I’m finding it harder and harder to tell whether an image has been generated or not (the main giveaways are disappearing). This is probably going to become a big problem in like half a year’s time. Does anyone know of any proof of legitimacy projects that are gaining traction? I can imagine news orgs being the first to be hit by this problem. Are they working on anything?

  • subarctictundraOP
    4·
    10 days ago

    Perhaps a trusted certificate system (similar to https) might work for proving legitimacy?

    • knightly the Sneptaur@pawb.social
      11·
      10 days ago

      Certificates like that can only guarantee that the work was published by someone who is the person they claim to be, it can’t verify how that content came to be in their possession.

      • subarctictundraOP
        1·
        9 days ago

        Hmm, I see. Surely wouldn’t that be enough if they proclaimed they would only sign real photographs though?

    • jaredj@infosec.pub
      2·
      9 days ago

      https://contentauthenticity.org/how-it-works

      The page is very light on technical detail, but I think this is a system like trusted platform modules (TPMs), where there is a hardware root of trust in the camera holding the private key of an attestation certificate signed by the manufacturer at the time of manufacture, and it signs the pictures it takes. The consortium is eager for people to take this up (“open-source software!”) and support showing and appending to provenance data in their software. The more people do so, the more valuable the special content-authenticating cameras become.

      But TPMs on PCs have not been without vulnerabilities. I seem to recall that some manufacturers used a default or example private key for their CA certificates, or something. Vulnerabilities in the firmware of a content-authenticating camera could be used to jailbreak it and make it sign arbitrary pictures. And, unless the CAI is so completely successful that every cell phone authenticates its pictures (which means we all pay rent to the C2PA), some of the most important images will always be unauthenticated under this scheme.

      And the entire scheme of trusted computing relies on wresting ultimate control of a computing device from its owner. That’s how other parties can trust the device without trusting the user. It can be guaranteed that there are things the device will not do, even if the user wants it to. This extends the dominance of existing power structures down into the every-day use of the device. What is not permitted, the device will make impossible. And governments may compel the manufacturer to do one thing or another. See “The coming war on general computation,” Cory Doctorow, 28c3.

      What if your camera refused to take any pictures as long as it’s located in Gaza? Or what if spies inserted code into a compulsory firmware update that would cause a camera with a certain serial number to recognize certain faces and edit those people out of pictures that it takes, before it signs them as being super-authentic?