Hacker News Reader

Comment by donaldihunter | Hacker News Reader

I don't think ZK proofs help to establish trust in a photo's authenticity at all. C2PA is a well thought out solution to this problem.

https://spec.c2pa.org/specifications/specifications/2.2/spec...

> The C2PA information comprises a series of statements that cover areas such as asset creation, edit actions, capture device details, bindings to content and many other subjects. These statements, called assertions, make up the provenance of a given asset and represent a series of trust signals that can be used by a human to improve their view of trustworthiness concerning the asset. Assertions are wrapped up with additional information into a digitally signed entity called a claim.

View on HN

I don't get how this is the only comment that doubts how their proofs work. There is zero detail or explanation of what they are proving

This is true, there is no detail.

The idea with zero knowledge proofs is that typically, photography metadata is stripped when it’s posted on Facebook. The proof would be a piece of metadata that COULD be safe to share in the SPECIFICS of what it proves. For example there is a circuit that can show that the photo was taken in the United States without leaking the specific location the photo was taken.

Presumably the authenticity scheme here is supposed to be, it answers it was taken on a real camera in a real place, without leaking any of the metadata. They are vague because probably that circuit (proving program and scheme) hasn’t been designed yet.

I also don’t know if it is possible to make useful assertions at all in such a scheme, since authenticity is a collection of facts (for example) and ZK is usually used to specifically make association of related facts harder.

Neal Krawetz of fotoforensics (and others probably) disagree that C2PA "is a well thought out solution"

https://www.hackerfactor.com/blog/index.php?%2Farchives%2F10... (search his blog if you want more of his thoughts on it)

I don't have a know enough bout this but I've been reading his blog for other topics a while and he does seem to know a lot about photo authenticity.

C2PA has the problem that it has a ton of optional metadata support and no well-defined strict validation procedure, so it's trivial to make fake photos appear valid using currently available C2PA enabled software.

They absolutely must define a much stricter mode that actually means something, and distinguish it from what they have now (which is essentially prototype level in terms of security model)

Reply on news.ycombinator.com