Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Reference Image: A New Approach for Verified Photography

security.apple.com

Post reply on HN
Print view View original

341–350 of 359 posts

Re: Apple Reference Image: A New Approach for Verified Photography

#341

Post by tgsovlerkhgsel »

rickdeckard wrote: post #120
tgsovlerkhgsel wrote: post #62

This is really clever from Apple. The journalist use case is just the PR story. This will be really useful for identity verification and insurance apps, and has the potential to shift from "you need a smartphone to be able to live normally" to "you need an iPhone to be able to live normally". There are already plenty of insurances that require you to submit claims through a smartphone app that tries to essentially do…

I don't understand the vector of this: An insurance would either assign #1 an insurance agent or mechanic to initially assess the damage (trusted) or #2 ask the customer to send pictures (untrusted). Tendency is #2 for cost-saving of the insurance, and 3rd party apps are used to execute this. Now the idea is that the insurance company discontinues the App and the (untrusted) customer must have an iPhone 18 Pro to mak…

Nowadays they do #3, demand that the customer takes pictures with a special app that claims to make the process nearly as trusted as #1 while being nearly as cheap as #2.

The idea is indeed that instead or in addition to requiring an app, the insurance company would require the app to run on a phone that supports Reference Image to make sure the image wasn't tampered with. Not right now, when the phones are new, but in a while when 50% of Americans have a sufficiently new iPhone. The rest of the people gets told to either borrow one if they want to make a claim, or go through some other alternative process designed to be so annoying that most people give up.

Re: Apple Reference Image: A New Approach for Verified Photography

#342

Post by lxgr »

fweimer wrote: post #309
lxgr wrote: post #298

Earlier quoted context omitted.

ICAO doc 9303 validation is about 10 lines in Python (on top of importing the right packages) last time I did it around 2012. I doubt it has become harder since then.

Was the public key directory even operational in 2012? What about revocation checking? I think processing that information is mandatory now, but probably was optional/largely unimplemented in 2012. But maybe I'm off by five years or so?

Revocation checking seems like a big gap, yeah. I’m not aware of any public revocation lists (but I’m also not super familiar with the industry), so I can only assume (hope?) that there are some shadowy but highly accurate databases that KYC providers are tapping into.

The CA public key I just got off my country’s website, they were kind enough to just publish it :)

Re: Apple Reference Image: A New Approach for Verified Photography

#343

Post by monocasa »

alwillis wrote: post #308
monocasa wrote: post #234

Earlier quoted context omitted.

Nation states almost certainly have the ability to extract the private keys out of an image sensor and SEP. Outside of superpowers even if you're willing to do it destructively. They can then sign their own fraudulent images.

> Nation states almost certainly have the ability to extract the private keys out of an image sensor and SEP. Outside of superpowers even if you're willing to do it destructively. They can then sign their own fraudulent images. That's not how this works. Let's pretend they're able to extract the sensor key and the SEP key. Then what? An attacker won't have the ECDSA P-256 over SHA-256 signed timestamp token from the…

> An attacker won't have the ECDSA P-256 over SHA-256 signed timestamp token from the Apple Push Notification Service.

Sure they can, they have everything needed to prove to Apple's servers that they're a real iPhone since pulling the keys means they have the cryptographic root of trust, and Apple's servers will happily be a signature oracle for them in that case.

> When Reference mode starts, the operating system supplies a SHA-256 digest to be embedded at a fixed location in the captured frame’s metadata. The digest is computed from the most recent secure timestamp, the device manifest, and the device's secure boot manifest.

And when you know what is measured into those manifests and the keys at the root of trust you can manufacture those too.

The entire scheme is dependent on not being able to extract device specific keys. At the end of the day, those are almost certainly efuses burnt based on a on-chip HRNG as a manufacturing step which is intended to never leave the device, but instead only signatures and associated public keys.

But when you have chip development hardware of the kind you'd have at a decent fabless semiconductor company, you can very clearly see burnt efuses.

Re: Apple Reference Image: A New Approach for Verified Photography

#344

Post by heddhunter »

int32_64 wrote: post #254

I would also like the reference image from the sensor instead of the blown out HDR monstrosity Apple removed the ability to turn off after the iPhone 12.

There are myriad 3rd party camera apps that will give you RAWs straight off the sensor. Apple also has its "ProRAW" format which is a nice middle ground.

Re: Apple Reference Image: A New Approach for Verified Photography

#345

Post by autoexec »

throw0101c wrote: post #319
autoexec wrote: post #279

Earlier quoted context omitted.

If they airdrop it to you that typically requires you to have an iphone or a mac and airdrop users are able to be identified and tracked so the photo could still be linked to your device. The EU forced apple to use Wi-Fi Aware though, so unless that's similarly vulnerable people in the EU might be able to avoid those issues.

> If they airdrop it to you that typically requires you to have an iphone or a mac […] Perhaps do not be so literal: Airdrop, SMS/MMS/RCS, WhatsApp, Signal, etc : * https://github.com/localsend/localsend

I agree, lots of alternatives to the specific one you suggested exist and would probably be better.

Re: Apple Reference Image: A New Approach for Verified Photography

#346

Post by alwillis »

propaganja wrote: post #311
autoexec wrote: post #281

Earlier quoted context omitted.

The NSA has probably already forced Apple to hand the keys over to them.

Apple would be legally restricted from disclosing any government compromises, while still claiming their systems are secure and operating as intended in general. We already know it's happening right now, and they know we know, but we can't do shit about it.

> Apple would be legally restricted from disclosing any government compromises, while still claiming their systems are secure and operating as intended in general.

I'm aware. The point is they can't give the NSA something they don't have. The photo sensor generates its own ECDSA P-256 signing key pair and never releases the private half.

Every device has a unique key pair and the private key is unavailable… there's not a way to give the NSA that would help them. The system is setup so that the image data, meta data, etc can't be accessed by anyone including Apple.

Re: Apple Reference Image: A New Approach for Verified Photography

#347

Post by alwillis »

monocasa wrote: post #343
alwillis wrote: post #308

Earlier quoted context omitted.

> Nation states almost certainly have the ability to extract the private keys out of an image sensor and SEP. Outside of superpowers even if you're willing to do it destructively. They can then sign their own fraudulent images. That's not how this works. Let's pretend they're able to extract the sensor key and the SEP key. Then what? An attacker won't have the ECDSA P-256 over SHA-256 signed timestamp token from the…

> An attacker won't have the ECDSA P-256 over SHA-256 signed timestamp token from the Apple Push Notification Service. Sure they can, they have everything needed to prove to Apple's servers that they're a real iPhone since pulling the keys means they have the cryptographic root of trust, and Apple's servers will happily be a signature oracle for them in that case. > When Reference mode starts, the operating system su…

I made a flow chart of the Apple Reference Image process; hopefully it clears up some misconceptions [1].

[1]: "How pixels become an Apple Reference Image" - https://news.ycombinator.com/item?id=49735284

Re: Apple Reference Image: A New Approach for Verified Photography

#348

Post by alwillis »

propaganja wrote: post #311
autoexec wrote: post #281

Earlier quoted context omitted.

The NSA has probably already forced Apple to hand the keys over to them.

Apple would be legally restricted from disclosing any government compromises, while still claiming their systems are secure and operating as intended in general. We already know it's happening right now, and they know we know, but we can't do shit about it.

Here's a flow chart; tell us at what point there's something Apple can be compelled by a 3-letter organization to produce: https://news.ycombinator.com/item?id=49735284

Re: Apple Reference Image: A New Approach for Verified Photography

#349

Post by EmbarrassedHelp »

dwaite wrote: post #316
tgsovlerkhgsel wrote: post #62

This is really clever from Apple. The journalist use case is just the PR story. This will be really useful for identity verification and insurance apps, and has the potential to shift from "you need a smartphone to be able to live normally" to "you need an iPhone to be able to live normally". There are already plenty of insurances that require you to submit claims through a smartphone app that tries to essentially do…

Identity Verification is the realm of digital credentials. The goal isn't to make putting a driving license or passport on a desk and to verify the picture is of authentic pixels, but to move to mDL / EIDAS2 technology to have a digital representation of a driving license/passport. This tech would just indicate that they got authentic pixels capturing a potentially fake license. Likewise, this doesn't help as much as…

Nobody is worry about making the jobs of age verification companies trying to violate user privacy any easier. In fact we should be moving towards new ways of circumventing these attacks on privacy.

Re: Apple Reference Image: A New Approach for Verified Photography

#350

Post by EmbarrassedHelp »

grishka wrote: post #207

And why does someone have to trust Apple? Everything "security"-related that comes out of Apple lately somehow always assumes that Apple is to be unquestionably trusted. And, yeah, I'm incredibly tired of this whole concept of a device you own acting in someone else's interests. This needs to stop and it needs to happen 10 years ago.

Apple's failed attempt at adding client side scanning for illegal content should have made everyone weary of trusting them when it comes to security and privacy. The idea should have been killed long before it even became public.
Post reply on HN