Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Reference Image: A New Approach for Verified Photography

security.apple.com

Post reply on HN
Print view View original

271–280 of 359 posts

Re: Apple Reference Image: A New Approach for Verified Photography

#271

Post by moffkalast »

pveierland wrote: post #15
BugsJustFindMe wrote: post #9

Earlier quoted context omitted.

iPhone lidar only works up to like 16 feet in the easiest lighting conditions (indoors) and may be functionally ineffective outdoors.

Still, that means that either the fake target scene and your screen presenting it would need to be outside of LiDAR sensor bounds, or you'd need to find a way to make the depth sensor data conform with your fake scene, both increasing the difficulty of producing a forgery.

A sufficiently light absorbing material is indistinguishable from infinity to a lidar. Or simply add a mirror that redirects it sideways, those can't be detected either.

Re: Apple Reference Image: A New Approach for Verified Photography

#272

Post by cromka »

modeless wrote: post #79

This is so insanely complex and requires placing trust in the correctness of so many pieces, many of them closed-source. And uploading every verified "developed" image to Apple's servers. And giving up full control of the software and hardware you "own". All to achieve a goal of "verifying" photons, which is only a part of the real problem of verifying the truth of an event that was photographed. I hope that companie…

Uploading photos is probably why this thing is unavailable in EU. Or tis another case of their performative malicious compliance.

Re: Apple Reference Image: A New Approach for Verified Photography

#273

Post by halestock »

alwillis wrote: post #71
halestock wrote: post #21

Earlier quoted context omitted.

This approach makes me wonder if the future is actually going to move towards visual cryptography.

Um… that's already a thing [1]: TL;DR: What is C2PA in 60 seconds What: An open technical standard for embedding cryptographically signed provenance data inside digital media files. Who: Created by a coalition founded by Adobe, Arm, BBC, Intel, Microsoft, and Truepic in February 2021. How: A C2PA Manifest (also called a Content Credential) travels inside the file and records who made it, when, and what tools were use…

Hm, that's more like digitally signing an image. I'm thinking about something like e.g. encoding/encrypting depth information from multiple images to create a composite that can't be duplicated without the source images.

Re: Apple Reference Image: A New Approach for Verified Photography

#274

Post by lern_too_spel »

Roark66 wrote: post #251

That is actually a pretty good idea.

An even better idea would have been to integrate it as an extension for C2PA, which already has an ecosystem developed around it. The capture portion of the ecosystem has lots of problems, and this is one potential improvement.

Re: Apple Reference Image: A New Approach for Verified Photography

#275

Post by cobbzilla »

jclardy wrote: post #233
coldtea wrote: post #218

Earlier quoted context omitted.

> There's no way to link a reference image to a person; it's also not possible to determine if a pair of images came from the same device. Apple knows the iphone the reference image was uploaded from, so, yes, there is.

It doesn't, as it is run through an Oblivious HTTP relay run by a third party before getting to Apple's servers. So it has no IP information, and the requests use anonymous access tokens. It is probably possible for an entity to break it, but it would require live access to both Apple and the third party (Likely Cloudflare) servers. And that is assuming there is only one third party routing OHTTP requests, otherwise…

Apple gets the device-signed image and replaces with a PCC signature to preserve anonymity.

> The final reference image is instead signed by Apple’s signing service, after validation by PCC.

So, if compelled, Apple could theoretically tell someone if two images came from the same camera.

Re: Apple Reference Image: A New Approach for Verified Photography

#276

Post by mcfedr »

Gigachad wrote: post #101
modeless wrote: post #79

This is so insanely complex and requires placing trust in the correctness of so many pieces, many of them closed-source. And uploading every verified "developed" image to Apple's servers. And giving up full control of the software and hardware you "own". All to achieve a goal of "verifying" photons, which is only a part of the real problem of verifying the truth of an event that was photographed. I hope that companie…

Because it’s impossible to implement this feature in open source and out in the open. It relies on a locked down image pipeline and hidden key.

its impossible in closed source. there is no reason to believe it does what it says it does. only private keys in the chain need to remain secret.

Re: Apple Reference Image: A New Approach for Verified Photography

#277

Post by slester »

cvoss wrote: post #269
alwillis wrote: post #165

Earlier quoted context omitted.

> This is really clever from Apple. The journalist use case is just the PR story. This will be really useful for identity verification and insurance apps, and has the potential to shift from "you need a smartphone to be able to live normally" to "you need an iPhone to be able to live normally". You have it all wrong. Apple Reference Image is not an id system; it's primarily a way to attest that the pixels recorded by…

> You have it all wrong. > Apple Reference Image is not an id system GP does not have it all wrong. A company desiring you to prove your identity often asks for a photograph of your government ID. Now that this is easily faked, it is reasonable to expect that the company will ask for a verifiably authentic photograph of your government ID. That the Apple Reference Image itself is not traceable to the device/user is b…

Why would anyone be using images of government IDs when modern documents have NFC chips with the data, signed and with anti-cloning mechanisms on them? If they can verify an Apple Reference Image they can verify an NFC document.

Re: Apple Reference Image: A New Approach for Verified Photography

#278

Post by porkshoe »

BugsJustFindMe wrote: post #77
porkshoe wrote: post #59

Earlier quoted context omitted.

You worry that a technology that you have never used nor evaluated might not work in practice... Therefore because of your worry (which is based on remarkably little information), it's a bad technology? Come the fuck on. That's beyond luddite bullshit.

Is this you? https://news.ycombinator.com/item?id=49685271

yes. https://imgflip.com/i/b1ay01

Re: Apple Reference Image: A New Approach for Verified Photography

#279

Post by autoexec »

throw0101c wrote: post #217
mitxela wrote: post #178

Earlier quoted context omitted.

You'll still need an iPhone, the verification is linked to the specific iPhone, and the specific iPhone is linked to you.

> You'll still need an iPhone, the verification is linked to the specific iPhone, and the specific iPhone is linked to you. Unless you use a friend's iPhone, or an iPhone you 'rented' for 5 minutes for $20 from someone on Craigslist or Facebook Marketplace to take a picture on and then Airdrop to you.

If they airdrop it to you that typically requires you to have an iphone or a mac and airdrop users are able to be identified and tracked so the photo could still be linked to your device. The EU forced apple to use Wi-Fi Aware though, so unless that's similarly vulnerable people in the EU might be able to avoid those issues.

Re: Apple Reference Image: A New Approach for Verified Photography

#280

Post by amanj41 »

tristanj wrote: post #8
amanj41 wrote: post #4

Earlier quoted context omitted.

Sony's analogous solution ( https://authenticity.sony.net/camera/en-us/ ) claims 3d depth information is built in, I'm sure Apple could do the same given at least some iPhone models have LiDAR on the back

This would work for close up shots taken on iPhone, but not landscape shots. The infrared dots the iPhone LiDAR projects are too weak to appear over long distances. Also the dots can be trivially blocked by putting your finger over the sensor, sometimes improving photo quality. I do this frequently when I want to take a photo through a window. The absence of the dot matrix tells the iPhone to focus on the background…

I see, yeah good point. Perhaps the lack of reliable depth data also be baked into some signed metadata property. Wouldn't tell you definitively if something were fake, but could be a context clue if a particular photo were dubious I suppose.
Post reply on HN