Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA, FBI, and CISA Release Cybersecurity Information Sheet on Deepfake Threats

cisa.gov

Post reply on HN
Print view View original

51–60 of 195 posts

Re: NSA, FBI, and CISA Release Cybersecurity Information Sheet on Deepfake Threats

#51

Post by mc32 »

wojciechpolak wrote: post #19
upofadown wrote: post #3

Entities like CFOs and political leaders will have to start cryptographically signing their statements. There is no practical way to detect fakes after the fact.

All official materials should primarily be posted on the original authors' websites and signed using asymmetric cryptography. Furthermore, new open standards should be established to enable the presentation of such signatures/verification on well-known platforms like YouTube, FB, etc. These platforms should always provide a clear reference to the original material along with its digital signature. For example, when w…

Isn’t this a problem? Someone can take an actual clip of a speech but because it’s not signed by the speaker no matter how bad the speech, it could be declared inauthentic or deepfake because it has no signature?

For example the whitehouse is known to revise the text of the president’s speeches when he says the wrong thing. If we only have officially released videos where the gaffes and fables are left out, how is anyone to know what he actually said?

Re: NSA, FBI, and CISA Release Cybersecurity Information Sheet on Deepfake Threats

#53

Post by rtkwe »

nicce wrote: post #32
wojciechpolak wrote: post #19

Earlier quoted context omitted.

All official materials should primarily be posted on the original authors' websites and signed using asymmetric cryptography. Furthermore, new open standards should be established to enable the presentation of such signatures/verification on well-known platforms like YouTube, FB, etc. These platforms should always provide a clear reference to the original material along with its digital signature. For example, when w…

There are already coming cameras which sign the data on the fly with help of hardware security modules. Only that can be truly verifiable. Adding signature after recording works to certain degree, but it still does not guarantee that the content is what the camera saw.

At least as a start after the fact signing will say this video was released by X.

Re: NSA, FBI, and CISA Release Cybersecurity Information Sheet on Deepfake Threats

#54

Post by AnimalMuppet »

insanitybit wrote: post #48
2devnull wrote: post #44

Earlier quoted context omitted.

But will that make a difference?

Time will tell. I think the answer is yet. I am inclined to avoid naming specific, relatively recent instances, but I think it would be fair to say that we're in a world with very high skepticism of the media and politicians have been taking that into account by claiming that the news is simply lying, that what they're reading is fake, etc.

It cuts both ways. We don't trust the media, and we don't trust the politicians. So when a politician says that the media is lying, we tend to believe whatever we want to believe.

The loss of truth is a serious thing for a society. (Yes, back in the Walter Cronkite days we had less truth than we thought we did. We had more agreed-upon truth that matched reality than we do today, though, and I think the difference matters.)

Re: NSA, FBI, and CISA Release Cybersecurity Information Sheet on Deepfake Threats

#55

Post by rtkwe »

nicce wrote: post #45
jacobsimon wrote: post #35

Earlier quoted context omitted.

How would that work with video editing? Like if someone records something and then trims it for length or needs to combine multiple streams. Seems like hardware level verification only goes so far.

For editing it does not matter if you just remove or move frames. Video is just a series frames and each of them are signed, each frame can be validated if the content is unmodified. If the same root key is used for another stream, then frames can be combined easily. I don't know audio well enough how it happens there. But potentially it can be signed in chunks as well. Of course, one needs to consider risks if editi…

You do get into issues because video files aren't just raw frames and haven't been for ages. Plus any changes on top of the video wouldn't just pass the frames through beyond the fact that current video encoding would reencode the embedded video when the larger video it was embedded in was exported. You'd have to add support for seamless passthrough of the original frames so the signatures could be validated plus some additional layers if you wanted to enable having graphics on top of the footage.

It would require completely changing how software currently handles video editing in short.

Re: NSA, FBI, and CISA Release Cybersecurity Information Sheet on Deepfake Threats

#56

Post by Horffupolde »

rhplus wrote: post #34
nicce wrote: post #32

Earlier quoted context omitted.

There are already coming cameras which sign the data on the fly with help of hardware security modules. Only that can be truly verifiable. Adding signature after recording works to certain degree, but it still does not guarantee that the content is what the camera saw.

…what the camera saw. Cameras can record screens. Perhaps adding a signed channel for depth and/or non-visible light would be the next step.

Yes but the idea is that you trust the camera which unique and works as a physical private key.

Re: NSA, FBI, and CISA Release Cybersecurity Information Sheet on Deepfake Threats

#57

Post by rtkwe »

mc32 wrote: post #51
wojciechpolak wrote: post #19

Earlier quoted context omitted.

All official materials should primarily be posted on the original authors' websites and signed using asymmetric cryptography. Furthermore, new open standards should be established to enable the presentation of such signatures/verification on well-known platforms like YouTube, FB, etc. These platforms should always provide a clear reference to the original material along with its digital signature. For example, when w…

Isn’t this a problem? Someone can take an actual clip of a speech but because it’s not signed by the speaker no matter how bad the speech, it could be declared inauthentic or deepfake because it has no signature? For example the whitehouse is known to revise the text of the president’s speeches when he says the wrong thing. If we only have officially released videos where the gaffes and fables are left out, how is an…

We don't have to live in the world where people are maximally naive (even if it seems so today). That also assumes there's not a signed video available of the event, usually things are recorded by more than one person especially a speech by the president.

The biggest risk IMO is that key becomes immediately one of the most important secrets to keep since it holds the promise of validating anything you want to lie about.

Re: NSA, FBI, and CISA Release Cybersecurity Information Sheet on Deepfake Threats

#59

Post by lazide »

rhplus wrote: post #34
nicce wrote: post #32

Earlier quoted context omitted.

There are already coming cameras which sign the data on the fly with help of hardware security modules. Only that can be truly verifiable. Adding signature after recording works to certain degree, but it still does not guarantee that the content is what the camera saw.

…what the camera saw. Cameras can record screens. Perhaps adding a signed channel for depth and/or non-visible light would be the next step.

Currently difficult to display something a modern smartphone camera will not be able to distinguish from real, right? (Pixel artifacts, lighting too consistent, etc. right?).

Re: NSA, FBI, and CISA Release Cybersecurity Information Sheet on Deepfake Threats

#60

Post by lazide »

rightbyte wrote: post #5
upofadown wrote: post #3

Entities like CFOs and political leaders will have to start cryptographically signing their statements. There is no practical way to detect fakes after the fact.

Really? How about not using unofficial channels for statements? I mean, what is new to this problem. Other than it is somewhat cheaper to pair the fake statement with the person responsible reading it out laud. Department press release -> Reuters -> News paper -> reader No signing required. The reader can verify the press release of he wants to.

It’s trying to solve the social issue of ‘omg react!’ videos and random reshare clips through technical means (proving the clip isn’t original).

Which it won’t. Eventually might be relevant when in a context where someone actually stops and spends time looking at evidence (civil and criminal court cases perhaps?) but those already use chain of custody for evidence because evidence has already been easy to fake for… well forever.

Still should be done IMO though, as it’s cheap and easy and will hopefully make it a little harder (or easier to detect) to do mass faking in the ‘middle’ - like fake IDs for online services, fake blackmail photos, etc.

Post reply on HN