Proof of Capture: Apple Reference Image, but open source and using steganography

Signing things by default has repeatedly been found to have serious unintended consequences. Do you really want your leaked/stolen photos to be undeniably linked to you?

https://blog.cryptographyengineering.com/2020/11/16/ok-googl...

> we sign a perceptual hash (pHash) of the image rather than an exact pixel checksum

Perceptual hashes are non-cryptographic. There are certainly collision attacks, but what about preimages? A preimage would completely break this scheme.

This paper demonstrates second-preimage attacks against PhotoDNA and PDQ: https://eprint.iacr.org/2021/1531.pdf

Here's a toy for embedding small text into images steganographically: https://github.com/fitzn/atrium

One of the few advantages of "not owning your device".

Glad that at least we have that now.

A pHash isn't built for this. The 15%x20% threshold that passes as authentic is enough to swap a face.

I very much hope that apple is using lidar data to determine if it's a flat surface being screened

I don't understand why few people are pointing out the obvious vulnerability here that you can control the wires going into the photosensor controller and pretend that the photosensor is capturing whatever image you want. I imagine it's not exactly trivial to do this, but a grad student with an FPGA could probably figure it out.

I expect in the near future all digital cameras to digitally sign the images they take. Even before AI slop, it was useful to avoid manual alterations. AI makes it all too easy, so it makes sense.

However, this will certify only the original image. I think the missing part of this is additional layers of certification which allow some image editing (e.g., rotating, contrast, etc.) yet clearly document that the image was modified and link to the original image ID. Kind of like a signed git log.

In the future, people willingly surveil themselves 24/7 with cryptographic proof, because fake images and video will be so good that it will be the only way to prove what one didn't do. Total Information Awareness achieved :D

> For example, a screen attack still works: photograph a screen displaying an AI image and you get a signed photo of a fake. But it's always nice seeing big actors interested in addressing this problem.

Yeah, very nice. So this whole idea basically doesn't work - but we get a new stealth way to embed metadata in an image that can be used for tracking...

(And a new narrative why cameras need to have TPMs and locked-down firmware as well)