Threat model: coercion-resistant hidden storage for sensitive files — feedback on steganography + hidden-volume approach
My threat model: I want sensitive files (documents/photos) to stay unreadable to anyone who gets full access to my device or cloud storage (theft, seizure, coercion at a border crossing), including someone who forces me to unlock the device or hand over a password. The goal isn't just encryption — it's that an adversary shouldn't even be able to prove a hidden vault exists, so I can't be coerced into revealing something I can plausibly deny having.
My current approach: I built a tool (StegVault) that encrypts data with AES-256-GCM and embeds it inside an ordinary photo via LSB steganography, plus a VeraCrypt-style hidden-volume mode — a decoy password reveals an empty/harmless vault, a separate real password reveals the actual data. Runs fully offline, single HTML file, no account/telemetry.
What I'm unsure about and want opsec feedback on:
- How resistant is plain LSB steganography to modern statistical steganalysis if an adversary specifically suspects steganography and runs detection tools against the image?
- Is a decoy-password hidden volume actually meaningful plausible deniability, or does the mere existence of the tool/technique undermine that (i.e., "why do you have StegVault installed" becomes suspicious on its own)?
- Any attack vectors on this threat model I'm underweighting — metadata, image compression artifacts re-encoding the stego image, etc.?
Not looking to just advertise it here — genuinely want to know where this breaks down from people who think about this stuff seriously. Happy to share more technical detail on the crypto/steganography implementation if useful.
(I have read the rules.)