3 ms·

I await cryptographically signed photos coming out of cameras. Actually I’ve said that should be the case for the last 20 years. You should be able to follow a

by neepi 1y ago

I await cryptographically signed photos coming out of cameras. Actually I’ve said that should be the case for the last 20 years. You should be able to follow a chain of evidence towards an unprocessed raw image potentially.

thih9 1y ago
There is ongoing work[1] and cameras that offer some support already[2]. [1]: https://en.m.wikipedia.org/wiki/Content_Authenticity_Initiative https://en.m.wikipedia.org/wiki/Content_Authenticity_Initiat... [2]: https://leica-camera.com/en-int/photography/content-credentials https://leica-camera.com/en-int/photography/content-credenti...
k2enemy 1y ago
There have been several initiatives in this direction. Here is one of the latest: https://contentauthenticity.org https://contentauthenticity.org
holowoodman 1y ago
There have also been calls for a mechanism like this to prevent doctored photos of controversial newsworthy events being spread by news agencies. But afaik the only thing that came off it was "we only pay for camera jpg, only allowed changes are brightness, contrast, color". Edit: sister comments have links.
bayindirh 1y ago
I think Nikon and Canon's past cameras had signed photos by default, and you could get the software for verification if you're a police dept or similar. Both manufacturer's keys got extracted from their cameras, rendering the feature moot. Now, a more robust iteration is probably coming, possibly based on secure enclaves. I'd love to have the feature and use it to verify that my images are not corrupted on disk.
- neepi 1y ago
  Used to work on archival. You want to store your images in TIFF and use FEC if you really care. That withstands significant bitrot. Signing will just tell you that the image is broken but not allow you to recover it. You can do fine with SHA256 and 3-2-1 backup.
  - bayindirh 1y ago
    Thanks for the heads-up, didn't know TIFF/FEC. However, I can't because the images are .ARW (Sony's camera raw format). I keep multiple copies with hashes of them currently. I check the disks periodically. Mid-term plan is to build an UNRAID array with patrolling. Will probably do backups with Borg on top of it, and keep another "working copy", so I have multiple layers of redundancy with some auto-remediation. UNRAID will keep disk level consistency in good shape. Patrolling will do checksum tests, Borg can check its own backups against bitrot and can repair them in most cases. Working copy will contain everything and refill if something unthinkable happens.
    - neepi 1y ago
      You have to convert to an archival format from whatever your raw format is. The issue with raw files is that they are compressed so any bitrot in those leads to more than just losing a pixel or two here or there but sometimes the entire file. TIFF is not compressed at all. FEC allows single pixel corrections to be done accurately. We had a metric shit ton of LTO tapes, changers and online disk cache that handled all that. I don't do that at home. I have 600GB of Nikon raws. I keep one copy on my Mac. I have a time machine backup in the house (in another room) on an Samsung T7 shield and I have an off site backup which is a quarterly rsync job to another Samsung T7 shield.
perching_aix 1y ago
Unfortunately that doesn't prove too much. It all hinges on the cameras, which are just computers, operating in a verifiable fashion. Which they don't, as no consumer available computer currently does, and I don't see this changing in the near future, both for technological and political reasons. I put a lot of effort into thinking about what could be proper trustable on photos and videos [0], but short of performing continuous modulation on the light sources the light of which is eventually captured by the cameras' sensors, there's no other way, and even that I'm not sure how would work with light actually doing the things its supposed to (reflection, refraction, scatter, polarization, etc.). And that's not even mentioning how the primary light source everyone understandably relies on, the Sun, will never emit such a modulated signal. So what will happen instead I'm sure, is people deciding that they should not let perfection be the enemy of good, and moving on with this stuff anyways. Except this decision will not result in the necessary corresponding disclaimers reaching consumers, and so will begin the age of sham proofs and sham disprovals, and further radicalization. Here's to hope I'm wrong, and that these efforts will receive appropriate disclaimers when implemented and rolled out. [0] related in a perhaps unexpected way: https://youtube.com/shorts/u-h5fHOcS88 https://youtube.com/shorts/u-h5fHOcS88
- dinfinity 1y ago
  Things should simply be signed by people and institutions. People who were there or did extensive research vouching for authenticity and accuracy of representation. Signing in hardware is nice, but you then still need to trust the company making the hardware to make it tamper proof and not tampered with by them. Additionally, such devices would have to be locked down to disallow things like manual setting of the time and date. It's a rabbit hole with more and more inconveniences and fewer benefits as you go down it. Better to just go for reputation, and webs and chains of trust in people based approaches.
  - deleted 1y ago
    [deleted]
- neepi 1y ago
  Yeah I'm not even talking about that side of things. I'm talking about after it leaves the camera. When someone shows you something, you should be able to say "I want to see the closest to original image". Humans make a lot of changes to images evidently to change perception. Even a simple crop can change the story being told. A good example: https://imgur.com/iqtFHHg https://imgur.com/iqtFHHg
hoseyor 1y ago
I will assume you simply mean cryptographically signed as evidence of having been taken by a camera? You do realize that would still not provide perfect proof that what was recorded by the camera was real, right? It does seem like an obsolete idea you may not have fully reconsidered in a while. But considering that same old idea that dates from prior to the current state, I would also not be surprised if you imagined clandestinely including all kind of other things in this cryptographic signature like location, time and day, etc.; all of which can also be spoofed and is a tyrannical system’s wet dream. You don’t think that would be immediately abused, as it was in other similar ways like through all the on device image scanning that was injected as counter-CSAM appeals to save the children…of course?
grues-dinner 1y ago
That fixes the problem of content being manipulated and then the original being discounted as fake when challenged. It doesn't do a whole lot for something entirely fictional, unless it becomes so ubiquitous that anything unsigned is assumed to be fake rather than just made on a "normal" device. And even if you did manage to sign every photo, who's managing those keys? It's the difference between TLS telling you what you see is what the server sent and trusting the server to send the truth in the first place.
lnrd 1y ago
What prevents anyone to take a signed picture by photographing a generated/altered picture? You just need to frame it perfectly and make sure there are no reflections that could tell it's a picture of a picture and not a picture of the real world, very doable with a professional camera. All details that could give it out would disappear just lowering the resolution, which can be done in any camera.
- grues-dinner 1y ago
  With a bit (OK quite a lot) of fiddling, you could probably remove the CCD and feed the analog data into the controller, unless that's also got a crypto system in it. Presumably if you were discovered you would then "burn" the device as its local key would be known then to be used by bad actors, but now you need to be checking all photos against a blacklist. Which also means if you buy a second hand device, you might be buying a device with "untrusted" output.
  - salawat 1y ago
    Any problem that requires cryptographic attestation or technical control of all endpoints is not a solution we should be pursuing. Think of it as a tainted primitive. Not to be implemented. The problem of Trust is a human problem, and throwing technology at it just makes it worse.
    - grues-dinner 1y ago
      I'm absolutely in agreement with that. The appetite for technical solutions to social problems seems utterly endless. This particular idea has so many glaring problems that one might almost wonder if the motivation is less about "preventing misinformation" or "protecting democracy" or "thinking of the children" or whatever, and more about making it easier to prove you took the photo as you sue someone for using it without permission. But any technology promoted by Adobe couldn't be about DRM, so that's just crazy talk!
rightbyte 1y ago
Wouldn't compression make the signature invalid? Feels kinda easy to fake anyways.

by neepi 1y ago

thih9 1y ago

There is ongoing work[1] and cameras that offer some support already[2]. [1]: https://en.m.wikipedia.org/wiki/Content_Authenticity_Initiative https://en.m.wikipedia.org/wiki/Content_Authenticity_Initiat... [2]: https://leica-camera.com/en-int/photography/content-credentials https://leica-camera.com/en-int/photography/content-credenti...

k2enemy 1y ago

There have been several initiatives in this direction. Here is one of the latest: https://contentauthenticity.org https://contentauthenticity.org

holowoodman 1y ago

There have also been calls for a mechanism like this to prevent doctored photos of controversial newsworthy events being spread by news agencies. But afaik the only thing that came off it was "we only pay for camera jpg, only allowed changes are brightness, contrast, color". Edit: sister comments have links.

bayindirh 1y ago

I think Nikon and Canon's past cameras had signed photos by default, and you could get the software for verification if you're a police dept or similar. Both manufacturer's keys got extracted from their cameras, rendering the feature moot. Now, a more robust iteration is probably coming, possibly based on secure enclaves. I'd love to have the feature and use it to verify that my images are not corrupted on disk.

neepi 1y ago
Used to work on archival. You want to store your images in TIFF and use FEC if you really care. That withstands significant bitrot. Signing will just tell you that the image is broken but not allow you to recover it. You can do fine with SHA256 and 3-2-1 backup.
- bayindirh 1y ago
  Thanks for the heads-up, didn't know TIFF/FEC. However, I can't because the images are .ARW (Sony's camera raw format). I keep multiple copies with hashes of them currently. I check the disks periodically. Mid-term plan is to build an UNRAID array with patrolling. Will probably do backups with Borg on top of it, and keep another "working copy", so I have multiple layers of redundancy with some auto-remediation. UNRAID will keep disk level consistency in good shape. Patrolling will do checksum tests, Borg can check its own backups against bitrot and can repair them in most cases. Working copy will contain everything and refill if something unthinkable happens.
  - neepi 1y ago
    You have to convert to an archival format from whatever your raw format is. The issue with raw files is that they are compressed so any bitrot in those leads to more than just losing a pixel or two here or there but sometimes the entire file. TIFF is not compressed at all. FEC allows single pixel corrections to be done accurately. We had a metric shit ton of LTO tapes, changers and online disk cache that handled all that. I don't do that at home. I have 600GB of Nikon raws. I keep one copy on my Mac. I have a time machine backup in the house (in another room) on an Samsung T7 shield and I have an off site backup which is a quarterly rsync job to another Samsung T7 shield.

perching_aix 1y ago

Unfortunately that doesn't prove too much. It all hinges on the cameras, which are just computers, operating in a verifiable fashion. Which they don't, as no consumer available computer currently does, and I don't see this changing in the near future, both for technological and political reasons. I put a lot of effort into thinking about what could be proper trustable on photos and videos [0], but short of performing continuous modulation on the light sources the light of which is eventually captured by the cameras' sensors, there's no other way, and even that I'm not sure how would work with light actually doing the things its supposed to (reflection, refraction, scatter, polarization, etc.). And that's not even mentioning how the primary light source everyone understandably relies on, the Sun, will never emit such a modulated signal. So what will happen instead I'm sure, is people deciding that they should not let perfection be the enemy of good, and moving on with this stuff anyways. Except this decision will not result in the necessary corresponding disclaimers reaching consumers, and so will begin the age of sham proofs and sham disprovals, and further radicalization. Here's to hope I'm wrong, and that these efforts will receive appropriate disclaimers when implemented and rolled out. [0] related in a perhaps unexpected way: https://youtube.com/shorts/u-h5fHOcS88 https://youtube.com/shorts/u-h5fHOcS88

dinfinity 1y ago
Things should simply be signed by people and institutions. People who were there or did extensive research vouching for authenticity and accuracy of representation. Signing in hardware is nice, but you then still need to trust the company making the hardware to make it tamper proof and not tampered with by them. Additionally, such devices would have to be locked down to disallow things like manual setting of the time and date. It's a rabbit hole with more and more inconveniences and fewer benefits as you go down it. Better to just go for reputation, and webs and chains of trust in people based approaches.
- deleted 1y ago
  [deleted]
neepi 1y ago
Yeah I'm not even talking about that side of things. I'm talking about after it leaves the camera. When someone shows you something, you should be able to say "I want to see the closest to original image". Humans make a lot of changes to images evidently to change perception. Even a simple crop can change the story being told. A good example: https://imgur.com/iqtFHHg https://imgur.com/iqtFHHg

hoseyor 1y ago

I will assume you simply mean cryptographically signed as evidence of having been taken by a camera? You do realize that would still not provide perfect proof that what was recorded by the camera was real, right? It does seem like an obsolete idea you may not have fully reconsidered in a while. But considering that same old idea that dates from prior to the current state, I would also not be surprised if you imagined clandestinely including all kind of other things in this cryptographic signature like location, time and day, etc.; all of which can also be spoofed and is a tyrannical system’s wet dream. You don’t think that would be immediately abused, as it was in other similar ways like through all the on device image scanning that was injected as counter-CSAM appeals to save the children…of course?

grues-dinner 1y ago

That fixes the problem of content being manipulated and then the original being discounted as fake when challenged. It doesn't do a whole lot for something entirely fictional, unless it becomes so ubiquitous that anything unsigned is assumed to be fake rather than just made on a "normal" device. And even if you did manage to sign every photo, who's managing those keys? It's the difference between TLS telling you what you see is what the server sent and trusting the server to send the truth in the first place.

lnrd 1y ago

What prevents anyone to take a signed picture by photographing a generated/altered picture? You just need to frame it perfectly and make sure there are no reflections that could tell it's a picture of a picture and not a picture of the real world, very doable with a professional camera. All details that could give it out would disappear just lowering the resolution, which can be done in any camera.

grues-dinner 1y ago
With a bit (OK quite a lot) of fiddling, you could probably remove the CCD and feed the analog data into the controller, unless that's also got a crypto system in it. Presumably if you were discovered you would then "burn" the device as its local key would be known then to be used by bad actors, but now you need to be checking all photos against a blacklist. Which also means if you buy a second hand device, you might be buying a device with "untrusted" output.
- salawat 1y ago
  Any problem that requires cryptographic attestation or technical control of all endpoints is not a solution we should be pursuing. Think of it as a tainted primitive. Not to be implemented. The problem of Trust is a human problem, and throwing technology at it just makes it worse.
  - grues-dinner 1y ago
    I'm absolutely in agreement with that. The appetite for technical solutions to social problems seems utterly endless. This particular idea has so many glaring problems that one might almost wonder if the motivation is less about "preventing misinformation" or "protecting democracy" or "thinking of the children" or whatever, and more about making it easier to prove you took the photo as you sue someone for using it without permission. But any technology promoted by Adobe couldn't be about DRM, so that's just crazy talk!

rightbyte 1y ago

Wouldn't compression make the signature invalid? Feels kinda easy to fake anyways.