3 ms·

How exactly would this work? People take RAW photos. Load it up in a RAW editing tool. Manipulate it. Then load it in Gimp. Manipulate some more. Will the fin

by BeetleB 2mo ago

How exactly would this work? People take RAW photos. Load it up in a RAW editing tool. Manipulate it. Then load it in Gimp. Manipulate some more. Will the final result have the signature? And if it does, what use would it be?

Retr0id 2mo ago
In the imaginary dream world that Adobe, Google et al live in, the final file does indeed have a signature. Each piece of software in the chain must use TPM-like technologies (yes, even GIMP) to make sure it's running a "legitimate" build of the software, on "legitimate" hardware, and re-sign the file at each step along the way (using keys provisioned during some flavour of remote attestation flow, or using a RA-authenticated remote-signing oracle). The final file embeds every preceding manifest, so you can "verify" all the way back to the original. If this all sounds patently unworkable, that's because it is.
- BeetleB 2mo ago
  OK, but given that GIMP is a general purpose tool, what use is the signature if all of them verify it, when I can drastically change the image to whatever I want it to be?
  - Retr0id 2mo ago
    The manifests at each step can embed a thumbnail (although this is optional, iiuc!), so looking at the thumbnail history it should be obvious that the edit was significant.
    - BeetleB 2mo ago
      Yeah - I totally would not support that!
- account42 2mo ago
  I can't wait for poking memory of applications running on my computer to become a felony.
  - inigyou 2mo ago
    It already is.
    - picofarad 2mo ago
      No it isn't, cheatengine exists, Q.E.D.
      - inigyou 2mo ago
        If you use cheat engine to inject child porn into an image viewer is it legal?