Remix.run Logo
bobthepanda 5 hours ago

i do wonder, that in the age where we have image and video creation out of the bag, whether or not this will result in whole classes of evidence becoming completely unreliable.

pjc50 5 hours ago | parent | next [-]

There's a big gap between "theoretically unreliable" and courts actually recognizing that, unfortunately. Lots of forensics is much more dubious than CSI would have you believe.

thatguy0900 2 hours ago | parent [-]

My girlfriends been having me watch law and order svu with her and to be honest it doesn't really even seem trustworthy with how they want to present it. The psychologist guy especially will come up with some wildly detailed assertions about who the criminal is based on nothing

assimpleaspossi 44 minutes ago | parent [-]

Are we really going to go to a fictional TV show now?

yardstick 5 hours ago | parent | prev | next [-]

There used to be - probably still are - cameras that would digitally sign all their images. Used in crime scenes? Maybe we will end up seeing wider adoption of this, despite the privacy implications. Hackers attention then will focus (once again) on the certificate supply chain and crypto hardware.

ChrisMarshallNY 5 hours ago | parent | next [-]

I worked for a company that made these. We sold expensive software to the FBI.

Took about six months for someone to crack the hash.

deepserket 5 hours ago | parent | next [-]

What about a system that saves in some way the hash in a Blockchain, and if you, eg, XOR the hash of the video with the hash of the previous block you will "certainly" know that the video was created between the previous block and the block where the hash is saved in. That's a starting point.

dindunuf 4 hours ago | parent | next [-]

that does nothing to verify authenticity

teravor an hour ago | parent [-]

it does something, sometimes. it pushes the required fabrication timeline back.

if it is mandated that every photo or video taken for the possible use in evidence is notarized at the time of acquisition, any fabrication would necessitate total premeditation. that is, the fabricators would need to know ahead of time what they were pursuing and what evidence they would need. this seems like a very costly barrier.

for example, altering security footage would require some fantastical elements: a real-time system of ingesting real footage and altering it in real-time to slip it into the notarization pipeline within the error margins.

requiring that any equipment that produces acceptable evidence stream commitment hashes in real-time to public append-only repositories would be an enormous step forward.

mcapodici 4 hours ago | parent | prev | next [-]

This sort of chain doesn't need PoW I take it, just a very secure police server to sign blocks.

inigyou an hour ago | parent [-]

And it couldn't be run by the police or any of their friends, since they're the adversary.

ChrisMarshallNY 4 hours ago | parent | prev | next [-]

Might have a point. This was before blockchain.

I suspect that the cops wouldn’t like the chain public, though.

Terr_ 4 hours ago | parent [-]

Like when people discuss voting, I believe a blockchain [0] is a terrible pitfall compared to a classic distributed database system of predefined nodes run by different organizations. For example, imagine a couple hundred predefined nodes run by different states, federal agencies, etc.

An attacker altering the ledger would still require compromising an unreasonably large number of independent groups at once, and even then the rest would be able to clearly see that some unusual and suspicious event occurred.

By limiting membership a bunch of problems simply vanish, like long-clearing times, wasting hardware on mining, vulnerability to foreign botnets, etc.

[0] A blockchain is distinguished by its core requirement, from which a cascade complexity flows: Uncontrolled node membership. Don't be fooled by people pitching "private blockchain", its a contradiction in terms designed to rehabilitate hype, like "multi-sample Theranos test" or a bicycle as "Segway passively stabilized inline wheel model."

4 hours ago | parent | prev [-]
[deleted]
EPWN3D 4 hours ago | parent | prev | next [-]

"Crack the hash"? Does this mean you were employing some novel hashing algorithm and relying on its secrecy? If so your employer were never serious about security in the first place. Hardware attestation is more or less a solved problem, and that solution does not involve secret algorithms.

ChrisMarshallNY 4 hours ago | parent [-]

Eh. It was some kind of hash of the image. I was not involved in that project, so can't tell you exactly how it worked, but the images were "signed," and someone figured out how to "re-sign" an altered image.

I think it was a fairly well-known technique.

lostlogin 4 hours ago | parent | prev [-]

Now sell them version 2.

aorloff 5 hours ago | parent | prev [-]

I imagine in this age of blockchains you could embed into a media file a signature that proved it was no older than the timestamp of when it occurred, the digital equivalent of a hostage-proof-of-life photo with a recent newspaper

But I don't know of a cryptographic mechanism to ensure that a digital image is not more recent than a particular time

dspillett 4 hours ago | parent | next [-]

> But I don't know of a cryptographic mechanism to ensure that a digital image is not more recent than a particular time

Many (most?) blockchain mechanisms include a timestamp in each transaction on the chain, so while multiple records from the same owner prove little (the timestamps could be faked over a given period of time) the interaction with the wider network and the chain would give some confidence that the record happened between within a small amount of time.

The other possibility, that doesn't require a chain with many independent active participants, is to have things signed by an external trusted authority. Submit a hash of the content and appropriate metadata to them, and have them sign it with a signing timestamp. I've considered abusing ACME certificates for document signing like that: the hash of content (or some signature based upon it) becomes the subdomain to sign¹ and you get a certificate that even after expiry is evidence that the CA saw that value at the signing timestamp. Note of the signing will also be in the public certificate transparency log. This wouldn't, on its own, prove anything about the authenticity of the content, that could have been doctored before signing, but it does prove that the content+metadata existed at that time (so might be more useful in copyright claim type cases, or agreed contract situations where all parties have signed the content and the signatures are included in the metadata, than for proving authenticity).

----------------

[1] based64²-ed with non-alphanumeric characters removed and truncated³ to fit or split, so acodha3sf7whsrhtqestkabtx0b4bbhyveee0ajnrpqcuxrjjvmhsujgcex.domain.tld or acodha3sf7whsrhtqestkabtx0b4bbhyveee0ajnrpqcuxrjjvmhsujgcex.w5jmmkpmyfgshx2jecsfordpnq.domain.tld

[2] names not being case-sensitive drops some of the entropy, if that is a concern use a 32-bits-per-character encoding instead and have names twice as long

gcr 4 hours ago | parent | prev | next [-]

Publish hash(image) on the blockchain at a verifiable time, then publish the image itself.

The image contains the previous block’s hash.

Wouldn’t this establish both a lower bound and an upper bound on the time the image could have been produced?

5 hours ago | parent | prev | next [-]
[deleted]
__del__ 5 hours ago | parent | prev | next [-]

wouldn't that be a hash of the image signed by a trusted entity and stored on a chain? maybe i'm overlooking why this doesn't work

catlikesshrimp 5 hours ago | parent | prev [-]

Interesting, There aren't any newspapers left in my country, neither printed nor not printed. The closest you can find is the weekly advertising booklet here and there. Which is irrelevant now because a computer can either stich new content to an old picture, or entirely producing a custom picture.

That would be a use case for a block chain. But I still don't understand how you are securing the integrity of the validity of the certificate stating the authenticity of the media. I only understand you are stamping media with a "at least as old as [timestamp]

3eb7988a1663 4 hours ago | parent | next [-]

If you want to prove that "happened at or after this timestamp" you can use a randomness beacon. NIST[0] and others publish a random number every N minutes. Embed that (or a combination) of those seeds to prove that you observed this value. This does not work for the harder problem of proving an event happened before a timestamp.

[0] https://csrc.nist.gov/projects/interoperable-randomness-beac...

appaj 4 hours ago | parent | prev [-]

Which country no longer has newspapers?

thewebguyd 5 hours ago | parent | prev | next [-]

I suspect so. Tbh, I'm surprised it hasn't happened already with the amount of processing that cell phones do on photos, with generative fill/expand/perspective change, etc.

We are quickly going to reach a point where any photo or video taken on a smartphone is inadmissible by default.

Lammy 4 hours ago | parent | prev | next [-]

The end-game is that people will willingly surveil themselves 24/7 on behalf of The System because that will be the only way to prove what they didn't do.

LtWorf 4 hours ago | parent [-]

Ah yes training the AI with more data to represent me even more accurately.

asdff 4 hours ago | parent | prev | next [-]

You should see what people were capable of in the darkroom, let alone before all this. You could always manipulate imagery ever since there was imagery to manipulate.

Arodex 4 hours ago | parent | next [-]

This is why:

- the whole roll of negatives was prime evidence;

- police forces were one of the biggest users of Polaroid instant film.

And moreover, who had a darkroom and the skills to edit substantially a picture?

Whereas here we have nobodies being able to generate pixel-perfect fake "evidence" from the computers they already have.

asdff 3 hours ago | parent [-]

Plenty of people. If you have running water, some tape, and trashbags, you too could have a darkroom.

https://www.metmuseum.org/exhibitions/objects/objects@exhibi...

The roll itself can be manipulated too. Most of the techniques used in modern photoshop are basically 1:1 carry overs of darkroom processes. Layers, dodge and burn, masking, etc.

There was a time you could take this class in highschool.

olyjohn 4 hours ago | parent | prev | next [-]

Big difference between that and writing an AI prompt.

asdff 3 hours ago | parent [-]

Not really. End result is the same: manipulated image.

pyth0 3 hours ago | parent [-]

Are we really pretending like the effort to do something doesn't affect how often that thing occurs?

asdff 3 hours ago | parent [-]

Are we acting like that was ever a limiting factor towards disseminating propaganda in the analog age?

mukbangpervert 4 hours ago | parent | prev | next [-]

We've gone from highly skilled people being able to forge some specific photos and documents using substantial time/energy/resources, to any asshole being able to generate realistic full-motion video in minutes.

I get that there is a certain type of moron who thinks that the collapse in cost of misinformation has no harm... but all you've done is announce to the world that you are a moron.

asdff 3 hours ago | parent [-]

It is really not any different. People would throw a hubcap in the air and pitch it as a UFO photo and idiots would latch on to that. You could take a photo of the empire state building and use a double exposure to make it look like you were king kong. Kids were doing this sort of stuff. Stop motion home movies where you'd look like you were levitating or your head got cut off.

It always comes down to provenance.

mukbangpervert 13 minutes ago | parent [-]

People are just lining up to announce that they're fucking idiots.

croes 3 hours ago | parent | prev [-]

How many people could do that?

How long did it take?

Now it’s a lot easier and faster

asdff 3 hours ago | parent [-]

Plenty could.

https://www.metmuseum.org/exhibitions/objects/objects@exhibi...

croes 2 hours ago | parent [-]

Compared to now

https://data.worldbank.org/indicator/IT.NET.USER.ZS

testing22321 4 hours ago | parent | prev [-]

I’m still shocked we have not seen an extremely convincing AI video of a famous person or world leader announcing something huge like UBI or WW3 or aliens.

Surely it’s just a matter of time.

2 hours ago | parent [-]
[deleted]