Proof of Capture: a $100 open-source camera that signs photos at the moment of capture
Proof of Capture: Apple Reference Image, but open source and using steganography
After Apple introduced Reference Image, two camera enthusiasts built an open-source alternative using a Raspberry Pi Zero and an ATECC608 crypto chip. The camera embeds a signed perceptual hash directly into the image pixels via steganography, so the signature survives compression and resizing. The private key never leaves the chip. The project costs under $100 and is open source, though it still can't prevent screen attacks.
Detection is a losing race: every improvement in the detector is training signal for the next generator.
- Retr0id
> we sign a perceptual hash (pHash) of the image rather than an exact pixel checksum
Perceptual hashes are non-cryptographic. There are certainly collision attacks, but what about preimages? A preimage would completely break this scheme.
This paper demonstrates second-preimage attacks against PhotoDNA and PDQ: https://eprint.iacr.org/2021/1531.pdf
- fitzn
Here's a toy for embedding small text into images steganographically:
- treyd
I don't understand why few people are pointing out the obvious vulnerability here that you can control the wires going into the photosensor controller and pretend that the photosensor is capturing whatever image you want. I imagine it's not exactly trivial to do this, but a grad student with an FPGA could probably figure it out.
- vzaliva
I expect in the near future all digital cameras to digitally sign the images they take. Even before AI slop, it was useful to avoid manual alterations. AI makes it all too easy, so it makes sense.
However, this will certify only the original image. I think the missing part of this is additional layers of certification which allow some image editing (e.g., rotating, contrast, etc.) yet clearly document that the image was modified and link to the original image ID. Kind of like a signed git log.
- Lammy
In the future, people willingly surveil themselves 24/7 with cryptographic proof, because fake images and video will be so good that it will be the only way to prove what one didn't do. Total Information Awareness achieved :D