Hacker News Reader

Comment by _verandaguy | Hacker News Reader

Leica started doing this a few years ago in response to the first wave of AI images[0]. Other, bigger manufacturers (Nikon, Canon, Sony as well I believe) have also joined, though with less fanfare. Adobe is in the loop.

As someone with a passing interest in infosec and cryptography, I'm sceptical of the long-term viability of this kind of product; it only takes one person successfully extracting a signing key to undermine the entire project.

    [0] https://leica-camera.com/en-int/news/partnership-greater-trust-digital-photography-leica-and-content-authenticity-initiative

View on HN

Yes, you're correct about private keys getting exposed, but it's better than nothing. I suspect though, even after key exposure there may be a way to make new private keys so that compromised keys have a known point when they are compromised, which makes public how much skepticism we should all have about authenticity.

I just think there is a world of difference between "certainty" and "plausibility" when it comes to videos on the internet. Yes, state actors might circumvent it, and skepticism should remain, but there is a world of difference between North Korea trying to convince me of some political scandal, and Pepsi Co trying to convince me that someone I trust loves Pepsi.

Cameras have a very long lifespan. People will still be using those cameras 20 years after the keys for their model get leaked.

And they will also get firmware updates.

I currently use a 2008 Fujifilm camera and a 2018 Sony. The Fujifilm doesn’t even have a firmware update mechanism, and the Sony camera doesn’t get updated anymore. These devices are rarely connected to the internet and never go obsolete so they get used until they break.

There might be a specialised line of cameras for forensics that signs the output and has lidar to detect when the camera is pointed at a screen, but the average person won’t have a camera with this kind of crypto. It would just be too easy for hackers to extract the keys from.

Reply on news.ycombinator.com