7 ms·
C2PA Cameras Do Not Survive Contact with Reality
- hydraterms 2mo ago[flagged]
- jazzyjackson 2mo agoI would be interested in a note on whether Sony / Leica / Olympus “content credentials” do any better with their hardware to ensure a signature is assigned to data straight off the sensor.
- EmbarrassedHelp 2mo agoWhy would someone paying for an expensive camera to damage the pixels of their images with "invisible" watermarks?
- MadnessASAP 2mo agoThe signature doesn't touch the image data in any way. It's just a piece of metadata attached to the image, like any other metadata tag.
- Retr0id 2mo agoUnfortunately they're a little outside of my tinkering budget, but if anyone wants to send me some I'll do my best to pwn them. Can't be any harder than a Google flagship, one would imagine. I have ordered a faulty Sony A7 IV motherboard, but due to its faulty-ness and the lack of the rest of the camera, I'm not sure how far I'll be able to get with it.
- kiddico 2mo agoCould you make use of a Sony a6000?
- Legend2440 2mo agoMy bet is they do considerably worse. Digital cameras are not designed with security in mind. Arbitrary code execution has been achieved on many DSLRs and there's even been open-source firmware projects for some.
- ethagknight 2mo agoI got a good laugh out of the "unblur to verify" first image. I dont know what I was expecting to see.
- andrewflnr 2mo agoAs far as AI-generated images go, that was a good one.
- tescreal 2mo agoI expect the only plausible chance (and it is a stretch) will be at-the-censor marking. Quantum bla bla magic pixie dust or unicorn farts something. The chance of a trustworthy (including from nation-state tampering a la Stalin et al) means of verification of digital anything is as good as dead imho.
- tashian 2mo agoI have a feeling Apple is going to knock it out of the park on this when they get around to it. They have a great foundation for doing image provenance well. The device attestation workflows are already there. And the same attacks that work against Android won't be as easy or effective because of Secure Enclave. Apple could run the whole signing process inside SEP. And, Apple could choose to integrate a LiDAR depth map into the signed photo as a mitigation against the analog attacks (eg. pictures of screens).
- deleted 2mo ago[deleted]
- gyomu 2mo agoApple isn’t going to touch this with a 10-foot pole. The provenance “proof” these approaches provide is very tenuous and nowhere near the “this is a real photo of a real world event taken by a real camera and not an AI image” proof that marketing types like to push. Apple doesn’t want a PR disaster where some crazy image is totally fake but becomes world news because it is “cryptographically signed as being from a real iPhone so it must be real!”
- deleted 2mo ago[deleted]
- Legend2440 2mo agoApple is working on their own system, which is expected to launch with IOS 27: https://www.macrumors.com/2026/08/10/ios-27-apple-reference-image/ https://www.macrumors.com/2026/08/10/ios-27-apple-reference-... >Images captured with an opt-in Reference mode can be authenticated to confirm they were taken with an iPhone. Authenticating is done by tapping the Reference badge on the image, which sends the raw image, sensor signatures, capture time frame, and the unique hardware identifiers of the sensor to Apple's Private Cloud Compute (PCC) servers. PCC uses the information to determine whether the camera captured the photo, gives it a unique ID, and then returns an authenticated version to the user's device.
- 2mo ago
- uqers 2mo agoI'm very surprised Google put in so much effort to implement an approach that is basically the equivalent of client-side verification of passwords. Did no one designing it mention that it could be defeated by any rooted device?
- demibabs 2mo agoNot any rooted device, it must be rooted via an exploit. Still pretty bad, though
- 12_throw_away 2mo agoActually I think this approach is very forward looking! Attestation is on the cusp of becoming a very powerful technique. We just need to figure out how to build 100% bug-free and 100% secure hardware and software, and then it's gonna work great.
- genxy 2mo agoWait a minute. I think you might have forgotten a /s, I can spot this kinda thing.
- akersten 2mo agoWell, all one has to do is look at the bigger picture of how rooted devices are being shuffled into 3rd rate/totally blocked experiences and the overall direction of things starts to take very clear shape. At over a decade old, still prescient as ever: https://www.youtube.com/watch?v=HUEvRyemKSg https://www.youtube.com/watch?v=HUEvRyemKSg
- RGamma 2mo agoSomeone better figure out how to make computing devices at home from everyday parts because the only way I see this (shockingly rapid) arms race end is legally mandated, cryptographically locked down hardware and software (or even thin clients) everywhere. RMS must be having daily nightmares at this point. P.S.: Fantastic talk you linked there.
- 2mo ago
- randomblock1 2mo agoEven at the hardware level, if it was a separate chip that the camera data passed through or something, that's not really good enough either, people have broken TPMs before. It'd have to be baked into the camera sensor. Even then, you could attack it from the next level up, with some fancy optics and a display, or something like that. I don't think completely solving this sort of problem is even possible.
- duskwuff 2mo agoAnd I'm not sure it's even useful to solve. The presence/absence of a digital signature will never be the deciding factor in whether people accept/reject an image as authentic.
- wisty 2mo agoI can break it with zero skills. Tripod, camera, clear monitor in a dark room ... just take a real photo of a fake photo.
- jedbrooke 2mo agosee also https://en.wikipedia.org/wiki/Telecine https://en.wikipedia.org/wiki/Telecine
- Terr_ 2mo agoThat might be detectable if they signed content contains focal-length metadata... but even then, some foresight and a collection of lenses would hide it.
- ipython 2mo agoWouldn’t the introduction of the lidar signals embedded in the photo (say used with apple’s faceid system) help here?
- deleted 2mo ago[deleted]
- SecuriLayer 2mo ago[flagged]
- xyzsparetimexyz 2mo agoSurely the easiest thing to target is photos taken by journalists and modifications, down sampling etc when shared to twitter?
- fenestella 2mo ago[flagged]
- mistercow 2mo agoAside from the fact that this was obviously never viable and the entire problem is clearly unsolvable if you sit down and really probe it for fifteen minutes, what I find most frustrating about this is that the false promise of preserving photos as reliable evidence is actively harmful. You will not build a perfect system, or even something near perfect. The best you're going to do is make it so that it's hard to casually present AI photos as real, leaving only the cases where it really matters. In the "best" case, you've just made the public more trusting of photos in general, so that when there's actual money or power on the line that makes jumping through the hoops to fake authenticity worth it, the public is more susceptible. The best outcome at this point is for everyone to get on the same page that photos have roughly the same probative value now as drawings. Poorly thought out snake oil efforts to prove authenticity are only going to delay that.
- qurren 2mo agoAre we entering a world where if I took a picture with a film camera and scanned it, it would be rejected as not real? This is ridiculous.
- CapitalistCartr 2mo agoIt's not a matter of "rejected as not real", it's "There's no way to know if this is real or not".
- account42 2mo agoWhen 99% of people are posting pics from their big tech approved smartphones with the "200% real no way to fake this" badge it doesn't matter that absence of the badge technically doesn't mean fake, that's what it will be interpreted as.
- lelandfe 2mo agoThe defendant submitted a remarkably high quality video of you saying you generated it with Nano Banana.
- trentor 2mo agoIt's compliance for advertising. Your client doesn't want AI in their project you show them the audit trail and if it turns out to be faked you point to the supplier who faked it. Our agency signed a insurance not only because of clients who don't want to use AI in their artwork but also because of the EU AI act. They c2pa to get their money back from a cheating supplier if they are not compliant with the AI act.
- Ozzie-D 2mo ago[flagged]
- LiamPowell 2mo agoI always got the impression that C2PA is a way to say "this photo came from the BBC (for example) and they've only signed it because they've verified the supplied edit chain". It's always been obvious that one could point a camera at a screen, I don't think anyone involved with C2PA has claimed otherwise. It seems like there's a big disconnect between what C2PA says it's for and what certain journalists think it's for.
- fedpost 2mo agoWhy not just have BBC sign stuff with their own creds then? You can originate the chain of custody anywhere and relying on the camera is kind of silly when the reputation of the original publisher in a more meaningful backstop.
- LiamPowell 2mo agoIt's useful to have all your tools automatically apply metadata in a standard way instead of having to keep track of it manually. Most cameras already add metadata that says what camera and lens were used, but you lose that as soon as you import it into Photoshop and export as a jpeg.
- Retr0id 2mo agoC2PA is a bit nebulous as a concept, which is part of the problem. It is both of these things. The BBC type use case where a publisher signs their own content with their own keys seems reasonable to me, or at least, not obviously broken. However I question the value-add when e.g. the BBC website is already authenticated by nature of being served over HTTPS, and anyone who redistributes BBC content can and should link back to the source. > It's always been obvious that one could point a camera at a screen, I don't think anyone involved with C2PA has claimed otherwise. They haven't claimed otherwise exactly, but some have implied it's a solvable problem. Here's where the "learn more" link goes, for when Youtube annotates a video as having C2PA metadata: https://support.google.com/youtube/answer/15446725 https://support.google.com/youtube/answer/15446725 (Google is a C2PA Steering Committee member) > The metadata that leads to a 'Captured with a camera' disclosure is made by a third party (for example, a camera manufacturer). This means that there is some risk that someone could take a photo of another screen showing synthetic content. Because the other screen shows an image that has been modified, it wouldn't be eligible for the 'Captured with a camera' disclosure. This issue is called 'air-gapping'. Camera manufacturers will continue to develop detection measures to prevent 'air-gapping', but the sophistication of those detection measures may vary in the near term. Interestingly they do not mention any of the other known limitations. Their phrasing is highly weasel-wordy, but the implication is clearly that they imagine picture-of-screen detection to become robust (somehow) in the medium-to-long term.
- squidsoup 2mo agoIsn't film photography verifiable with a physical negative? i.e. you could verify a digital reproduction of the analog photo by comparing the digital image with the negative. Tedious, but sound?
- fedpost 2mo agoYou can expose a negative with whatever the fuck you want. It doesn't have to be a real scene.
- deleted 2mo ago[deleted]
- danielheath 2mo agoDoes that prove you didn't photograph a display showing the digital image?
- deleted 2mo ago[deleted]
- roywiggins 2mo agoTransferring electronic images to film is a long-solved problem. https://en.wikipedia.org/wiki/Film_recorder https://en.wikipedia.org/wiki/Film_recorder
- deleted 2mo ago[deleted]
- fedpost 2mo agoFor the time being, I wish more workflows revolved around RAWs. You can pretty much prove the origins of an image sans cryptography by just possessing the image sensor data that you used to produce the final. It's not foolproof but AI image models can't really generate a convincing bayer raw and it's not something anyone is going to spend significant time training.
- jauntywundrkind 2mo agoUntil it matters. Which you are proposing happening.
- Melatonic 2mo agoExactly
- deleted 2mo ago[deleted]
- TOMDM 2mo agoI'd always thought the usefulness of C2PA was limited to verified devices in custody by trusted actors. Like a security camera with a tamper evident enclosure, or an organisation being able to attest that they recorded the imagery. The idea that it could be used to attest the authenticity of any random person or device surely wasn't a thing serious people expected was it?
- hypfer 2mo ago> was limited to verified devices in custody by trusted actors. Like a security camera with a tamper evident enclosure, or an organisation being able to attest that they recorded the imagery. But that is also not the case, because whatever keys are in those devices may have been duplicated in the factory or somewhere along the supply chain. Or the stuff is cloud connected and an exploit can be executed via that. Or, as written in the blog post you're commenting on, software exploits. The whole idea is that the concept works for no one.
- TOMDM 2mo agoWell, you can say the same thing about HSMs, or the CPU in your device. If there's no trust afforded to the device holder, or it's manufacturer, there's no trust in anything. Always to degrees, and never fully, but trust can still be had.
- mikewarot 2mo agoYou could actually make this secure, by having firmware in the camera module itself do the signature before handing it off to the rest of the system. The key is to prevent ingress of control, as long as the module only emits signed photographs or video, and has tightly controlled input channels, for zoom, aperture, etc... it seems a quite reasonable project.
- hypfer 2mo agoNo, you can't make this secure. You're just tweaking who can pull that off and how. And, given that the main threat here is disinformation by nation state actors, they can also attack the camera module (or its supply chain) instead.
- mikewarot 2mo ago>the main threat here is disinformation by nation state actors When did that happen? I thought we were just talking about people being able to prove they took a photo, and it wasn't photoshopped after the fact.
- e_l 2mo agoI fear that the long-term result might be a small cartel of "trusted" companies that holds the private keys which can attest and lead to the death (or at least limiting widespread adopting) of open-source operating systems. It won't stop fraud by governments and/or determined/well-resourced attackers, but it'll make it difficult enough for 99.99% of the public. And as usage drops over time, it becomes more socially acceptable to justify further limitations. Governments and corporations (e.g. banks) will require that you use a "trusted" (meaning locked-down) devices to interact with their services. We're already seeing some companies block GrapheneOS/LineageOS.
- CrzyLngPwd 2mo agoC2PA was never going to work to prevent abuse, but what it will do it give false confidence. Most people don't read HN, or understand tech, and so if the device says "captured with camera" then they will believe it since Google says it's true. Accusing someone of a crime, with fake but verified photographic or video evidence will be trivial, and claiming it's fake just makes someone tap the "Google says it's true" sign.
- MelonArmiger 2mo ago[dead]
- Hard_Space 2mo agoI sat in on a number of tedious C2PA meetings about three years ago. It was clear that no-one wanted to hear the hard truths, and one was certainly not rewarded for introducing them. I'm guessing there were a lot of consultancies to maintain, and a lot of snouts in the trough. This was a technology that required international governmental prescription, not voluntary or viral adoption. Either way, it was horrifically flawed from the outset.
- jcarrano 2mo agoIf this could be made to work reliably, it would imply that cameras would have the ability to doxx users.
- deleted 2mo ago[deleted]
- spaqin 2mo agoI do find it somewhat ironic that it's implemented in Pixels first, considering the amount of AI processing phone cameras do to get a pleasant image.
- vanyle 2mo agoThis reads a bit like "Door locks do not survive contact with reality." The point is not to prevent state-sponsored actors to produce fake media, but to add friction and avoid shady marketing agency and photographs from claiming their pictures are genuine.
- ACCount37 2mo agoYeah, the target is not the cryptographic "safe forever", but a real world "safer than not having it". If we're trying to decide whether a high profile politician has committed a crime, then yeah, C2PA on the footage isn't fully trustworthy. However, every bit of footage you get that corroborates the story raises the threshold of the attack. If we're trying to decide whether Joe Everyman has crossed a double solid while driving his truck? C2PA is probably good enough. The chances of that footage being faked by a malicious party would be low even without C2PA, but C2PA makes them even lower.
- yaro330 2mo agoAll these funny jabs at Android's security meanwhile Pixels are literally one of the most secure devices in the industry and Google invest tons into security. Hardware attestation stands unbroken to my knowledge, only software attestation can be faked, and even then it's a constant cat and mouse game which Google continues playing until they are done with Pixel 3 generation. C2PA is not immune to the analogue hole, sure, but dark room + photo of a photo approach falls apart the moment you bake in depth data into the image, which is already done.
- saagarjha 2mo agoDavid is upset that Pixel is not patching fast enough.
- grapheneos 2mo agoPixel 2 and later had hardware attestation, not the Pixel 4 and later. Devices launched with Android 8 or later were required to support it. Android hardware attestation using root-based verification is highly insecure. It depends on the weakest links in the overall ecosystem. There are tons of leaked keys from insecure TEE implementations. People can often even downgrade to an ancient TEE implementation to exploit it when anti-rollback wasn't used for updates. Devices never updated since launch can be used to get keys via known vulnerabilities. Google doesn't revoke all the known leaked keys because it would break compatibility across many devices. Originally, private keys were provisioned to 100k or more devices in batches. They've moved to a system where each can get a unique key and then the ones used by apps are dynamically rotated but it's only the Pixel 7 and later using it in practice for Pixels and other devices took far longer to adopt it. That only got forced in the past year or so for other devices. Android hardware attestation using pinning is highly secure on devices with a good implementation but that doesn't work for this use case. It could work for giving out phones to people and then verifying those are still genuine, not tampered with and have continued applying updates on an ongoing basis.
- deathanatos 2mo agoAnd never mind should someone want to edit¹ the image that comes off the camera. Now it cannot remain cryptographically verified, which means it's now in the pool of "dunno" images, where AI fakes can thrive alongside it. ¹in a non-AI, traditional way, that doesn't mislead the viewer and this entire footnote should reveal how subjective and intractable this problem is