Re: Spook MIME Boundaries

[Florian Weimer <fw@deneb.enyo.de>]

* Greg Stark:

>> More effective would be BEGIN PGP MESSAGE line, followed by random
>> base64 encoded junk.
>
> At this point anybody listening would pretty much have to be able to base64
> decode at wirespeed anyways.

No, you just look for "BEGIN PGP MESSAGE", and then you store the IP
addresses involved (and, if possible, email addresses seen earlier on
the same connection).  Traffic analysis is an extremely effective tool
for many applications, and concentrating on encrypted traffic reduces
the data set very nicely.

Something like

-----BEGIN PGP MESSAGE-----

jA0EAwMC4/o8ylG480Ngye38oMxjWBRvkIexOLnESJ07wjS18zZLJJnHkX8CBFG0
8CV61rhpf9CyIj/vZp3TZZhSRjPRuEhHgQ4fE+zUDY5xW4Kx4CffXzJSFEKMcTf6

in your signature would fool some *real* heuristics.