3 ms·

One threat is that a malicious actor uses a compromised device to fake a "legitimate" verified image. This image can now be injected into the news cycle and be

One threat is that a malicious actor uses a compromised device to fake a "legitimate" verified image. This image can now be injected into the news cycle and be taken seriously. Keeping a secret on the camera is more or less the "jailbreak problem", aka being able to make a dvd player or console that only does the things that the manufacturer wants. I will be pretty sad if this problem is actually "solved" effectively because it portends a future where manufacturers can completely curtail user freedom. But... If the key on the device is compromised by reverse engineering or because the manufacturer is compromised then the whole root of trust is gone. Attackers can choose the weakest brand of camera. You now have some doubt about any image that has been "verified" because it could have come from a compromised camera secret. All the rest of the stuff, the blockchain, etc depends on the root of trust in the camera. You also now have debates around camera country of origin because there is no near future world where governments can't lean on local manufacturers. Finally, doubt can be thrown on images retro-actively if we later learn that a camera we thought was secure, has vulnerabilities.

chrisco255 6y ago
This isn't a "freedom" issue. And no, even if the private key on the device is hacked, you wouldn't be able to hack all the cameras (assuming the device manufacturer would embed a different key for each unit ID), you would still have to hack the OS and the User and the Phone's encryption. So the surface area of a hack would be small. You cannot fake all those signatures, you'd have to literally hack all that encryption. All of this would be optional, of course. People can always edit out metadata. But it would lend credence and authority to a photograph or video. Which would carry more weight in a court of law, for example, where this stuff really matters.
- xyzzy123 6y ago
  This is an interesting conversation because we both seem convinced we're "obviously right". I am clearly having trouble understanding your point of view. I apologise in advance if I'm mis-understanding your argument. Perhaps "First off, you'd have to steal the actual device" from upthread is the clue. I think the disconnect might be that you are working from a threat model where someone else is trying to tamper with an image from your camera. I agree you could make that arbitrarily difficult. But I am primarily concerned with the threat where someone is tampering with their own camera to fake evidence. This possibility makes it harder for you to prove that your own image is legitimate. Your reasoning implies that one or two hacked cameras are not a problem. To my way of thinking, the possibility that "at least 1 hacked camera exists" or "any camera could possibly be hacked" are enough to throw doubt on any "verified" images that someone tries to present in a high stakes context such as national security or the courtroom. We're back to debating provenance.
  - chrisco255 6y ago
    I don't know. I don't want to live in a world where someone can literally murder someone on camera and get away with it on a technicality. Witness testimony is already used in court and is quite unverifiable and subject to all sorts of psychological phenomenon where people sometimes believe they saw something entirely different than what actually happened. I think cryptographic signatures couldn't guarantee validity 100%, but they could improve the situation in a world of deep fakes on demand. It would require a larger degree of premeditation and effort to convincingly pull off a deep fake in that world.
    - krageon 6y ago
      > a technicality It's not a technicality if the video can't be distinguished from perfect nonsense. Just as you don't let someone with a documented history of hallucinations testify on their own.

chrisco255 6y ago

This isn't a "freedom" issue. And no, even if the private key on the device is hacked, you wouldn't be able to hack all the cameras (assuming the device manufacturer would embed a different key for each unit ID), you would still have to hack the OS and the User and the Phone's encryption. So the surface area of a hack would be small. You cannot fake all those signatures, you'd have to literally hack all that encryption. All of this would be optional, of course. People can always edit out metadata. But it would lend credence and authority to a photograph or video. Which would carry more weight in a court of law, for example, where this stuff really matters.

xyzzy123 6y ago
This is an interesting conversation because we both seem convinced we're "obviously right". I am clearly having trouble understanding your point of view. I apologise in advance if I'm mis-understanding your argument. Perhaps "First off, you'd have to steal the actual device" from upthread is the clue. I think the disconnect might be that you are working from a threat model where someone else is trying to tamper with an image from your camera. I agree you could make that arbitrarily difficult. But I am primarily concerned with the threat where someone is tampering with their own camera to fake evidence. This possibility makes it harder for you to prove that your own image is legitimate. Your reasoning implies that one or two hacked cameras are not a problem. To my way of thinking, the possibility that "at least 1 hacked camera exists" or "any camera could possibly be hacked" are enough to throw doubt on any "verified" images that someone tries to present in a high stakes context such as national security or the courtroom. We're back to debating provenance.
- chrisco255 6y ago
  I don't know. I don't want to live in a world where someone can literally murder someone on camera and get away with it on a technicality. Witness testimony is already used in court and is quite unverifiable and subject to all sorts of psychological phenomenon where people sometimes believe they saw something entirely different than what actually happened. I think cryptographic signatures couldn't guarantee validity 100%, but they could improve the situation in a world of deep fakes on demand. It would require a larger degree of premeditation and effort to convincingly pull off a deep fake in that world.
  - krageon 6y ago
    > a technicality It's not a technicality if the video can't be distinguished from perfect nonsense. Just as you don't let someone with a documented history of hallucinations testify on their own.