Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

C2PA Cameras Do Not Survive Contact with Reality

da.vidbuchanan.co.uk

Post reply on HN
Print view View original

131–140 of 153 posts

Re: C2PA Cameras Do Not Survive Contact with Reality

#131

Post by blincoln »

thaumasiotes wrote: post #121
dTal wrote: post #106

Earlier quoted context omitted.

Difficult and also solves nothing, since you can just point the camera at a screen.

Have you ever tried pointing a camera at a screen? The screen is doing all kinds of crazy things that are not apparent to your eyes, but that show up clearly on camera.

Some screens are like that, but it's not an inherent property of all visual displays.

For example, you'll see a sort of barber-pole effect when pointing a video camera at a raster-scan digital display whose refresh rate isn't synced to the camera's frame rate. To avoid that, sync them, or maybe use a colour e-ink display.

Alternatively, print a high-resolution version with a decent photograph printer and take a picture of the print with the C2PA camera.

Re: C2PA Cameras Do Not Survive Contact with Reality

#132

Post by account42 »

richdrich wrote: post #76
mistercow wrote: post #40

Aside from the fact that this was obviously never viable and the entire problem is clearly unsolvable if you sit down and really probe it for fifteen minutes, what I find most frustrating about this is that the false promise of preserving photos as reliable evidence is actively harmful. You will not build a perfect system, or even something near perfect. The best you're going to do is make it so that it's hard to cas…

People got on fine until 200 years ago with the only means of rendering a picture being to draw it, as in Hogarth's calumnous image of the in fact really quite civilised Gin Lane ( https://www.theguardian.com/artanddesign/picture/2012/sep/12... )

People didn't have the ability to distribute forged images to millions to form a mob in seconds though.

Re: C2PA Cameras Do Not Survive Contact with Reality

#133

Post by account42 »

CapitalistCartr wrote: post #45
qurren wrote: post #41

Earlier quoted context omitted.

Are we entering a world where if I took a picture with a film camera and scanned it, it would be rejected as not real? This is ridiculous.

It's not a matter of "rejected as not real", it's "There's no way to know if this is real or not".

When 99% of people are posting pics from their big tech approved smartphones with the "200% real no way to fake this" badge it doesn't matter that absence of the badge technically doesn't mean fake, that's what it will be interpreted as.

Re: C2PA Cameras Do Not Survive Contact with Reality

#134

Post by anonreplier »

Gormo wrote: post #128
fwipsy wrote: post #72

Earlier quoted context omitted.

Read the rest of my comment please. Is the single motivated malicious user able to do as much damage as all of the blocked attempts put together? Probably not, since if there's really all that much riding on it, people will point out it can be bypassed. Should we also abolish Pangram, because it's not 100% accurate? Someone might be convinced a text is not AI-generated when it actually is! We should get rid of it rat…

> Is the single motivated malicious user able to do as much damage as all of the blocked attempts put together? Yes, absolutely. Probably moreso. The whole point of these proposals is to try to solve for the "motivated malicious user" who is engaging in actual high-stakes fraud. There is no point in applying techniques that suppress inconsequential pranks while making serious crimes easier to get away with. This real…

Why is this being framed as 2 types of users, lovable pranksters and fraudsters? There's a whole spectrum between these 2.

Also I'd like to know if a "joke" is likely fake.

Re: C2PA Cameras Do Not Survive Contact with Reality

#135

Post by treyd »

fwipsy wrote: post #72
treyd wrote: post #62

Earlier quoted context omitted.

It's actually worse if it is plausibly trustworthy for "99.9%", since that's enough that naive users will get accustomed to believing the verification badge is authentic. When a motivated malicious user (who doesn't actually need that much resources) will be able to convince people something is authentic because the verification passes when it shouldn't since naive users are primed to believe it by default.

Read the rest of my comment please. Is the single motivated malicious user able to do as much damage as all of the blocked attempts put together? Probably not, since if there's really all that much riding on it, people will point out it can be bypassed. Should we also abolish Pangram, because it's not 100% accurate? Someone might be convinced a text is not AI-generated when it actually is! We should get rid of it rat…

You're conflating the effectiveness of the mechanism with its systemic impact.

* Pangram: Yes we should really be discouraging people from putting trust in tools like this because they can't be made totally reliable.

* Antivirus: We should be building application environments with robust security models so that malicious software has a limited blast radius (like we do on mobile, like the Linux ecosystem is trying to do with Flatpak, etc).

* HTTPS: HTTPS is a strict upgrade from HTTP so we should be using it everywhere possible. The UI symbols to indicate to users the security expectations they're getting are good practice.

* ssh: This is just an inappropriate comparison.

The HTTPS comparison would make more sense if actually 0.1% of the time when their browser said they were using HTTPS it was just lying.

Re: C2PA Cameras Do Not Survive Contact with Reality

#136

Post by timcobb »

HWR_14 wrote: post #31
timcobb wrote: post #24

Earlier quoted context omitted.

Yeah this is what I don't get why are people even spending time on this.

Is this picture real or AI is a real problem it is worth money to solve.

It is (not sure I agree, but I can see how one would think this) but you're not going to solve it like this

Re: C2PA Cameras Do Not Survive Contact with Reality

#137

Post by timcobb »

duskwuff wrote: post #63
HWR_14 wrote: post #31

Earlier quoted context omitted.

Is this picture real or AI is a real problem it is worth money to solve.

What I'm getting at is that metadata that claims that a photo is "real" won't necessarily convince people that it is, and the lack of that metadata doesn't mean anything at all. About the only real use I've seen for C2PA is to confirm that an image bearing that metadata is AI-generated - and that marker is easily lost through editing or retransmission.

Yeah we live in the era of alternative facts and this is just more, at best, "fact checking"

Re: C2PA Cameras Do Not Survive Contact with Reality

#138

Post by blincoln »

akoboldfrying wrote: post #71
mistercow wrote: post #40

Aside from the fact that this was obviously never viable and the entire problem is clearly unsolvable if you sit down and really probe it for fifteen minutes, what I find most frustrating about this is that the false promise of preserving photos as reliable evidence is actively harmful. You will not build a perfect system, or even something near perfect. The best you're going to do is make it so that it's hard to cas…

What makes you so certain that this valuable research showing weaknesses in today's systems will render the C2PA concept useless forever? Yes, software LPEs are a risk -- as they are in every nontrivial computer system. New ones will appear, and old ones will be closed in time, as TFA acknowledges. Re hardware attacks: The (neat!) glitch injection attack the author describes in the linked "lighter" page only raises t…

> Does the existence of lock picks or bolt cutters render padlocks pointless today

A padlock shouldn't be the only component of the bigger physical security picture.

A random person carrying/using bolt cutters or trying to pick a lock looks suspicious, and should be noticed by on-site staff or whoever is monitoring the security cameras.

If the padlock is decent, there will also be an inherent delay involved in bypassing it using those tools, which should increase the likelihood of the person being noticed.

If the padlock is used in an unattended/unmonitored location (i.e. a remote vacation house with no neighbours and no security cameras), then the padlock is probably only good for keeping honest people honest.

A lot of physical security => information security analogies are misleading for the same reason. In information security, it's very possible for an adversary to have effectively unlimited time to perform their attack (or to develop the means to perform the attack quickly).

Imagine a scenario where any determined person could e.g. spend a month in their home workshop and develop a pair of gloves containing transducers that would vibrate any padlock open in seconds. They could mimic the action of using the key or entering the combination to avoid looking suspicious. Also, the gloves have a button that instantly creates another pair of the same gloves at no cost. How much value would a padlock have in that scenario? That's the kind of asymmetric playing field one has to consider in information security contexts.

Re: C2PA Cameras Do Not Survive Contact with Reality

#139

Post by Gormo »

anonreplier wrote: post #134
Gormo wrote: post #128

Earlier quoted context omitted.

> Is the single motivated malicious user able to do as much damage as all of the blocked attempts put together? Yes, absolutely. Probably moreso. The whole point of these proposals is to try to solve for the "motivated malicious user" who is engaging in actual high-stakes fraud. There is no point in applying techniques that suppress inconsequential pranks while making serious crimes easier to get away with. This real…

Why is this being framed as 2 types of users, lovable pranksters and fraudsters? There's a whole spectrum between these 2. Also I'd like to know if a "joke" is likely fake.

I don't suspect there is a uniform spectrum between those two. I think this is something that's going to be clinal, which we see in a lot of other comparable social contexts. The number of people actually willing to cross a moral threshold into outright crime is relatively small, but those are precisely the people who cause the most damage when they get away with their behavior.

Bur I don't even really think that's really relevant anyway, because whatever the density of "malicious" motivations is, the point here is that the fact that it only is an effort/motivation threshold that allows this technique to "block" malicious uses, and the motivation to overcome that threshold correlates directly with the stakes involved in the malicious use.

In other words, the more malicious the abuse is, the less effective this solution will be: the boundary of its usefulness will be wherever the line between pranksters and actual criminals happens to lie.

Re: C2PA Cameras Do Not Survive Contact with Reality

#140

Post by RGamma »

akersten wrote: post #27
uqers wrote: post #8

I'm very surprised Google put in so much effort to implement an approach that is basically the equivalent of client-side verification of passwords. Did no one designing it mention that it could be defeated by any rooted device?

Well, all one has to do is look at the bigger picture of how rooted devices are being shuffled into 3rd rate/totally blocked experiences and the overall direction of things starts to take very clear shape. At over a decade old, still prescient as ever: https://www.youtube.com/watch?v=HUEvRyemKSg

Someone better figure out how to make computing devices at home from everyday parts because the only way I see this (shockingly rapid) arms race end is legally mandated, cryptographically locked down hardware and software (or even thin clients) everywhere.

RMS must be having daily nightmares at this point.

P.S.: Fantastic talk you linked there.

Post reply on HN