Each lever in the Paranoia Guide, explained
A deeper read on the five levers in Stiger's Paranoia Guide — what threat each one addresses, what it actually does, and what it doesn't do. Pick the levers that match your situation.
Stiger ships with a five-step Paranoia Guide. Each step is a lever you can pull or skip. Pulling all of them is overkill for most people; pulling none of them is fine for sending hidden jokes. The point of this article is to lay out what each lever protects against, so you can decide honestly which ones you need.
The threat model behind every lever is the same shape: someone, somewhere, might inspect this conversation later. Sometimes that’s a casual snoop on an unlocked phone. Sometimes that’s a forensic reviewer scrolling chat history at a border crossing. The levers stack to make different things hard for that adversary.
1. What are you hiding?
The concept. Not all uses of Stiger have the same stakes. Sending your partner a heart-shaped sticker that secretly says “missing you” is not the same threat model as sending a source’s contact to a journalist. The first lever isn’t a setting — it’s the question itself.
What Stiger does. Out of the box, with no setup, Stiger will hide text inside a sticker. Anyone who has Stiger installed and drags the sticker into it will reveal that text. There’s no encryption gate by default.
Why this matters. If your worst-case scenario is “my friend with Stiger sees the joke,” you don’t need encryption, biometrics, or manual send. You need the rest of this guide only when the contents matter.
What it doesn’t do. No setting in Stiger can turn a low-stakes hidden message into a high-stakes one. The first decision is yours: how bad is it if this gets read? Pick levers from there.
2. Blend in
The concept. Steganography is “hide in plain sight.” Plain sight means the carrier looks ordinary. If every sticker you ever send through Stiger has a hidden message, the pattern itself is a signal — even without the contents.
What Stiger does. A short tap sends the sticker as-is, no payload. Long press opens the secret-message input. The same pack, the same UI, the same iMessage thread can carry a mix of plain stickers and stealth ones. To anyone watching, including someone scrolling your chat history later, it’s just a person who likes stickers.
Why risk drops. A forensic reviewer doing keyword scan of a chat log sees no keywords. A reviewer doing pattern scan sees a noisy mix of ordinary sticker traffic. The hidden ones don’t stand out.
What it doesn’t do. Blending in protects the pattern. It does not protect the contents if someone with Stiger and your password decodes a specific sticker. That’s what the password lever is for.
3. Add a physical lock
The concept. End-to-end encryption protects you from the network and from Apple. It does not protect you from someone holding your unlocked phone. The Messages app is open; the stickers are right there; drag one into Stiger and your secrets spill.
What Stiger does. With Face ID (or Touch ID, or device passcode) required, the reveal screen and password input are gated behind a biometric or passcode prompt. Stickers stay visible in the iMessage extension — they’re just images — but extracting their hidden content requires the lock.
Why risk drops. Two common scenarios become safer:
- A friend grabs your unlocked phone “to text someone.” They open Messages, see stickers, drag one into Stiger out of curiosity. Without the lock, the hidden text appears. With it, they get a Face ID prompt that isn’t theirs.
- Briefly handing your unlocked phone to a stranger — a customs officer scrolling, a clerk verifying something, a curious friend. Same protection, same outcome.
What it doesn’t do. This is the unlocked-phone lever, not the compelled-unlock lever. If someone forces you to authenticate — at a border, in a hostile interview — the lock opens for them too. For that threat, the answer is upstream: don’t have the carrier installed during the search, or don’t carry the phone you decoded on.
4. Go dark
The concept. When you send a sticker through an iMessage extension, the bubble carries a small attribution from the source app. The attribution is itself a signal: a chat-log reviewer scrolling through history can see that some of these stickers came from a steganography tool, even without opening any of them.
What Stiger does. With manual send mode on, Stiger copies the sticker to your clipboard instead of inserting it directly. You then paste it into iMessage yourself. The sticker arrives as an ordinary image attachment, with no extension attribution attached.
Why risk drops. The signal disappears. A reviewer scanning the chat for the steganography-tool attribution finds none. The image looks like any other image someone saved and pasted.
What it doesn’t do. It does not hide the image bytes themselves. A forensic tool that knows what to look for — LSB statistics, the padding chunk inside the PNG, the fact that it’s an image attachment rather than a native sticker — can still flag the carrier as suspicious if it inspects every image in the thread. This lever protects the casual metadata read, not the targeted forensic read.
5. Lock your secrets
The concept. Hidden isn’t private. Without encryption, anyone with Stiger installed can drag a sticker into it and read its hidden text. “Hidden” keeps you safe from people who don’t have the app. “Encrypted” keeps you safe from people who do.
What Stiger does. With a password set, the hidden payload is encrypted with AES-256-GCM, keyed via PBKDF2-SHA256 with 600,000 iterations. Stiger never sends the password to a server; it leaves your phone only if you pair by QR, encrypted for your partner’s device. The recipient needs Stiger Pro and the same password to decode.
Why risk drops. Now the threat shifts entirely. A stolen phone with Stiger installed cannot read incoming stickers without the password. A forensic tool extracting sticker bytes from chat history cannot brute the contents with a good password — 600k PBKDF2 iterations slow every guess down. A short one still falls: a 6-character password takes hours on commodity GPUs, so use a long passphrase. Without the key the payload is random-looking bytes, though steganalysis can still tell that something is hidden.
What it doesn’t do. The password is a pre-shared secret — Stiger is not a key-exchange protocol. You and your recipient have to agree on the password through a trusted channel. Sending the password through iMessage itself defeats the purpose; the threat model assumes iMessage is the channel you don’t fully trust. Use a voice call, an in-person meet, or a different secure messenger to share the password once. After that, every sticker you exchange in iMessage is locked.
Picking your levers
Not every lever fits every user. A rough mapping:
- Toy / hidden notes / fun. Skip everything. Default Stiger is fine.
- Personal stuff that shouldn’t be casually readable. Set a password, add a Face ID lock. That’s two levers.
- Restricted-region use, real stakes. All five. The “What are you hiding?” question reframes itself: what’s the cost if this gets read?
- Journalists, sources, recipients you don’t fully trust the app surface around. All five, plus the threat model read in full. There are limits Stiger doesn’t paper over.
The Paranoia Guide in the app shows your current score and which levers are active. This article is the longer version of why each one is on that list.
Read more: The threat model in plain English, or What iMessage actually keeps private.