Think of a picture of a dog running through grass beneath a cloudless sky. 'Which I suspect even the NSA doesn't currently have, and performing detection on that scale would be very difficult.'Īnother problem he encountered: correcting his algorithms so they don't inadvertently cause changes to the plain areas of some images - which can make the encoded messages easier to detect. 'A researcher could certainly build a simple system for detecting which images have secret messages hidden in them although they would first require access to all 300+ million photos being uploaded to Facebook every day,' Campbell-Moore says.

That could limit the extension to 'hobbyists and researchers,' he says, rather than militants, or maybe not. Since the images contain a large number of changes, someone looking for them could conceivably write an algorithm that tracks down manipulated images. Campbell-Moore believes steganography certainly can be used by terrorists in a general sense - but terrorists may avoid his method as it's not entirely foolproof. Steganography tools can benefit terrorists as much as they can protect privacy.

It's also hard for Facebook to block or remove permissions, as the extension doesn't rely on a Facebook API key. Since the extension runs through a web browser without a server connection, the users can't be detected by network analysis. It uses Google Chrome's web extension platform, since Facebook's in-house apps publicly list their users - which would defeat the purpose of a secrecy tool. 'The algorithm can then piece the original message back together correctly, despite each copy stored in the image being slightly damaged.'

'Conceptually, imagine storing the message ten times, each in different sections of the photo before it is uploaded and recompressed,' Campbell-Moore adds. 'This minimizes the amount of change it will undergo when they do recompress it, keeping the damage to the secret message low,' he says. Then it makes lots of 'very slight' changes to add redundancy. When encoding a message into an image, the extension automatically compresses the image, as Facebook would.

So Campbell-Moore replicated Facebook's recompression algorithm, available in a draft research paper (.pdf).

How to encode a message in a picture