YHK - yet another hacker news clone

> Today, powerful, widely available AI tools allow users to easily generate or alter photorealistic images to a degree that was difficult to imagine just a few years ago.

Photoshop has existed for decades and so has fake images. This is a low friction way to attest "this image came from an iPhone sensor and Apple approved it". It will still take the usual image forensics to determine if the scene it depicts is legitimate.

https://image-ppubs.uspto.gov/dirsearch-public/print/downloa...

The Apple Reference Image feature is here launched on iPhone 18 Pro and iPhone 18 Pro Max that both have built-in LiDAR sensors that could be used for this process.

Discerning a camera taken image of an image is typically very very easy. The collors/exposure/etc will all be obviously wrong in ways to a human, even without doing any analysis.

https://www.elcomsoft.com/news/428.html

https://blog.elcomsoft.com/2011/04/nikon-image-authenticatio...

You don't even have to travel to the location, you can just spoof GPS. And of course that will only be needed until some eastern european kid gets bored one weekend and the signing keys magically appear on pastebin.

It's funny to see Apple fall into this same trap.

But you're only allowed to do that if your name if Anish Kapoor

There’s no such thing as a Golden Gate Bridge.

Prove it.

I think the idea is to control the easy, cheap mass production of AI gen picture and not 100% coverage.

That’s a tradeoff I can live with.

While I'm on board with you about the inabsolute security of this (relative to what's typically expected of cryptographic systems), the fact that their 'verified' state requires a live certification and can be revoked means that the sensor responsible for obviously faked images will see those images and that device no longer certified.

It all relies a lot on trust in Apple, and integration with Apple, and relatively unmotivated attackers.

I think the "reference image" means a photo is taking by a real iPhone 18 device at a certain time, what the content actually means is another matter.

The "digital negative" in DNG format can be used to analyze the authenticity of the content.

Once a defeat device (a camera pointed at a screen) is functional, whoever has it, can simply automate a "receive API request, display image on screen, photograph it, return signed image" pipeline. A cheap internet service. I'd WAG a hundred thousand signatures per day per phone, limited by the sensor speed.

Since there's no way for anyone, Apple included, to correlate photo signatures with the device that signed them, it's also true there's no way to stop one device from signing millions in bulk. ("...an outside observer cannot determine whether any pair of reference images were taken by the same device..."; "...avoid even implicit public association between different photos taken by the same sensor...")

It's the same economic asymmetry as DRM vs. movie piracy (as soon as one group defeats a technical challenge, millions instantly benefit, at zero marginal cost). Apple has no chance of winning.

But Apple likely would reject such photo because of inappropriate depth map / LiDAR data.

PCC is quite good, about as close to private remote compute we can get without doing HME.

[0] https://support.apple.com/guide/iphone/view-reference-images...

[1] https://www.apple.com/legal/privacy/data/en/reference-image/

> When you take a photo in Reference mode after tapping Reference Mode, your device will include reference image information in the photo’s metadata. If you then view that photo and tap the Reference badge on your iOS device or click it on your Mac, the device will send the raw photograph, metadata about the photograph like the sensor’s signatures and the time frame in which the photo was captured, as well as the sensor’s unique hardware identifiers to Private Cloud Compute.

Edit: On reread it seems they do in fact send the actual photographic data to PCC, which I presume has some reason over signing metadata on-device? Original mistaken post is below for transparency.

You can always not use the reference image mode, and according to the article you send a hash of the signature of the photograph, so all they would know is you took a photograph in reference image mode at some point in time before the request.

True.

> raises the bar but could be bypassed with enough effort.

Anyone can spoof this.

Apple cannot stop spam iMessages. They can't stop someone from rendering their privileged UI inside a browser viewport. People copy and paste remote script executions from convincing captchas.

This whole provenance thing is a red herring. You agree with me, but there's truly not a single application for this that won't be exploited.

Insurance companies can have a native app and require the device’s camera. Companies already have tools to combat a liveliness check. Even if you’re using a modified app that pulls from the photo album instead of the camera? A video recording with the appropriate liveness verification easily avoids that mess.

Why do you believe Android manufacturers and SOC makers like Qualcomm won’t be able to offer a similar solution?

An insurance would either assign #1 an insurance agent or mechanic to initially assess the damage (trusted) or #2 ask the customer to send pictures (untrusted).

Tendency is #2 for cost-saving of the insurance, and 3rd party apps are used to execute this.

Now the idea is that the insurance company discontinues the App and the (untrusted) customer must have an iPhone 18 Pro to make an insurance claim?

Or is the insurance agent / mechanic an untrusted entity who will now be required to have an iPhone 18 Pro?

What is the fraud vector here, and how can the insurance service provider continue cost-saving on damage-assessment by offloading to the customer, if the customer is required to own a specific device?

I don't follow. It's my user agent that's verifying the image, and my device will tell me that it's not verified.

You have it all wrong.

Apple Reference Image is not an id system; it's primarily a way to attest that the pixels recorded by the camera sensor have not been altered in any way; the pixels, metadata and timestamp are all cryptographically signed.

There's no way to link a reference image to a person; it's also not possible to determine if a pair of images came from the same device.

> And while "a nation state actor can spoof this" is a problem for the journalism use case

This is incorrect:

    When the image sensor is first initialized in the factory, it creates a
    cryptographic signing identity, sharing only the public key with the
    factory. The SEP similarly creates a separately-attested signing
    identity. These identities are bound together into the device manifest,
    allowing us to later check whether a particular sensor and SEP are from
    the same device.

    The final signature on a reference image is a composite post-quantum
    signature combining RSA-3072 and ML-DSA-87. To our knowledge, Apple
    Reference Image is the only image provenance system that provides
    quantum-secure defenses.

> Also, the journalism use case suffers from the same fundamental issue all of these use cases suffer from: People will "verify" the picture by looking at the repost of a screenshot of the verification UI, not by verifying the original themselves.

I would imagine there will be a way to confirm an Apple Reference Image on the web. Pretty soon, 3rd parties will be able to verify the image themselves:

    Reference images can be viewed in the Photos app alongside the main
    image, like a digital negative, to visually compare the two assets and
    determine if any edits were made. APIs are available in iOS, iPadOS, and
    macOS 27 for third-party apps to enable viewing of these reference images.

Location services is quite hard to trick. To the point people have gone to the lengths of putting iPhones inside a microwave for RF shielding and setting up fake phone tower signals inside to trick the phone in to unlocking the hearing aid feature on AirPods for unapproved countries.

Whatever that means in detail...

What you are prevented from doing is adding a verification to a photo outside of the iOS image pipeline, or modifying the photo with the verification still in tact.

I have my doubts about this scheme but this is not one of them. If the point is that someone in principle could verify, that is enough for it to be useful, even if not everyone does.

The harder one is they can force apple to certify a fake photo.

the part that would be very hard but not outside the realm of plausibility, is that gov could force apple to introduce a bug in its pcc platform to link photos to the photographer in order to track and arrest inconvenient people. Apple says there are a bunch of protections against that but ultimately you are trusting apple to do it the way they say they are.

This entire system relies on trusting apple

If there is too much of a gap between the upper and lower bounds then the image becomes suspicious.

It’s opt-in because your photo is sent to Apple’s servers. Only if it were on-device should they even consider making it default.

> i guess you need internet to take a picture

Not really, internet is required to process the reference image, but that can happen later if you’re not currently connected.

> are complex hardware attacks really that important?

No, but the floor shouldn’t be “trivially exploitable” like C2PA[0]. It’d be interesting if there were a middle ground but we don’t have anything like that as of now.

[0] https://www.da.vidbuchanan.co.uk/blog/android-c2pa.html

Apple/iOS already have part authentication pipeline on its security sensitive devices (TouchID/FaceID). How can camera sensor can't be considered one of those and needs attestation before enabling?

From the document:

> Apple Reference Image leverages custom-designed image sensors in iPhone 18 Pro and iPhone 18 Pro Max to ensure reliable capture of image data, and relies on Private Cloud Compute, which provides a computational environment for secure photographic processing that cannot be subverted even in the case of device compromise. (emphasis mine)

I believe many of the problems we have, need social and human solutions, especially when the technical solutions are hard or impossible.

Like here, where we can no longer trust images to depict reality and act as proof. While its admirable that people look for technical solutions, the obvious social solution is to admit that images are no longer absolute proof and will become less and less trustworthy¹.

And, by admitting that, change our relation to these artifacts. Sure, that will change journalism, police work, legal systems, etc etc.

But pretending that we can rely on images might allow journalists, police, judges to continue relying on them as if they're authentic, which is a far bigger problem over a longer period.

Social solutions require effort, demand flexibility, take time and are messy. But this is what humans are and do. Not everything has a technical solution. Not every technical solution is the best option.

¹ we already saw this when people claimed "someone must have hacked my iphone and put it there". For decades we've seen this with images that are deliberately taken in a way to spin a story (like the illusion of a large crowd or spacious room through carefull angles or fancy lenses). And I predict we will see this with security footage, "live streams" or even bodycams with "ai enhancement". Just imagine a bodycam or a dashcam that manipulates the output to benefit the owner. "A dashcam that will prove your innocence in assumed traffic violations" or such.

Apple's protocol differs in that it requires a timestamping server to sign the file and centralising Apple as the single arbiter of truth. An excellent addition, if you trust Apple and the governments they're friendly with (I don't, especially the latter part).

No, because images will be confirmed to have been taken on "this iPhone". The New York Times will be able to publish an article and to attest that the photographs shown were taken by their journalists, and then your user agent will verify that provenience.