Plaintext
Convoy leaves the north gate at 0600, three trucks.
Flagged: keywords
Defense Innovation UnitCommunication MaskingTeam MagCT
Welcome to the other side of the board.
Sensitive message in.
Ordinary conversation out.
Obscure masks sensitive message content as ordinary conversation. The intended recipient recovers the original message.
01 / The problem
Encryption is a flag too.
People in the field still send sensitive information over WhatsApp and SMS. Filters flag the keywords. Encrypting the message doesn't help, because a block of scrambled characters is the most suspicious text on the network.
Encrypted
U2FsdGVkX1+q9Lr0Vx7kTz3bN8w1hQe…
Flagged: ciphertext
Obscure
Heading out early tomorrow, can you save me a seat by the window?
Passes: looks like small talk
Illustrative messages. Every cover is written fresh for each message.
02 / Try it
Which one is hiding something?
We open the pitch with this question. Pick the message you think is carrying a secret.
03 / How it works
Four steps. One ordinary sentence.
- 01
Write
Type the real message on your phone. It stays on the device and is never sent as typed.
- 02
Cover
A language model writes one ordinary text for it, a few seconds per cover, in the local language if you want.
- 03
Seal
Your phone locks the real message with AES-GCM, using a one-time key tied to that exact cover. The server keeps only the cover's fingerprint and the locked copy.
- 04
Open
Send the cover through any app. The receiver pastes it into Obscure, the fingerprint finds the locked copy, and the message opens.
SecretNorth gate, 0600
Cover“Heading out early tomorrow…”
Server seessha-256 · sealed bytes
ReceiverNorth gate, 0600
04 / Use it
Send your first hidden message.
Two phones, any chat app, about a minute. Both people need Obscure open; nobody needs an account.
- Both
Open Obscure
Go to uchess.pages.dev/app. To keep it, choose Add to Home Screen: it installs as "uChess" with a chess icon.
- Sender
Write and encode
On the Send tab, type the real message. Under Make the cover sound like, pick a topic or language if you like. Tap Encode.
- Sender
Copy and send
A few seconds later an ordinary-sounding message appears. Tap Copy message and send it in WhatsApp, SMS or any chat, like any other text.
- Receiver
Paste and decode
Open Obscure, go to Receive, and paste the text. Copying it straight from the chat, names and times included, is fine. Tap Decode.
- Both
Leave no trace
Messages open for 24 hours, then they're gone. The Panic tab clears the cache, or wipes the app entirely and drops back to chess.
05 / Two doors
Hidden behind a chess site.
On the phone and in the browser history, Obscure presents as uChess, a working chess site. That is the front door. This page is the other one.
The front: uChess
A working chess site, with a computer opponent, puzzles, a move list and a chat box. Team members have a way in from there; nobody else sees anything but chess.
uchess.pages.dev →The direct way: this site
The portfolio of what Obscure is and how it works, for judges, partners and the team. It links straight into the same app.
Open the app →06 / In the field
Built for a phone that might get checked.
Panic wipe
One code clears the app's storage, caches and service worker, then drops back to the chess page.
Self-cleaning
The cache clears after every send, and every 15 minutes while the app is open, with a visible countdown.
Covert at the OS level
Installed, it is "uChess" with a chess-king icon. Its tab title and history entries read as chess.
Any language
Covers can be written in Spanish, French, Arabic and more, so the chatter matches the place.
No ID in the message
The cover carries no code or link. The receiver finds the message by the text alone.
Expires in 24 hours
Sealed messages are one-time and short-lived. Nothing waits on the server for long.
07 / Honest limits
Current security scope.
- It hides content, not contact. Who talks to whom, and when, is still visible to anyone watching the traffic.
- The server holds the one-time keys. A production build needs per-user keys and a real key exchange.
- A web page can't erase browser history. The panic wipe clears the app's own footprint, not the browser's global history.
- Independent security audit. The current build has not undergone an independent security audit. Demonstrations use benign sample messages.
08 / Who's building it
Team MagCT, with DIU.
Obscure is built by a five-person team working with the Defense Innovation Unit on its Communication Masking problem: hiding what a message says, without making it look hidden.
The team
- Daniel
- Sarah
- Maggie
- Sylvana
- João
Partner
Defense Innovation Unit · Resilient Communications