The way I am thinking the stego would be pure noise, but you can also suspect any png with a lot of pure noise to be stego, but you can't actually prove it is stego if that noise does not decrypt or reveal that it is a message unless you have the proper decryption key and that is quite possible to achieve, and yes it is inefficient, but quite possible to do and use, you can also hide the noise in wave/flac files and other lossless formats, that will 100% for sure decompress to the same as the raw source file. You can also choose to be a regular image/flac file poster that produce a lot of stuff and put random noise in everything, then the few times you do want to send a message you do. Nobody will be able to tell the difference and just how many messages you send.
That might actually work, but to be honest, I'm not sure it's worth the effort, at least at this point in time.
That is used by russians and others where they have a constant link between two sites that is pure noise and sometimes they drop an encrypted message in there that sounds and looks like pure noise, but on the other end the keys reveal it to be a message and bring it to the attention of people. It is really no that hard to do.
My understanding is that what the Russians (and other governments) used in the past -- and still do -- are numbers stations. If you have a shortwave radio, you can still hear these if you tune in to the right frequencies at the right time. These messages are encrypted with one-time-pads, which are the only cryptographic system that is unbreakable in theory as well as in practice. (Naturally, that assumes that the pads themselves are not compromised, and that they are
never re-used.)
Because the messages are widely broadcast, there is no way to know who the intended recipient(s) are. The proper use of one-time-pads (OTPs), will ensure that these messages can never be broken.
Also it may be possible to use error correcting codes to make the images able to survive lossy compression too, of course within limits. So there could be messages hidden in jpg and other lossy formats as well.
I experimented with stego in image files, but that was so long ago, I can scarcely remember the details.
Honestly though email needs replacement for many reasons 
Email has its' flaws, but also its' advantages: it's ubiquitous, for starters. Many of the disadvantages of using email are more than compensated-for by use of nymservers and remailers. The infrastructure is already in place, it's just a matter of learning how to use it. The Cypherpunks designed these services
very well, and they have stood the test of time.
Also I have been thinking that I want to make a client that runs on top of proton.me that adds actual trust noone encryption to it, of course proton still tracks who talks to who, so if that is important to hide the other methods talked about here are better.
There is no need to re-invent the wheel, so why bother? You can use a protonmail account as a nymserver target. Any email from the nymserver is processed by a backend-remailer, and all metadata is stripped-off. Anyone examining your Protonmail box would not be able to see who has written to you, and Proton cannot be forced to decrypt your email, because they have zero access to the private half of the PGP key used to encrypt your email.
As far as Proton tracking who talks to who, that can be overcome by using a remailer to hide your correspondents' email addresses. All anyone who looks at your outgoing emails can see is that the emails are going to a remailer; they cannot see inside the message, as it is encrypted with the remailer's PGP key. (The same is true for nymservers -- any messages send to the nymservers are encrypted with the nymserver's PGP key -- so the most anyone can learn is that you are using nymservers and/or remailers.) Anyone looking in your Sent box or your Inbox sees only PGP-encrypted messages, with all metadata stripped-away.
For that matter, it isn't even necessary to use Protonmail -- there are any number of Tor-hidden-service based email services that are free to use -- the operators have no idea who you are. These services do not use JavaScript, and plain-text emails are better for security, as typically do not contain embedded executable (i.e. HTML) code. Some examples are:
Darknet Email Exchange (DNMX):
http://hxuzjtocnzvv5g2rtg2bhwkcbupmk7rclb6lly3fo4tvqkk5oyrv3nid.onion/ Sign-up is free, and the service does not require JavaScript. DNMX uses Squirrelmail, which is plain-text, as opposed to HTML.
N.B.: Do NOT click on any of the ads. Daniel's EMail:
http://danielas3rtn54uwmofdo3x2bsdifr47huasnmbgqzfrec5ubupvtpid.onion/mail/register.phpLike DNMX, Daniel's Email also uses Squirrelmail, and plain-text. Unlike DNMX, Daniel's Email is run by a identifiable person, so the potential for LE raids is there -- but the fact that the service is run as a Tor Hidden-Service means that Daniel has no idea who his users are, nor can he be compelled to find-out. Use of PGP/remailers will prevent any usable information from ever falling into the hands of the authorities.
One nice thing about Daniel's Email, (unlike DNMX) is that you can delete an account after you're done with it -- there are two options:
a) Delete an account such that the account name is locked for a year, meaning no one else can register with that name; or
b) Delete an account such that the account name is released immediately for re-use by someone else.
Ideally a tor/i2p site is set up where people can dump messages, that only the recipient can read, sender anonymous via the network, receiver(s) anonymous too, maybe if that tor site wants to save on resources the messages only persist for a certain amount of time, maybe only from people who have sent monero or similar anonymous currency to pay for their used space. Who knows.
I have many ideas about this too, just slow to implement them
Sites such as you are describing already exist -- temporary email services exist that hold emails for only a number of days, usually a maximum of 30. Some of them even allow additional password-protection. Two examples are: flashbox.5july.org and
https://tempr.email/en/ (N.B.: Tempr.email appears to require JavaScript).
also slightly weary of the techniques being used by actual bad people, but I know they will be, still as non criminals are being hunted by the governments we non criminals need to protect ourselves so the governments kind of are forcing us to make it impossible to hunt anyone, it is their own fault.
I suspect that you meant to write: "leery of the techniques used by actual bad people" instead of "weary of the techniques used by actual bad people". I don't see that as a valid argument, frankly.
Security researcher theGrugq, in his posting,
"Yardbird's Effective Usenet Tradecraft, Survival in an Extremely Adversarial Environment" [1] says:
"If your secure communications platform isn’t being used by terrorists and pedophiles, you’re probably doing it wrong. – [REDACTED]"In his notes from the Editor to the above-referenced post, he says:
When analyzing the activities of groups operating in an adversarial environment to learn what works, what doesn’t, and why, (unfortunately) the pool of covert organisations is somewhat limited: intelligence agencies; terrorist groups; hacker crews; narcos; insurgents; child pornographers… Few other groups face such a hostile operating environment that their security measures are really “tested”.
The group examined in this post had an incredibly effective set of security practices. They imposed strict compartmentation, regularly migrated identities and locations, required consistent Tor and PGP use, etc. They had legitimate punishments for people who transgressed the rules (expulsion) and they survived a massive investigation effort. Clearly, they were doing something right (actually a number of things). Just as clearly, they are reprehensible people who engage in activity that is immoral and unethical, by any measure. (Paying for child pornography to be produced is flat out wrong, regardless on where you stand on the spectrum of opinions regarding child porn laws).
The thing is, there are basically no nice people who provide case studies of OPSEC practices. Most are engaged in violence, serious drug trafficking (at the “kill people for interfering” level), theft and manipulation of human beings, etc. Thats the nature of the beast.
People with well funded, trained and motivated adversaries have the strongest incentives to practice the highest level of security. They’re the ones to learn from.
[1]
https://grugq.github.io/blog/2013/12/01/yardbirds-effective-usenet-tradecraft/Tell you what... generate a throw-away DNMX email account and drop me a line at: guy_fawkes@nym.mixmin.net
I can walk you through the process via email. Reading me talk about it is one thing; it's another to try it out for yourself and see how useful/effective it is.
Let me know if you're willing, ok?
Guy