Hacker News Reader

Thats not really bypassing it. The intention of the digital signature is "I trust John at AP, and this picture has a digital signature stating that this photo is taken by him, so I trust that its valid". You taking a photo of a photo just means that we now have a photo with your signature in it, and I never trusted you in the first place. To bypass it you have to trick John into faking a picture, or steal his cammera.

View on HN

That's true but then why does it need to be a hardware backed key as part of the camera?

It will be people who need to learn how to sign and encrypt and manage their keys.

Because that proves you didn’t photoshop it after taking it or sign an AI generated image

That's unrealistic in practice. What if the camera manufacturer or an employee of the camera manufacturer messes with it?

I don't believe it will be possible in practice to "granularize" trust like that. You trust a person or an institution (a person is already more ideal though). Going even further will not work in practice.

There's no need for that to be done on the camera then. John's photo manager can just add a PGP signature from his laptop. Except in practice this isn't needed. The fact that it was posted by John on the AP website is enough proof

Reply on news.ycombinator.com