3 ms·
Hi, These are all valid concerns. Programatically superimposed usage of the code is problematic for all the same problems as with EXIF manipulation, so the th
by miunau 5y ago
Hi,
These are all valid concerns.
Programatically superimposed usage of the code is problematic for all the same problems as with EXIF manipulation, so the thinking is to recommend using a physical prop (smartphone or paper) that makes it harder to fake the code in later. When combined with rapid distribution (to a news agency, live feed, Telegram or such), there's a period of time where I think it's unfeasible that someone would had tampered with it to future-date an older image.
It is possible to superimpose the code of course, as I noted:
"For example, when uploading photos through a messenger service, the service can sign the photos upon upload date and superimpose the QR Date onto it. Any further uploads to date the photo again would have to either crop the code out or otherwise mangle it so much that it would raise suspicion.
For videos, the QR Date can be superimposed as either moving around in the frame, switch places, or other motion to make it harder to superimpose another code later."
However these would only be indicative, not definite proof, and would need to be combined with other efforts- mainly deduplication, to find doubles.
For key storage and logging, I don't think it's my job to try to convince people to trust me with a private key (or logs) for the purposes of introducing this idea. Frankly I do not want the responsibility. If it ends up being useful, I would be happy to donate the domain to a reputable NGO or journalistic organisation for proper storage of the private key on a hardware device, contracts on how it and logs are handled, etc. In the meanwhile, if you want to trust the site, it's up to you just like with any CA.
I don't think a single online centralised authority would be a good idea in any case- it's why I'm trying to also consider situations where it can be used offline and by many organisations that each have their own requirements for trust.