Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Reference Image: A New Approach for Verified Photography

security.apple.com

Post reply on HN
Print view View original

311–320 of 359 posts

Re: Apple Reference Image: A New Approach for Verified Photography

#311

Post by propaganja »

autoexec wrote: post #281
monocasa wrote: post #234

Earlier quoted context omitted.

Nation states almost certainly have the ability to extract the private keys out of an image sensor and SEP. Outside of superpowers even if you're willing to do it destructively. They can then sign their own fraudulent images.

The NSA has probably already forced Apple to hand the keys over to them.

Apple would be legally restricted from disclosing any government compromises, while still claiming their systems are secure and operating as intended in general.

We already know it's happening right now, and they know we know, but we can't do shit about it.

Re: Apple Reference Image: A New Approach for Verified Photography

#312

Post by crote »

JumpCrisscross wrote: post #283
slester wrote: post #277

Earlier quoted context omitted.

Why would anyone be using images of government IDs when modern documents have NFC chips with the data, signed and with anti-cloning mechanisms on them? If they can verify an Apple Reference Image they can verify an NFC document.

> If they can verify an Apple Reference Image they can verify an NFC document Interfacing with images is easy. Interfacing with NFC takes work. I have experienced precisely zero identity-verification workflows which NFC'd anything, and that includes my banks, which could easily ask for my debit card's NFC but don't.

Counterpoint: all of the identity-verification flows I have experienced in the last few years used NFC to read the chip in my identity documents - from car rental apps to my bank doing KYC.

If anything, verifying NFC is easier than images. Asking the chip in my identity card to provide a cryptographically-signed "This document belongs to Jane Doe" request is a handful of lines of code. Doing the same with images? Good luck coming up with an approach which isn't fooled by a photocopy!

Re: Apple Reference Image: A New Approach for Verified Photography

#313

Post by alwillis »

autoexec wrote: post #281
monocasa wrote: post #234

Earlier quoted context omitted.

Nation states almost certainly have the ability to extract the private keys out of an image sensor and SEP. Outside of superpowers even if you're willing to do it destructively. They can then sign their own fraudulent images.

The NSA has probably already forced Apple to hand the keys over to them.

> The NSA has probably already forced Apple to hand the keys over to them.

Again, that's not how it works.

There's no set of keys and certificates they could give to the NSA. Every iPhone 18 Pro and Pro Max has a unique set of cryptographic keys, most of which can't be accessed by Apple.

The first thing that happens is when photo sensor is initialized at the factory, it creates its own ECDSA P-256 signing key pair; the private key is never disclosed. The public key is signed by the factory's certificate authority.

This ain't X.509 where VeriSign's key pair is sitting in a HSM at their HQ and in theory could be forced to sign a fraudulent certificate or revoke someone's valid website certificate.

Re: Apple Reference Image: A New Approach for Verified Photography

#314

Post by cobbzilla »

colejohnson66 wrote: post #304
cobbzilla wrote: post #275

Earlier quoted context omitted.

Apple gets the device-signed image and replaces with a PCC signature to preserve anonymity. > The final reference image is instead signed by Apple’s signing service, after validation by PCC. So, if compelled, Apple could theoretically tell someone if two images came from the same camera.

Still, "the same camera" isn't "this person" without more information.

sure but if you can tie “this person” to “this one photo”, then for any photo, Apple can (again, theoretically) identify all photos by that person.

it’s one step removed from identity.

fwiw i think this is an unambiguous improvement over current post-sensor attestations, it’s just good to explore the edges

Re: Apple Reference Image: A New Approach for Verified Photography

#315

Post by alwillis »

mitxela wrote: post #178
alwillis wrote: post #165

Earlier quoted context omitted.

> This is really clever from Apple. The journalist use case is just the PR story. This will be really useful for identity verification and insurance apps, and has the potential to shift from "you need a smartphone to be able to live normally" to "you need an iPhone to be able to live normally". You have it all wrong. Apple Reference Image is not an id system; it's primarily a way to attest that the pixels recorded by…

You'll still need an iPhone, the verification is linked to the specific iPhone, and the specific iPhone is linked to you.

The reference image isn't linked to any particular iPhone or person:

    We built Apple Reference Image to avoid using an explicit, public
    credential for photographers, and to avoid even implicit public
    association between different photos taken by the same sensor. The
    final reference image is instead signed by Apple’s signing service,
    after validation by PCC. That signature is backed by Apple’s
    strongest technical guarantees.

    Our implementation also protects the
    confidentiality of the image itself, including from Apple. Merely
    capturing a reference image should never expose the actual pixels to
    Apple or anyone else. We achieve this through the exceptional privacy
    properties of PCC — the nodes themselves are architected so that not
    even Apple can access image data, just as Apple cannot see the
    information processed for Apple Intelligence in PCC.

Re: Apple Reference Image: A New Approach for Verified Photography

#316

Post by dwaite »

tgsovlerkhgsel wrote: post #62

This is really clever from Apple. The journalist use case is just the PR story. This will be really useful for identity verification and insurance apps, and has the potential to shift from "you need a smartphone to be able to live normally" to "you need an iPhone to be able to live normally". There are already plenty of insurances that require you to submit claims through a smartphone app that tries to essentially do…

Identity Verification is the realm of digital credentials. The goal isn't to make putting a driving license or passport on a desk and to verify the picture is of authentic pixels, but to move to mDL / EIDAS2 technology to have a digital representation of a driving license/passport.

This tech would just indicate that they got authentic pixels capturing a potentially fake license.

Likewise, this doesn't help as much as you'd like with most bespoke remote selfie verification systems, since this doesn't support video, doesn't protect against MITM and adds a remote processing delay that breaks any time-of-flight measurement. It shuffles the risks around.

Re: Apple Reference Image: A New Approach for Verified Photography

#317

Post by deltoidmaximus »

int32_64 wrote: post #254

I would also like the reference image from the sensor instead of the blown out HDR monstrosity Apple removed the ability to turn off after the iPhone 12.

This is another interesting point. iPhone's do a bunch of post processing to improve image quality. What exactly are we signing as real and not AI manipulated here? How much image processing is allowed before it isn't verified? (do panoramic stitched photos count?)

Re: Apple Reference Image: A New Approach for Verified Photography

#319

Post by throw0101c »

autoexec wrote: post #279
throw0101c wrote: post #217

Earlier quoted context omitted.

> You'll still need an iPhone, the verification is linked to the specific iPhone, and the specific iPhone is linked to you. Unless you use a friend's iPhone, or an iPhone you 'rented' for 5 minutes for $20 from someone on Craigslist or Facebook Marketplace to take a picture on and then Airdrop to you.

If they airdrop it to you that typically requires you to have an iphone or a mac and airdrop users are able to be identified and tracked so the photo could still be linked to your device. The EU forced apple to use Wi-Fi Aware though, so unless that's similarly vulnerable people in the EU might be able to avoid those issues.

> If they airdrop it to you that typically requires you to have an iphone or a mac […]

Perhaps do not be so literal: Airdrop, SMS/MMS/RCS, WhatsApp, Signal, etc:

* https://github.com/localsend/localsend

Re: Apple Reference Image: A New Approach for Verified Photography

#320

Post by alwillis »

cobbzilla wrote: post #275
jclardy wrote: post #233

Earlier quoted context omitted.

It doesn't, as it is run through an Oblivious HTTP relay run by a third party before getting to Apple's servers. So it has no IP information, and the requests use anonymous access tokens. It is probably possible for an entity to break it, but it would require live access to both Apple and the third party (Likely Cloudflare) servers. And that is assuming there is only one third party routing OHTTP requests, otherwise…

Apple gets the device-signed image and replaces with a PCC signature to preserve anonymity. > The final reference image is instead signed by Apple’s signing service, after validation by PCC. So, if compelled, Apple could theoretically tell someone if two images came from the same camera.

> So, if compelled, Apple could theoretically tell someone if two images came from the same camera.

No they couldn't.

If you generate two SSH key pairs on your laptop, there's no way to confirm they were created on the same machine.

There's no device identifying data in a reference image, which is the point. The factory signature, the image sensor key, the Secure Enclave Processor key and all of the signing that takes place on PCC are all device-agnostic.

The reference image is processed and eventually signed by Private Cloud Compute's post-quantum signature using a hybrid MLDSA87-RSA-3072-PSS-SHA512 scheme.

So… it's not possible for Apple to know if two images came from the same iPhone.

Post reply on HN