. according to U.S. law, but you fear persecution from your government for what you say, what would you do?
Friends don't let friends use multiple inheritance.
Please point out a relevant passage where Jesus suggests that persecution and murder were OK if the person wasn't a Christian.
Well, here's one passage where He explicitly says that's exactly the kind of shit He intends to stir up. Vicious motherfucker, isn't He?
Matthew 10
34 Think not that I am come to send peace on earth: I came not to send peace, but a sword.
35 For I am come to set a man at variance against his father, and the daughter against her mother, and the daughter in law against her mother in law.
36 And a man's foes shall be they of his own household.
37 He that loveth father or mother more than me is not worthy of me: and he that loveth son or daughter more than me is not worthy of me.
38 And he that taketh not his cross, and followeth after me, is not worthy of me.
39 He that findeth his life shall lose it: and he that loseth his life for my sake shall find it.
Perhaps a public forum isn't really the best place for these people to be having this discussion.
Don't label something "offtopic" unless you know the topic well enough to tell what's on topic.
Join the CIA.
I believe this should be at the top of the comment thread along with the rest of the Score:5's... (I read with highest scores first, and I'd imagine a lot of people do). It's rather informative and (for this discussion) critical information.
the real at&t mix
Yes - I imagine that it would not take very many encrypted packets to be sniffed before your friend in the Evil Empire gets a visit from the Ministry of Love.
Some kind of code that does not look like a code is called for. I'm wonder if a special kind, encoded by DHTML or XML or Unicode somehow would work, but seriously, anything discussed here would give it away.
Historically, the majority of the employee of U.S.'s Central Intelligence Agency spends time reviewing publications from around the world, looking for interesting things. I'm sure that these days, they are review all that is onlineand I am very sure that it is NOT just the U.S.'s spooks that are doing it.
DREAM LOUD!
Satellite phones? Those were expensive as hell, last time I checked. And all the satellite ISPs I have heard of only transmit downstream data through the satellite, the upstream goes through the phone lines.
Friends don't let friends use multiple inheritance.
Am I missing something, or can't your friend use a webmail site in the UK that supports SSL? That way, the Chinese government would never even have any message to analyze to see if it is encrypted or not. Its not like they can ban or track all SSL traffic going out of the country.
Of course, your friend could be extra paranoid and use steganography in the messages sent via the webmail interface, as well as keep an extra spam account on the server in case the Men in Black come by and say, "We see you have been going to superencryptedwebmail.co.uk alot. Care to give us your password so we can see what you are doing there?". Also, a low-technology solution like a browser would require a bit of maintenance: always cleaning out cookies, caches, and whatever else junk it keeps around.
>It is UNCONSTITUTIONAL for the United States to use the Military to police its own people.
Governments routinely do things that are beyond their legal authority. There was no legal authority to incarcerate Japanese Americans, force the Cherokee to move to Oklahoma, conquer the southern states when they seceded, etc.
The constitution is no more powerful than the will of the people to enforce it, over the goverment's objections.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
A scientist in Zaire would be pretty hard to find these days, seeing as it doesn't exist anymore.
Please update your links to THE_WORLD.
Consider a supposed chat session or e-mail. Use as a base any prepared text which has been thoroughly spell-checked against a common standard (say, the unabridged Oxford English dictionary). Preferably it is a message which in itself is an appropriate message.
Now, at a rate which approximates normal typing errors, take a letter that is keyboard-adjacent to the one you wish to insert into the message, and make the substitution. As an example, say you are trying to insert the word DANGER into the text. To put the letter D in, find an S, F, R, X, E, or C (using my QWERTY keyboard as an example). For spaces, just double a space. Make sure that the word created is an actual typo, not a new word. (So, using the s in "sandy" prodces "dandy", which doesn't help, but using the the f in "frozen" produces "drozen", not a word I know and therefore useful.)
The end result of this is that a simple program can extract the appropriate letter from the message. Put together, this forms either the message or an encrypted form of the message (the safer route, as a good encryption algorithm should look like random errors anyway -- defeating an initial analysis of the errors.
Plausible?
-TBHiX-
Suggestion: Use Jon Katz articles as the background text; if the opinions around here are any indication, we'd have security through disdain. ("I don't care if there's government info in it, I'm not reading it!")
The internet auditing project story mentions an unknown hacker who liked to use fake DNS packets to carry data. It also mentions SSH ESP, a toolkit for putting ssh over packets normally left alone by firewalls, though I've not yet seen other references to it.
I mean, the ping packet is required to carry an arbitrary dataset to it's destination. And you get a reply. I wonder if some ping tools will fill it with pseudo random numbers? Hard to differentiate that from an encrypted message. I have yet to be on a network with outgoing ping disabled, though it certainly could be fwalled.
>translated into English; you no longer have to
>learn Latin in order to read it.
Yes it has. But if you've read any history, you know full well that the christian church fought tooth and nail to PERVENT this. They did *NOT* want thost dirty commoners to be able to read scripture without the "helpful intrepretation" of the clergy. Hell, they weren't even so fond of the nobility having their own copies in Latin! Gutenberg was NOT a popular guy in Rome. To say nothing of all the other science and technology (Gallileo anyone?) they've tried to supress over the years. But that would be too far offtopic for this thread.
>If you don't trust people, go read it yourself;
Okay... soon as I learn aramic, ancient hebrew and latin I will. Oh... wait you meant I should read the translated works didn't you?
Here's a little exercise. Take a relatively simple phrase: "The quick brown fox jumped over the lazy red dog". Go over to the babelfish at altivista and run it through a few generations of translations. How rapidly does it become obfuscated? Now, these are MODERN languages, in everyday useage in the world. Where's the babelfish that includes aramic and hebrew?
Remember, too, that the babelfish is an OBJECTIVE program that gives computer generated translations WITHOUT the "helpful corrections of obfuscated meanings" that were *SO* thoughtfully provided during the church's translations of the bible throughout the few thousand years the bible has been kicking around.
Oh... one LAST point. No perfect digital duplication of the bible till the last decade or so. And the VAST majority of it's existence was BEFORE Gutenburg. Guess how it was duplicated... by hand. Even if the church was above making a few "adjustments" to christian dogma that would make it easier for them to control the masses (not bloody likely), such a stupid, inefficent duplication process is BEGGING for errors (even unintentional ones).
You think your COMPUTER has a case of bit rot??? It's not likely to be more than five years old... wanna go for five thousand?
john
Resistance is NOT futile!!!
Haiku:
I am not a drone.
Remove the collective if
Imagine all the people...
I didn't realize that men having sex with young girls,
That charge is completely unsubstantiated. It was a pretense, like the Gulf of Tonkin or the Mythic Kuwaiti Incubator Babies.
assembling a ton of weapons,
In Texas, that is nowhere near illegal. It is also well known that most of the guns were kept as investments, like a gun dealer would. (ie, they *were* actively trading them, not just intending to).
and most likely burning the place down when the government decides something ain't quite right
That is pure conjecture about there motives. It is also easy to prove with the FBI's own infrared film that the fire was started in the exact same places where the three FBI tanks breached the compound wall, and at exactly the same time.
was included in the phrase 'peacefully assemble'. It doesn't fit perfectly, but it was certainly morally wrong to sit around and do nothing...
On the contrary. After seeing the evidence from both sides I think it does fit perfectly. Those Davidians were set up, and then they were murdered.
As neat and simple a case as ever I saw.
"Reactionaries must be deprived of the right to voice their opinions; only the people have that right." - Mao
I suspect that the 'embargo' in the story refers to an encryption embargo. Encryption products are still considered munitions by US export laws, and unless you wanna play Ollie North, shipping strong encryption (and possibly any encryption whatsoever, I'm not sure) to certain nations is verboten. Iran is definitely one of those nations.
--
--
Do I look like I speak for my employer?
For example: I encrypt message A ("the Russians attack at dawn") together with message B ("the weather is beautiful in Moscow, wish you were here") into encoded message C. The receiver can then decrypt it with key A' (yielding correct A) or B' (yielding bogus B). If anyone (such as UK authorities) ever coerced me or the recipient to reveal the key, you would just give them B' and noone would be the wiser.
Thus, while Big Brother would be able to determine you are sending encrypted communcations, they would not be wise to the real content if they manages to get one of the keys from you.
Seeing the idea of Steganography kicked around here, I'd like to point you guys to StegFS which can help a lot if you don't want to disclose data to anybody unwanted. This makes it impossible for somebody to disprove you saying that you don't have anything on your machine and in consequence to get at your crucial files. I don't know if it supports non-Linux OS's though.
While I cannot think of securely wiring money back to non-government-conforming organizations in Iran (or whatever country, incl. US) I would think about doing "business" solely in the so-called free world and ship non-monetary goods back to Iran, which of course can be dangerous itself.
Another I piece of software I didn't see mentioned here is Outguess, a steganography tool. Attaching (prepared) binary data to mail or newsgroup messages is probably not a bad idea. One should think of ways of secure communication if that fails though (via enemy sysadmins)
Nevertheless I applaud those people trying to squeeze out a little freedom in literally opressing situations with the help of modern technology. It takes a lot of courage. Good luck.
cheers,
Roland
that was my thought, too.
title of today's article from "cliff":
Digital Voices from Rouge Nations
title of one of the most high-traffic Katz postings ever:
Voices from the Hellmouth
Can there be any more doubt?
the problem with teens is they're looking for certainties.
Hollywood, Television, has become the dream machine. We need to take that back; each of us is a Dream Machine
What I'm surprised no-one seems to have thought of so far in the discussion is this:
:)
Steganographic data transmission by network traffic patterns
Imagine, if you will, a web server in, let's say, China, that has a peculiarity about the way it responds to incoming connections. When an incoming connection is accepted, the ACK in the TCP SYN/ACK sequence is delayed by a certain amount. Delays above a certain threshold code a 1, delays below that threshold code a 0. Hey presto, you have a well-hidden (albeit low-bandwidth) communications channel. The client (outside the country) continues to request files (thus making new connections) until it has recieved all the data, and a CRC is used to make sure that this somewhat unreliable method of data transmission has succeeded.
Of course, this has its problems - the net does not guarantee delivery times, and such a scheme could be defeated by large random delays being introduced at the infamous 'Great Firewall of China'.
However, having now introduced the concept, some of you can probably think of ways to do it which take time out of the equation.
Imagine a web browser which, on a certain page, requested the images on the page in a certain order, and that order coded for some value (binary coding would be _most_ inefficient here.) The webserver (outside of the country, of course) notes this order and logs the data for decryption.
There you go, another well-hidden (but low-bandwidth) channel.
Or how about encoding data in TCP header options?
There are so many ways to encode data in a well-hidden way on the net it's untrue, and due to the extremely erratic nature and enormous volume of IP traffic, is almost impossible to detect.
IIRC some of the DDoS tools use patterns of ICMP and UDP packets as ways of messaging, discarding any actual data contained within the packets... so yes, it's been done before.
Sorry folks, but encoding stuff in the low bits of data files just isn't subtle enough...
In the United States, England, Canada, Australia, and New Zealand, the media is controlled, run, owned and MANIPULATED by the Jews. The Jewish are at war with the Muslims in the Middle East - which explains why the media would form such a harsh view of them. They are all deemed as terrorists, when the real terrorists are actually the Jewish people.
The US government, the US media, and the US people are all being held by the bootstraps by the Jewish. They make out China and the Middle East to be such dangerous plaecs - and it is true, they can be dangerous, but not as much as they are made out to be in the media.
If you haven't experienced something first hand, you shouldn't have the audacity to comment on it's nature. Because, contrary to popular western opinion, we are NOT immune to propoganda, and we don't have free speech at all.
So if I were you, I wouldn't be too concerned about the Iranians or the Iraqis censoring Newspapers, or the Internet, or killing innocent civilians, or dropping an Intercontinental Ballistic Missle in the middle of New York. Because Americans just have to learn they can't form their opinions of the world through the medias eyes. Wake up and see who controls the media, and how much they would want to get their opinion into the publics mind.
If you are interested, you can visit www.natall.com. It's an interesting website, and trust me it will open up your eyes. I don't agree with alot of what's said in it, but it has some very valid points that will make you think twice about watching the news on TV every night.
Please send me an e-mail if you disagree with any of my views. I would love to discuss it further with anyone.
Daniel.
PS. I AM NOT A RACIST! I am not speaking of Jews in general. There are bad people in all races. But in cases like this, you must generalise in order to take heed of the bigger picture.
--
Daniel Zeaiter
daniel@academytiles.com.au
http://www.academytiles.com.au
ICQ: 16889511
Hey, I've been just reading that at UK they are passing the law that british intelligence services can monitor all the Internet communication, and at USA we got FBI's Carnivor. So here is my question: which nations are free, which citizens are actually under the constant watch, and who can be arrested for sending some e-mail to whoever? So - why are we worrying about N. Korea or Iran? Solidarity begins at home, correct?
I just can't believe you're still posting at +1.
Free music from Jack Merlot.
Think.. Porn images tend to be noisy, low quality. Perfect for hiding random bits.
And if someone sees them, then don't tend to look twice.. Though they might tend to make copies for 'safe keeping'.
So, you can move data through sending porn images to each other. You send american porn, they send chinese porn.
Another option is to do the same, only on an FTP site.
There are a few practical problems though, first, the stego technique must be some type of spread-spectrum. (IE: keyed, if you don't know the key, you can't determine if there's any data stego'ed in it.) The second problem is where do you obtain so much porn? Maybe you'll have to accept donations? Or make your own porn?
As I pointed out in another post.. Set up a FTP site where you exchange porn. Or use email. You now have an excuse to exchange large numbers of images back and forth. And a realistic reason too! And snoops might save copies just for 'safekeeping'. Besides, if they think that you're 'morally unsound' act of just moving porn back and forth, they're more likely to miss the fact that you're smuggling contraband data out.
.edu system. Porn trading.
:)
Since the images tend to be low quality, you can introduce noise artificially and then stego the data on top. You have to choose a stego technique whereby the information is hidden such that it is impossible to determine if anything is stego'ed. MAKE SURE YOU FIND A GOOD TECHNIQUE! Your friend's life may literally depend on it.
If you want to be clever, make a prepackaged program 'logo_pron' that has an undocumented feature where it can accept a secret message and stego's it into the image while innocously introducing a logo. Make it look like some crappy shareware program. That way, if they test it, it behaves like it's supposed to. Or make it look like a program that puts 'personalized messages' onto images.
As someone else pointed out. If they suspect you and are monitoring you or you're endstation, and they catch you doing something, you're hosed. Never forget this critical fact.
Your best bet is to hide it in something obvious and apparently innocous. Crappy shareware. Ratio porn site on a
Which reminds me of something..
Where do you find enough porn to stego an entire censored newspaper?
Hey!
Obviously the idea is to communicate without anyone knowing.
My reccommendation would depend on the time you want the data delivered in. If you have a long time for each communication, I would advise you set up a dialogue over the post. You send regular letters to your cousin in China, writing about all sorts of family subjects. You don't conceal and hidden information in these messages. Every time you have some secret information, you send your friend a big American movie that would be hard to get in China. I can't comment on video availiability in China, but I don't expect it's that great. Anyway, you send off your video of, say, 'The Matrix'. Both you and your friend have some sort of video editing system. You could use pretty much anything, but I like the Danmere Backer range. You go to the very end of the video, after the film, stick some tape over the snapped-off tag, then record your message, in whatever format you want. Rewind the video, remove the tape to write-protect the tape, if possible, get somebody who works at a shop to shrink-wrap it for you, then post it off. A few weeks later, he posts back your video with a letter of thanks, and his reply recorded over your old message.
Whilst the time requirements are quite strict, and there may be difficulties posting videos from abroad, I doubt government searchers are going to open your shrink-wrapped video and watch the entire thing, end to end, in case you have a secret message encoded in it. You could camoflage your message with a regular exchange of non-messaged tapes if you want.
If you want to communicate more quickly, I'd go for steganography. I personally use steganos which is windows-only (gasp!) but uses something they call Dynamic Cell Spreading (DyCeS). If it was me programming it, I'd ask for a password, then I'd hash the password, and number all the pixels. If the hash started with hex 7C1..., I'd encrypt the message with the password provided, then put the first bit in cell 7C1, and repeat this several times. That way, people looking at your message wouldn't be able to tell which cells to check for hidden messages. This could be done against a background of normal photographs, as camoflage.
Then again, I didn't write the program, and don't have any information on how the DyCeS algorithm works, and havn't a clue how to write a steganography program.
Maybe some peer review could be in order?
Michael Tandy
...another insightless comment from Michael Tandy.
"Goodness me, how unlike the FBI to abuse the trust of the American public." -- The Onion
I dunno about the media, but he certainly had more guts than most people here (me included).
Sending encrypted data is bad - the government
does not need to break it - it will put you to
jail, if they just suspect anything.
Better setup two public web servers - for
example some solitaire server in USA and some
chinese chess (or whatever) in China. And then
exchange messages by moving cards or pieces.
Though it will allow only text communication...
/Alex
First of all, just used encrypted e-mail or https. The volume of e-mail is so high that the Chinese government isn't even bothering to monitor e-mail. Moreover, the Chinese government for the most part does not care what people say in private conversations as long as it's nothing that can be construed as organizing opposition to the state. What you should be worried about is *NOT* the connection between China and the rest of the world. What you should be worried about is data physical residing in China. Talking about politics over private e-mail will *NOT* get you in much trouble. Setting up an anti-government website which is physically located in China will get you in a heap of trouble. Also, if what you are doing is construed as anti-government, and you are arrested or deported, all of the e-mail correspondence on your hard disk is likely to be read. So you could spend all of your time going encryption and all of that would be useless if the police get physical access to your machine. So your best bet is to run e-mail through https and a Hotmail server which is located outside of China. Also make sure you clean your caches so that you have *NOTHING* on your machine that would be of use to the police if they get access to it (i.e. lists of people you have been talking to). Not only would having interesting data on your machine be devastating if you do get picked up, it would also give the police an incentive to pick you up. China isn't a problem in internet communications. Places like North Korea and Iraq are. For all of its worries about political dissent, the Chinese government is more interested in economic growth and turning China into a superpower, and this limits the amount of repression that the government is willing to engage in (i.e. it would have no problems with internet dissent if it shut down all the servers but its not about to do that). Also, the problem really isn't in the technical aspects of communication. One thing that I've noticed is that people in the West are remarkably uninterested in what people in China actually think, especially when it is different from preconceived notions of how Chinese people should think. Sometimes I think it's amazing how people who campaign for democracy show such remarkable disinterest or in some cases contempt for what people really think.
The PRC simply does not have the resources to monitor all internet traffic. It's efforts at internet blocking and encryption licensing have been pathetic jokes. Furthermore, it is too interested in making China an economic powerhouse to try the North Korean solution of blocking all links. So what it does is to focus on a few high profile cases, strike really, really hard in those few cases and let self-censorship take care of the rest. So your job is basically not to be one of those few high profile cases.
O.K. so what does the Chinese government care about? It really doesn't care what people think, what it cares about is largely staying in power. This means that it tends to focus on people who are creating an organization that could challenge the Communist Party. This means that you are not in particular risk if you just communicate private thoughts, but if you try to organize people, you need to be really, really careful. This is particularly the case if you are in any "leadership position." The PRC has extremely limited resources and so it tends to focus in on people in leadership positions and strike them really, really hard.
So in the case of China, the thing to do is to stay "under the radar". Reading Hotmail e-mail through https is unlikely to attract a lot of attention. Setting up an "down with the communist party" web and bulletin board site is likely to get you unwanted attention.
Also, something that should be quickly obvious is that there probably isn't a "one size fits all" solution. Something that works in China, would probably not work well in North Korea, Iran, or Syria and vice versa. In the case of China, the internet is well developed enough so that it's easy for a tree to hide in the forest. This is *not* the case in North Korea, and I don't know about Iran or Syria.
One final thing. Why am I telling you all this? I strongly suspect that if I knew your political ideology I'd strongly disagree with it, and I doubt you would care too much for what I think. The reason I'm telling you all this is that I think the key to Chinese political progress is the development of "civil society" and anything that makes exchanging ideas in China easier (even slightly) is a good thing.
Choosing pictures and such randomly is one way, choosing message elements specifically to deceive the Bad Guys is another idea - sending TIFFs of the Great Wall to make the spooks think the sender is just a tourist emailing his buddies is a very simple way of deceiving the authorities, the "Food for the NSA" keywords (plutonium neutronium Middle East Ecstasy Echelon hello to my friends in domestic surveillance) is another method. Be creative.
Meldroc, Waster of Electrons
Also, be aware that PRC probably monitors Slashdot. Wouldn't you?
--
--
Socrates was asked where he was from. He replied not "Athens," but "The world."
Seriously, the best method would be for you to host a web site outside the country in question, and encode inside some posted family pictures (you on trip to Yukon, at the KMart, etc) your basic message. All they need on the other end is the same encoding software for images and you're done.
Then, they could either host the images or send them via email (e.g. "Here's some pics of Marge and the kids fishing on the river Kwai"). Make it really boring ("Uncle Jim and Aunt Li-Po shopping").
This is the stuff that they don't care about.
Will in Seattle
My appologies,
There was a typo in my email address for this story it should have been cscrutin@interaccess.com
Sorry for any confusion.
-C
No the internet won't turn China into a democratic nirvanna, but China is a lot more open and free with the internet than without it.
chenyu wrote:
Here, here! We all disagree... it's inevitable. The beauty of /. is that we can all exchange ideas and help one another out, if we choose. This, to me, is human progress. Even better, when we can listen to things without voices, this is natural progress.
Censorship is the ultimate form of oppression!
Having never been to china or iran, I don't know how much worse things are there than here, but, hey, we've got plenty of censorship issues here in the Western world to keep us busy.... let's support these struggles on all fronts!
After all, has anyone ever thought of a better answer to the question "why are we here" than "to grow by sharing ideas with one another?"
My two cents,
by Col. Klync
----
Not to be confused with Col.
I liked Shatner's singing, .. Hey Mr. Tambourine Man... brilliant
Ohhh....singing, eh? Is THAT what that's called.
That clears up a lot of confusion for me...thanks! For the longest time, I couldn't figure out WHAT Shatner was doing.