Hacker News Reader

Comment by neepi | Hacker News Reader

I await cryptographically signed photos coming out of cameras. Actually I’ve said that should be the case for the last 20 years.

You should be able to follow a chain of evidence towards an unprocessed raw image potentially.

View on HN

Unfortunately that doesn't prove too much. It all hinges on the cameras, which are just computers, operating in a verifiable fashion. Which they don't, as no consumer available computer currently does, and I don't see this changing in the near future, both for technological and political reasons.

I put a lot of effort into thinking about what could be proper trustable on photos and videos [0], but short of performing continuous modulation on the light sources the light of which is eventually captured by the cameras' sensors, there's no other way, and even that I'm not sure how would work with light actually doing the things its supposed to (reflection, refraction, scatter, polarization, etc.). And that's not even mentioning how the primary light source everyone understandably relies on, the Sun, will never emit such a modulated signal.

So what will happen instead I'm sure, is people deciding that they should not let perfection be the enemy of good, and moving on with this stuff anyways. Except this decision will not result in the necessary corresponding disclaimers reaching consumers, and so will begin the age of sham proofs and sham disprovals, and further radicalization. Here's to hope I'm wrong, and that these efforts will receive appropriate disclaimers when implemented and rolled out.

[0] related in a perhaps unexpected way: https://youtube.com/shorts/u-h5fHOcS88

Things should simply be signed by people and institutions. People who were there or did extensive research vouching for authenticity and accuracy of representation.

Signing in hardware is nice, but you then still need to trust the company making the hardware to make it tamper proof and not tampered with by them. Additionally, such devices would have to be locked down to disallow things like manual setting of the time and date. It's a rabbit hole with more and more inconveniences and fewer benefits as you go down it.

Better to just go for reputation, and webs and chains of trust in people based approaches.

Yeah I'm not even talking about that side of things. I'm talking about after it leaves the camera. When someone shows you something, you should be able to say "I want to see the closest to original image". Humans make a lot of changes to images evidently to change perception. Even a simple crop can change the story being told.

A good example: https://imgur.com/iqtFHHg

Yeah, that's a good point. Kind of ties in with the video I linked. Also reminds me a bit to how in modern video containers the film grain is usually a separate thing, and is rendered onto the image during playback. One can imagine turning on a view where the modified parts of the image would become highlighted, assisting with speculations on what might have been altered and how.

I didn't mention this in my previous comment, but after having thought about it even further, I've eventually arrived at the idea that there can be basically an arbitrary amount of meaning embedded onto a photo or a video, and it being "verified" to me as a human really just means "it is what I think I'm looking at" - that's when I realized this task is likely unsolvable in absolute terms, and just how much more difficulty lies beyond the already hopelessly difficult crackpot idea of light source signal modulation that I came up with prior. But yeah, as I suggested, these are just what I could think of, and perfection should indeed not be the enemy of good.

“I thought about it and couldn’t come up with anything so this is a dead end.”

What a load of nonsense. A little bit of humility and a basic understanding of history should quickly make you realize that.

OPs point is far more interesting and deserves more discussion

I don't understand your hostility. There's nothing in what I wrote or in the way I wrote that would suggest to a good faith reader that my opinion is absolute, that I consider my opinion fact, or that my knowledge is all-encompassing. In your own words I merely "thought about it" - a phrase that means exactly just that, and nothing more. In a way, it's literally a request for further thoughts by others to make up for what I might have not thought of; the exact admission you're looking for, just stated implicitly.

It's immensely frustrating to dress up a natural language sentence with enough precision to try and account for all and every bit of nuance, so you should anticipate and actively consider that I have missed or implied some.

Despite this, you clearly did not, and instead went into attack mode on the assumption(!) that I did miss them intentionally.

I'd recommend you take your own advice on intellectual humility before offering it to others.

> OPs point is far more interesting and deserves more discussion

The idea of "cryptographically signed photos coming out of cameras"? It's been discussed to death and is essentially a hope for magic technology to solve our social problems.

Also it won't work, technically: it's like asking for perfect a DRM implementation to be universally implemented everywhere.

I think Nikon and Canon's past cameras had signed photos by default, and you could get the software for verification if you're a police dept or similar.

Both manufacturer's keys got extracted from their cameras, rendering the feature moot. Now, a more robust iteration is probably coming, possibly based on secure enclaves.

I'd love to have the feature and use it to verify that my images are not corrupted on disk.

Used to work on archival. You want to store your images in TIFF and use FEC if you really care. That withstands significant bitrot. Signing will just tell you that the image is broken but not allow you to recover it. You can do fine with SHA256 and 3-2-1 backup.

Thanks for the heads-up, didn't know TIFF/FEC. However, I can't because the images are .ARW (Sony's camera raw format). I keep multiple copies with hashes of them currently. I check the disks periodically.

Mid-term plan is to build an UNRAID array with patrolling. Will probably do backups with Borg on top of it, and keep another "working copy", so I have multiple layers of redundancy with some auto-remediation.

UNRAID will keep disk level consistency in good shape. Patrolling will do checksum tests, Borg can check its own backups against bitrot and can repair them in most cases. Working copy will contain everything and refill if something unthinkable happens.

You have to convert to an archival format from whatever your raw format is. The issue with raw files is that they are compressed so any bitrot in those leads to more than just losing a pixel or two here or there but sometimes the entire file. TIFF is not compressed at all. FEC allows single pixel corrections to be done accurately. We had a metric shit ton of LTO tapes, changers and online disk cache that handled all that.

I don't do that at home. I have 600GB of Nikon raws. I keep one copy on my Mac. I have a time machine backup in the house (in another room) on an Samsung T7 shield and I have an off site backup which is a quarterly rsync job to another Samsung T7 shield.

There is ongoing work[1] and cameras that offer some support already[2].

[1]: https://en.m.wikipedia.org/wiki/Content_Authenticity_Initiat...

[2]: https://leica-camera.com/en-int/photography/content-credenti...

What prevents anyone to take a signed picture by photographing a generated/altered picture? You just need to frame it perfectly and make sure there are no reflections that could tell it's a picture of a picture and not a picture of the real world, very doable with a professional camera. All details that could give it out would disappear just lowering the resolution, which can be done in any camera.

With a bit (OK quite a lot) of fiddling, you could probably remove the CCD and feed the analog data into the controller, unless that's also got a crypto system in it.

Presumably if you were discovered you would then "burn" the device as its local key would be known then to be used by bad actors, but now you need to be checking all photos against a blacklist. Which also means if you buy a second hand device, you might be buying a device with "untrusted" output.

Any problem that requires cryptographic attestation or technical control of all endpoints is not a solution we should be pursuing. Think of it as a tainted primitive. Not to be implemented.

The problem of Trust is a human problem, and throwing technology at it just makes it worse.

I'm absolutely in agreement with that. The appetite for technical solutions to social problems seems utterly endless.

This particular idea has so many glaring problems that one might almost wonder if the motivation is less about "preventing misinformation" or "protecting democracy" or "thinking of the children" or whatever, and more about making it easier to prove you took the photo as you sue someone for using it without permission. But any technology promoted by Adobe couldn't be about DRM, so that's just crazy talk!

There have been several initiatives in this direction. Here is one of the latest: https://contentauthenticity.org

There have also been calls for a mechanism like this to prevent doctored photos of controversial newsworthy events being spread by news agencies. But afaik the only thing that came off it was "we only pay for camera jpg, only allowed changes are brightness, contrast, color".

Edit: sister comments have links.

That fixes the problem of content being manipulated and then the original being discounted as fake when challenged.

It doesn't do a whole lot for something entirely fictional, unless it becomes so ubiquitous that anything unsigned is assumed to be fake rather than just made on a "normal" device. And even if you did manage to sign every photo, who's managing those keys? It's the difference between TLS telling you what you see is what the server sent and trusting the server to send the truth in the first place.

Wouldn't compression make the signature invalid? Feels kinda easy to fake anyways.

I will assume you simply mean cryptographically signed as evidence of having been taken by a camera?

You do realize that would still not provide perfect proof that what was recorded by the camera was real, right? It does seem like an obsolete idea you may not have fully reconsidered in a while.

But considering that same old idea that dates from prior to the current state, I would also not be surprised if you imagined clandestinely including all kind of other things in this cryptographic signature like location, time and day, etc.; all of which can also be spoofed and is a tyrannical system’s wet dream.

You don’t think that would be immediately abused, as it was in other similar ways like through all the on device image scanning that was injected as counter-CSAM appeals to save the children…of course?

Reply on news.ycombinator.com