3 ms·

It would be extremely hard for almost anyone to do so, and they can use signatures with per camera tokens as well as global ones. That way compromising one came

It would be extremely hard for almost anyone to do so, and they can use signatures with per camera tokens as well as global ones. That way compromising one camera doesn't compromise all. And there is a lot more stuff they can do to prevent such naive attacks. By your simple reasoning, all iphones would be cracked, yet even the USA govt hasn't been able to crack into them. And what they propose is vastly better than doing nothing.

myrryr 4y ago
They need to do no such thing. They never need to access the key, or anything remotely like it. They do need to push other images from where the sensor would be :). And is it better than nothing? I think having having which people may treat ad evidence which is trivial to fake is worse than something which people won't treat as evidence
- ChrisLomont 4y ago
  >They do need to push other images from where the sensor would be :). Yes, taking a new photo. However, a photo of a photo is going to show artifacts in the frequency spectrum that should not be difficult to detect. So they cannot edit a picture, even trying to feed it back into the sensor. And. if the signing is built into the die of the sensor, it would take incredible resources to even attempt to feed new data into the sensor grid itself, tech vastly beyond anyone but a nation state. >I think having having which people may treat ad evidence which is trivial to fake is worse than something which people won't treat as evidence So you're against police body cams, because everyday people might be faking all the bad police interactions? Because all cameras I've looked into would be easier to tamper with than one designed with signed images that's done well.
noodlesUK 4y ago
> By your simple reasoning, all iphones would be cracked, yet even the USA govt hasn't been able to crack into them. I don’t think this is quite the right takeaway. What the threat model is for this is not that you’d be able to crack any iPhone you like in whatever circumstances, but rather more like jail breaking one. Jailbreaks definitely exist, and depending on your need, you’d only need to jailbreak one, once. Even with a per-device token, if what you need is to generate a validly signed photo that has been manipulated (say for a passport photo or forensics), you’d be able to do that.
- ChrisLomont 4y ago
  That's not clear. If they designed it well, the photo comes off the sensor into the equivalent of Apple's Secure Enclave, gets signed, then the data reaches the level where jailbreaks could touch it. It would be profoundly stupid (and unlikely) that Sony would send data from the sensor to software, then sign using keys simply read into software. So no, jailbreaks very likely would have zero ability to sign an image.

myrryr 4y ago

They need to do no such thing. They never need to access the key, or anything remotely like it. They do need to push other images from where the sensor would be :). And is it better than nothing? I think having having which people may treat ad evidence which is trivial to fake is worse than something which people won't treat as evidence

ChrisLomont 4y ago
>They do need to push other images from where the sensor would be :). Yes, taking a new photo. However, a photo of a photo is going to show artifacts in the frequency spectrum that should not be difficult to detect. So they cannot edit a picture, even trying to feed it back into the sensor. And. if the signing is built into the die of the sensor, it would take incredible resources to even attempt to feed new data into the sensor grid itself, tech vastly beyond anyone but a nation state. >I think having having which people may treat ad evidence which is trivial to fake is worse than something which people won't treat as evidence So you're against police body cams, because everyday people might be faking all the bad police interactions? Because all cameras I've looked into would be easier to tamper with than one designed with signed images that's done well.

noodlesUK 4y ago

> By your simple reasoning, all iphones would be cracked, yet even the USA govt hasn't been able to crack into them. I don’t think this is quite the right takeaway. What the threat model is for this is not that you’d be able to crack any iPhone you like in whatever circumstances, but rather more like jail breaking one. Jailbreaks definitely exist, and depending on your need, you’d only need to jailbreak one, once. Even with a per-device token, if what you need is to generate a validly signed photo that has been manipulated (say for a passport photo or forensics), you’d be able to do that.

ChrisLomont 4y ago
That's not clear. If they designed it well, the photo comes off the sensor into the equivalent of Apple's Secure Enclave, gets signed, then the data reaches the level where jailbreaks could touch it. It would be profoundly stupid (and unlikely) that Sony would send data from the sensor to software, then sign using keys simply read into software. So no, jailbreaks very likely would have zero ability to sign an image.