News for hackers. Stuff that matters.
Re:Family fun with deepfakes by clarkmoody on Friday February 02, 2018 @11:12AM (#16291641)
It's time for cryptographic signatures in cameras (phones and otherwise) so that you can prove something is unadulterated.

Apple signing key -> your phone's key -> signature over hash of the media (edit: for video, embed signatures every so often to you can verify a shorter clip out of the whole). Embed Apple's signature and your pubkey in the metadata of the image, and TwitYouFace will verify on upload that it's authentic.

Of course, you can't fix stupid unless you talk about a complete overhaul of public education... And even then, people are people.

Re:Family fun with deepfakes by ggg9990 on Friday February 02, 2018 @11:16AM (#16291681)
That doesn’t prove anything. Make your fake video, point your phone camera at it, record.
Re:Family fun with deepfakes by pavlov on Friday February 02, 2018 @11:23AM (#16291743)
The phone has enough metadata to make that easy to expose, at least in the simple case. There's GPS location, time, and even your Face ID verification (on iPhone X) to prove that it was really you holding the camera.

If you make your fake video after the event, the location and time will be obviously off.

Re:Family fun with deepfakes by Spivak on Friday February 02, 2018 @11:26AM (#16291768)
Which are all values written by the camera. My camera will believe it's whatever time, location, and face I tell it.
Re:Family fun with deepfakes by pavlov on Friday February 02, 2018 @11:32AM (#16291815)
The point by clarkmoody was that Apple would be signing the photos with their key to ensure those values are correct.

It would be basically the macOS Developer ID software model applied to photos.

Re:Family fun with deepfakes by nandhp on Friday February 02, 2018 @11:39AM (#16291880)
You can set the time on your phone, and GPS spoofing is a technology that already exists -- or you could disable location services.

https://en.wikipedia.org/wiki/Spoofing_attack#GPS_spoofing

Re:Family fun with deepfakes by 05 on Friday February 02, 2018 @11:58AM (#16292049)
Cryptographic timestamps are a thing
Re:Family fun with deepfakes by vinkelhake on Friday February 02, 2018 @11:45AM (#16291937)
That's fine, if you publish that video it will be signed by ggg9990 and you will have to decide if you want to be associated with it. Watchers will then have to decide if ggg9990 is a trustworthy source.

It boils down to trust, not whether the original video was real or not.

To put it another way, reputable news organizations already go to great lengths to ensure that their stories are well sourced. At the end of the day, they are putting their reputation on the line.

Re:Family fun with deepfakes by bufferoverflow on Friday February 02, 2018 @11:41AM (#16291889)
Try it. Seriously, try and record a realistically looking recording off the screen. Movie pirates have been trying to perfect it for decades, and even their best attempts look obvious.
Re:Family fun with deepfakes by 05 on Friday February 02, 2018 @12:03PM (#16292110)
Unless you build DRM right into camera sensor (which is, admittedly, not that hard), you can use an FPGA chip to receive your source video in HDMI format, convert it to CSI interface and send it to the phone SoC over the camera flex cable.
Re:Family fun with deepfakes by ggg9990 on Friday February 02, 2018 @12:16PM (#16292207)
If you can make a porn video of someone look like a porn video of someone else, I’m sure the technology to solve this problem is not far off.
Re:Family fun with deepfakes by bloopernova on Friday February 02, 2018 @02:11PM (#16293334)
What if all legally acceptable cameras have to use multiple sensors?

In other words, 2 main stereoscopic sensors, each recording their cryptostream to their storage. In addition to that, you have 2 UV sensors doing the same thing, and 2 IR sensors as well?

The idea being that it's much, much harder to fake something if you have to take IR and UV into account.

Isn't this also where something like a blockchain is useful? Where data is dumped into it realtime by this mythical secure camera, with all its associated metadata.

Then you can ask: "does the time the data was added agree with the time the camera says the data was recorded?" "Does the blockchain agree that the data hasn't been modified after it arrived?"

Add to that the possibility that there are multiple cameras all recording this incredibly detailed video from different angles, and the evil counterfeiters will (hopefully) have a dickens of a time faking all this.

Although with all this wonderful processing, networking and storage power to enable this secure camera, you can probably create a faking system too.

Re:Family fun with deepfakes by clarkmoody on Friday February 02, 2018 @11:23AM (#16291741)
Maybe a second layer of AI that cleans up that video-of-video look?

Philosophically though, I think it's a good thing that many are learning not to trust information from self-proclaimed authorities :-)

Re:Family fun with deepfakes by spac on Friday February 02, 2018 @11:31AM (#16291800)
So what do you propose? At some point a system of trust must be established or are you going to travel around the world, attend every event, see everything with your own very eyes, run the analysis, crunch the data etc... to be convinced of the information?
Re:Family fun with deepfakes by jessaustin on Friday February 02, 2018 @11:44AM (#16291917)
It's possible to simply believe less. Not only will you be less likely to get screwed over, you'll also be happier, when you no longer have a big handle on your nose that the bastards can use to lead you around.
Re:Family fun with deepfakes by throwaway2048 on Friday February 02, 2018 @11:23AM (#16291742)
The "just sign the photos" line of thought fails in exactly the same way DRM does, yet its brought up every time this issue is raised on HN...
Re:Family fun with deepfakes by maxerickson on Friday February 02, 2018 @11:37AM (#16291868)
Hasn't ios DRM continued to get more effective over time?

If there are no known exploits, a signed video, marked as having a network based timestamp, is at a minimum incrementally more reliable than a video without such metadata.

Re:Family fun with deepfakes by fredley on Friday February 02, 2018 @11:43AM (#16291910)
This is at the same time a great solution, and a useless one. Sure, you could verify that a video came from device X by carefully comparing the signature of the video was signed by the public key of the phone, but who on earth is going to do that for a video their aunt posted on Facebook?
Re:Family fun with deepfakes by acdha on Friday February 02, 2018 @12:19PM (#16292233)
That’s a big challenge: for big news stories it’d be useful if it meant that TruePatriot420 has to explain how their phone was used to record a candidate’s private conversation in a different state but I think many of the most damaging things for many victims won’t hit that level of scrutiny. If some horrible person tries to smear their ex, most of the damage will come simply from circulation.

What might be worth trying would be some sort of verified badge if this became common enough that players could meaningfully highlight its absence, similar to the way browsers are now showing non-HTTPS sites as insecure. If Facebook badged the video with a big “this iPhone video doesn’t have the usual signature” message that might slow people down.

For the deepfake porn or fake news problem I also wonder whether there’s a useful fuzzy ID service where a player could display a “this is substantially similar to <source video> and may be a copy” warning which wouldn’t be so inaccurate that nobody would heed it. That could be really important if we started seeing political fakes where someone is shown accurately but their words are faked.

Re:Family fun with deepfakes by clarkmoody on Friday February 02, 2018 @12:10PM (#16292165)
You're missing the point.

Facebook / Twitter / etc verify the crypto signatures on media ingress. Then they can give proper attribution and show a checkmark or something that attests the media hasn't been altered.

So in your feed, there will be some media with checkmarks and some without and you can choose which to believe more.

Alternatively, a competitor could come along and reject all media that doesn't pass cryptographic verification.

Re:Family fun with deepfakes by 52-6F-62 on Friday February 02, 2018 @11:49AM (#16291988)
It would absolutely have to become more consumer and lay-user friendly.

Of course, depending on how that's implemented it could just be another vulnerability in easy-to-use proofing.

But if there was some way to add an abstraction on top of the raw keys, keeping them still accessible if the user is keen, then that might be a step in the right direction.

Re:Family fun with deepfakes by e40 on Friday February 02, 2018 @11:31AM (#16291799)
It's time for cryptographic signatures in cameras (phones and otherwise) so that you can prove something is unadulterated.

The otherwise is already covered by DSLRs. Canon has it, and I'm sure Nikon does. Law enforcement has been using this stuff for years.

Re:Family fun with deepfakes by ISL on Friday February 02, 2018 @01:50PM (#16293104)
Is there a way to enable a keysigning in my Canon SLR? How do I install my private key?
Re:Family fun with deepfakes by e40 on Friday February 02, 2018 @05:54PM (#16294910)
No, it's a hardware module that you connect to the camera.

http://www.canon.co.jp/imaging/osk/osk-e3/index.html

Apparently it was broken in 2010 (found while googling for this).

Re:Family fun with deepfakes by bhouston on Friday February 02, 2018 @11:16AM (#16291682)
This is how things have to proceed for sure.