On the medium being the message

I was eating lunch today, staring at the cover of "Wired", when the phrase
"The medium..." caught my eye.  This set off a whole train of thought on
message concealibility, like hiding messages in, say, the order of headers
in a posting, or the "Reply-To:" header, or even the words in subsequent
postings to a newsgroup.  Who would ever think to look at, say, the third
word in every posting Tim makes to alt.whatever newsgroup?  Or in the "Date:"
field, or in the "Message-ID:" field, or ... or ... or ...

Hmmm.  Food for thought.
-- 
Ed Carp				erc@wetware.com			510/659-9560
   For anonymous mailers -->   anonymus+5300@charcoal.com
"I've met many thinkers and many cats, but the wisdom of cats is infinitely
 superior."      -- Hippolyte Taine  (1828-1893)

> [...] This set off a whole train of thought on
> message concealibility, like hiding messages in, say, the order of headers
> in a posting, or the "Reply-To:" header, or even the words in subsequent
> postings to a newsgroup.  Who would ever think to look at, say, the third
> word in every posting Tim makes to alt.whatever newsgroup?  Or in the "Date:"
> field, or in the "Message-ID:" field, or ... or ... or ...

Not much bandwidth in that medium there...

Things like gif/jpeg images and sound files have a ton of semi-random bits
in them that you can fool around with without anyone noticing much, but
plain text in news headers and postings just doesn;t leave one with much
room for putting in a message.  At least not without being blanently
obvious... 

jim

> > [...] This set off a whole train of thought on
> > message concealibility, like hiding messages in, say, the order of headers
> > in a posting, or the "Reply-To:" header, or even the words in subsequent
> > postings to a newsgroup.  Who would ever think to look at, say, the third
> > word in every posting Tim makes to alt.whatever newsgroup?  Or in the "Date:"
> > field, or in the "Message-ID:" field, or ... or ... or ...
> 
> Not much bandwidth in that medium there...
> 
> Things like gif/jpeg images and sound files have a ton of semi-random bits
> in them that you can fool around with without anyone noticing much, but
> plain text in news headers and postings just doesn;t leave one with much
> room for putting in a message.  At least not without being blanently
> obvious... 

True, but how much do you need if you have code dictionaries?  The Message-ID
field, for example, could contain a page.word reference, one that meant
"the cops are watching me, be careful", or "Nuclear detonator received".
Not much the NSA could do to figure that one out unless they had searched
your place, or knew a HELL of a lot about you and your co-conspirator.

My point was, there are a lot of covert channels that one can use without
making it obvious that there is any sort of covert data being passed.
-- 
Ed Carp				erc@wetware.com			510/659-9560
   For anonymous mailers -->   anonymus+5300@charcoal.com
"I've met many thinkers and many cats, but the wisdom of cats is infinitely
 superior."      -- Hippolyte Taine  (1828-1893)