Top
Best
New

Posted by Retr0id 10 hours ago

C2PA Cameras Do Not Survive Contact with Reality(www.da.vidbuchanan.co.uk)
112 points | 64 comments
mistercow 4 hours ago|
Aside from the fact that this was obviously never viable and the entire problem is clearly unsolvable if you sit down and really probe it for fifteen minutes, what I find most frustrating about this is that the false promise of preserving photos as reliable evidence is actively harmful.

You will not build a perfect system, or even something near perfect. The best you're going to do is make it so that it's hard to casually present AI photos as real, leaving only the cases where it really matters. In the "best" case, you've just made the public more trusting of photos in general, so that when there's actual money or power on the line that makes jumping through the hoops to fake authenticity worth it, the public is more susceptible.

The best outcome at this point is for everyone to get on the same page that photos have roughly the same probative value now as drawings. Poorly thought out snake oil efforts to prove authenticity are only going to delay that.

richdrich 6 minutes ago||
People got on fine until 200 years ago with the only means of rendering a picture being to draw it, as in Hogarth's calumnous image of the in fact really quite civilised Gin Lane (https://www.theguardian.com/artanddesign/picture/2012/sep/12...)
indutny 3 hours ago|||
In my opinion, the benefits for end users are rather minimal since I doubt an average person would ever be checking C2PA provenance data, but there is a commercial incentive for Google and others to promote C2PA, since it makes preparing training material for Machine Learning significantly easier, and perhaps as a smaller benefit justifies hardware attestation that locks users down into proprietary OSes.
fwipsy 2 hours ago|||
I think it's useful even if it can be spoofed. Many people don't even bother to edit visible watermarks out of AI photos/videos. I'm fairly certain this will defeat 99.9% of malicious users, many of whom won't even know it exists until someone points out it's missing.

People are concerned that the technology will lend additional credence to the last 0.1%. But anyone who thinks about the technology for 2 minutes will see you can just point the camera at the screen. In cases where it really matters (a court of law, internet arguments between nerds) people will know it's not 100% reliable. Locks can be picked, and signatures can be forged, but that doesn't make them useless.

"C2PA Cameras Do Not Survive Contact With Reality" does not survive contact with reality where very, very few users would even think of rooting their phone so they can create signed fake images.

treyd 2 hours ago|||
It's actually worse if it is plausibly trustworthy for "99.9%", since that's enough that naive users will get accustomed to believing the verification badge is authentic.

When a motivated malicious user (who doesn't actually need that much resources) will be able to convince people something is authentic because the verification passes when it shouldn't since naive users are primed to believe it by default.

fwipsy 31 minutes ago||
Read the rest of my comment please. Is the single motivated malicious user able to do as much damage as all of the blocked attempts put together? Probably not, since if there's really all that much riding on it, people will point out it can be bypassed.

Should we also abolish Pangram, because it's not 100% accurate? Someone might be convinced a text is not AI-generated when it actually is! We should get rid of it rather than fool people into thinking it can be determined accurately. What about antivirus? We should abolish it as well rather than fool people into thinking that their software is ever 100% safe. What about HTTPS? We shouldn't call it "secure" shell because the computer you're connecting to could be compromised! I could go on and on and on.

The median instance of AI image generation isn't evidence in a court case. It's cyberbullying, or deepfakes, or fake news. It's called "slop" because there's a lot of it being churned out at low effort.

hypfer 9 minutes ago||
You're missing all of the points that there could be by focussing on random people.

While it is always an individual tragedy when people treat each other badly (e.g. through deepfakes and all), the real threat does not exist on that level.

This is about misinformation and disinformation, so we're talking state actors. And with that, the 99.9% hypothesis does not hold true.

Retr0id 2 hours ago|||
When I search for "C2PA" on the google play store, there are more AI-watermark-removal apps than there are signing apps. Certain types will jump through ridiculous hoops if they think it will affect their algorithmic reach on social media.

Malicious users don't need to root their own phones. They just need to go to fakemyimage dot com, and someone else's rooted phone in a clickfarm-type setup signs it for them. I am not operating such a service myself because I thought it was unnecessary in making my point, but perhaps I will have to reconsider.

fwipsy 26 minutes ago||
You're arguing that lots of people can spoof this, the other guy is arguing that nobody will know it can be spoofed so it will do more damage. But these are contradictory -- if fakes become common, then they will also become common knowledge. The impact of any given fake is reduced if there are more of them. The technology doesn't need to provide 100% assurance. If it adds even a little friction to the slop mills then that's increasing the signal to noise ratio.
Gigachad 2 hours ago|||
I don’t think there is a technical solution to this problem but I think there is a legal one.

Make it a legal requirement to mark AI generated photos and enforce penalties for posting unmarked AI generations. Social media should also mark the country of origin for each post, with the knowledge that posts from your own country are covered by these laws.

inigyou 1 hour ago|||
The EU did this, Claude and Microsoft complied and HN was practically rioting about it literally yesterday: https://news.ycombinator.com/item?id=49421158
akoboldfrying 22 minutes ago|||
I think public key cryptography offers a technical solution that is nearly as ideal here as for its existing uses for securing communication between physically remote actors -- please see my comment here for details: https://news.ycombinator.com/item?id=49444227

I say "nearly", because as soon as you need to keep a private key secure from someone with direct physical access to the device, you're entering dangerous territory. TTBOMK there's no way to make a "perfect black box", so it becomes an arms race between defensive "obfuscation" and tamper detection mechanisms in the one hand and stealth scanning techniques on the other. But this is already the case for TPMs -- that is, the situation is no worse than for an already widely accepted technology.

akoboldfrying 34 minutes ago|||
What makes you so certain that this valuable research showing weaknesses in today's systems will render the C2PA concept useless forever?

Yes, software LPEs are a risk -- as they are in every nontrivial computer system. New ones will appear, and old ones will be closed in time, as TFA acknowledges.

Re hardware attacks: The (neat!) glitch injection attack the author describes in the linked "lighter" page only raises the implementation cost of doing image certification properly. For example, if the camera module presented only an interface that dumped raw RGB or JPEG-encoded data plus a digital signature that used a private key known only to the manufacturer, then all that would be required to verify a "downstream" image would be to keep a copy of those original bytes inside the final (potentially cropped, filtered, AI-ed, etc.) image, in the worst case roughly doubling its size on disk (though certainly more efficient schemes could be designed). Any interested third party could then compare the original and final images by eye and decide for themselves whether or not the subsequent processing materially changed the image's "meaning".

Finally: Does the existence of lock picks or bolt cutters render padlocks pointless today? Does it corrode society by encouraging people to mistakenly believe that anything they put behind a $5 padlock will be safe forever? No, and no.

qurren 4 hours ago||
Are we entering a world where if I took a picture with a film camera and scanned it, it would be rejected as not real?

This is ridiculous.

CapitalistCartr 3 hours ago|||
It's not a matter of "rejected as not real", it's "There's no way to know if this is real or not".
lelandfe 3 hours ago|||
The defendant submitted a remarkably high quality video of you saying you generated it with Nano Banana.
ted_dunning 2 hours ago||
And their video was C2PA signed.
LiamPowell 3 hours ago||
I always got the impression that C2PA is a way to say "this photo came from the BBC (for example) and they've only signed it because they've verified the supplied edit chain". It's always been obvious that one could point a camera at a screen, I don't think anyone involved with C2PA has claimed otherwise.

It seems like there's a big disconnect between what C2PA says it's for and what certain journalists think it's for.

Retr0id 2 hours ago||
C2PA is a bit nebulous as a concept, which is part of the problem. It is both of these things. The BBC type use case where a publisher signs their own content with their own keys seems reasonable to me, or at least, not obviously broken.

However I question the value-add when e.g. the BBC website is already authenticated by nature of being served over HTTPS, and anyone who redistributes BBC content can and should link back to the source.

> It's always been obvious that one could point a camera at a screen, I don't think anyone involved with C2PA has claimed otherwise.

They haven't claimed otherwise exactly, but some have implied it's a solvable problem. Here's where the "learn more" link goes, for when Youtube annotates a video as having C2PA metadata: https://support.google.com/youtube/answer/15446725 (Google is a C2PA Steering Committee member)

> The metadata that leads to a 'Captured with a camera' disclosure is made by a third party (for example, a camera manufacturer). This means that there is some risk that someone could take a photo of another screen showing synthetic content. Because the other screen shows an image that has been modified, it wouldn't be eligible for the 'Captured with a camera' disclosure. This issue is called 'air-gapping'. Camera manufacturers will continue to develop detection measures to prevent 'air-gapping', but the sophistication of those detection measures may vary in the near term.

Interestingly they do not mention any of the other known limitations. Their phrasing is highly weasel-wordy, but the implication is clearly that they imagine picture-of-screen detection to become robust (somehow) in the medium-to-long term.

LiamPowell 41 minutes ago||
> However I question the value-add when e.g. the BBC website is already authenticated by nature of being served over HTTPS, and anyone who redistributes BBC content can and should link back to the source.

The value would be in images reposted to social media where the website an show a badge that says it came from a certain source.

fedpost 2 hours ago||
Why not just have BBC sign stuff with their own creds then? You can originate the chain of custody anywhere and relying on the camera is kind of silly when the reputation of the original publisher in a more meaningful backstop.
LiamPowell 39 minutes ago||
It's useful to have all your tools automatically apply metadata in a standard way instead of having to keep track of it manually. Most cameras already add metadata that says what camera and lens were used, but you lose that as soon as you import it into Photoshop and export as a jpeg.
trentor 4 hours ago||
It's compliance for advertising. Your client doesn't want AI in their project you show them the audit trail and if it turns out to be faked you point to the supplier who faked it. Our agency signed a insurance not only because of clients who don't want to use AI in their artwork but also because of the EU AI act. They c2pa to get their money back from a cheating supplier if they are not compliant with the AI act.
uqers 7 hours ago||
I'm very surprised Google put in so much effort to implement an approach that is basically the equivalent of client-side verification of passwords. Did no one designing it mention that it could be defeated by any rooted device?
12_throw_away 6 hours ago||
Actually I think this approach is very forward looking! Attestation is on the cusp of becoming a very powerful technique. We just need to figure out how to build 100% bug-free and 100% secure hardware and software, and then it's gonna work great.
genxy 3 hours ago||
Wait a minute. I think you might have forgotten a /s, I can spot this kinda thing.
akersten 5 hours ago|||
Well, all one has to do is look at the bigger picture of how rooted devices are being shuffled into 3rd rate/totally blocked experiences and the overall direction of things starts to take very clear shape.

At over a decade old, still prescient as ever: https://www.youtube.com/watch?v=HUEvRyemKSg

demibabs 7 hours ago||
Not any rooted device, it must be rooted via an exploit. Still pretty bad, though
randomblock1 7 hours ago||
Even at the hardware level, if it was a separate chip that the camera data passed through or something, that's not really good enough either, people have broken TPMs before. It'd have to be baked into the camera sensor. Even then, you could attack it from the next level up, with some fancy optics and a display, or something like that.

I don't think completely solving this sort of problem is even possible.

duskwuff 7 hours ago||
And I'm not sure it's even useful to solve. The presence/absence of a digital signature will never be the deciding factor in whether people accept/reject an image as authentic.
timcobb 6 hours ago|||
Yeah this is what I don't get why are people even spending time on this.
HWR_14 5 hours ago|||
Is this picture real or AI is a real problem it is worth money to solve.
duskwuff 1 hour ago|||
What I'm getting at is that metadata that claims that a photo is "real" won't necessarily convince people that it is, and the lack of that metadata doesn't mean anything at all. About the only real use I've seen for C2PA is to confirm that an image bearing that metadata is AI-generated - and that marker is easily lost through editing or retransmission.
SoftTalker 4 hours ago|||
Why? An image should never be proof of anything, by itself.
EA-3167 6 hours ago|||
A desperate attempt to preempt regulation.
akersten 5 hours ago||
A desperate attempt to establish their version of regulatory capture and not have to pay licensing fees to the other guy
rackp 4 hours ago|||
[dead]
jasonjayr 7 hours ago|||
And in 2026, I don't think it's too big of a stretch to imagine that there are going to be people in power that can add + remove the metadata to whatever image they want, at will, to tell whatever story they want to create. Sadly.
gruez 5 hours ago||
There were similar fears about the webtrust CA system, but AFAIK there's no known incidents where a government strongarmed a CA into misissuing a MITM certificate, and then it was used in MITM attacks. The closest is some misissued certificates seemingly due to incompetence but weren't used in attacks.
SoftTalker 4 hours ago||
And there are unicorns living at the end of the rainbow.
yjftsjthsd-h 6 hours ago||
> Even then, you could attack it from the next level up, with some fancy optics and a display, or something like that.

The analog hole is alive and well:)

taneq 4 hours ago||
And at that level, it’s a matter of definition anyway. What is “AI generated”? A photo of a screen showing an AI picture is still a photo. If that’s “AI” then what about a photo of an AI generated billboard? Or a photo of a bus with an AI graphic on the side?
fedpost 2 hours ago||
For the time being, I wish more workflows revolved around RAWs. You can pretty much prove the origins of an image sans cryptography by just possessing the image sensor data that you used to produce the final. It's not foolproof but AI image models can't really generate a convincing bayer raw and it's not something anyone is going to spend significant time training.
jauntywundrkind 1 hour ago|
Until it matters. Which you are proposing happening.
ethagknight 8 hours ago||
I got a good laugh out of the "unblur to verify" first image. I dont know what I was expecting to see.
andrewflnr 6 hours ago|
As far as AI-generated images go, that was a good one.
wisty 7 hours ago||
I can break it with zero skills. Tripod, camera, clear monitor in a dark room ... just take a real photo of a fake photo.
Terr_ 6 hours ago||
That might be detectable if they signed content contains focal-length metadata... but even then, some foresight and a collection of lenses would hide it.
ipython 5 hours ago|||
Wouldn’t the introduction of the lidar signals embedded in the photo (say used with apple’s faceid system) help here?
jedbrooke 6 hours ago||
see also https://en.wikipedia.org/wiki/Telecine
squidsoup 2 hours ago|
Isn't film photography verifiable with a physical negative? i.e. you could verify a digital reproduction of the analog photo by comparing the digital image with the negative. Tedious, but sound?
fedpost 2 hours ago||
You can expose a negative with whatever the fuck you want. It doesn't have to be a real scene.
roywiggins 1 hour ago|||
Transferring electronic images to film is a long-solved problem.

https://en.wikipedia.org/wiki/Film_recorder

danielheath 2 hours ago|||
Does that prove you didn't photograph a display showing the digital image?
More comments...