How will remote attestation prove that you were actually standing on the balcony pointing the camera, and not recording some slop you generated? The analog hole is a real problem.
Don't worry, photographs were being faked before Lee Harvey Oswald.
The optical data will be cryptographically bound to the state of the autofocus mechanism and to the output of a LiDAR scanner.
We know it is practical to have a LiDAR scanner in the same assembly as an image sensor because the rear camera bump of the iPhone Pro has a LiDAR scanner.
The technology need not be 100% tamper-proof to have a large effect on society: there is a huge difference in persuasiveness between the claim that anyone could have created a particular video by submitting to an AI some starting videos and images and some prompts and the claim that anyone with years of training and experience in cutting-edge microelectronics could have bought 500 iPhones and used very expensive equipment to create 499 ruined iPhones and one iPhone that can be used to create false attestations of recordings -- particularly because in a high profile instance such as a repeat of the Rodney King beating, Apple engineering would tend to be very interested in examining the device used to make the recording.
> We know it is practical to have a LiDAR scanner in the same assembly as an image sensor because the rear camera bump of the iPhone Pro has a LiDAR scanner alongside the optical lenses.
The iPhone Pro starts at $1199.
Moreover, LiDAR is essentially a laser that emits at a particular wavelength and a camera that detects that wavelength, so it could be fooled by pointing it at a screen that emits at the same wavelength, which in turn could be an ordinary screen with something in front of it that converts light at a wavelength it emits to the one the LiDAR sensor is expecting.
And that's if you insist on using light. The LiDAR sensor itself is an analog piece of hardware that converts the light into an electrical signal, so if you substitute its electrical output as the input to the signing hardware then it signs whatever you want and never knows the difference.
The hardest part about this is probably creating a credible depth map of a generated 2D image, which is the part that doesn't require signatures or attestation.
> The technology need not be 100% tamper-proof to affect society: there is a huge difference in persuasiveness between the claim that anyone could have created a particular video by submitting to an AI some starting videos and images and a few prompts and the claim that anyone with years of technical training and experience could have bought 500 iPhones and used very expensive equipment to create 499 ruined iPhones and one iPhone that Apple's engineers have not detected yet that can be used to create falsely attested recordings.
Until one of the people with the capacity to do it sets up a website where anyone can submit an image and have it signed.
Moreover, isn't "most people can't do this but some people still can" actually worse? It's a system for providing undue credibility to the forgeries from the people who can do it.
Without even making most legitimate images more credible, since most phone cameras don't have fancy LiDAR hardware.
The camcorder used to record the Rodney King beating also probably cost at least $1199. LiDAR will spread to cheaper smartphones if enough consumers start to value it, and many (maybe most) consumers will do if it becomes necessary for the consumer to retain the ability to make recordings that can be used as evidence.
>it could be fooled by pointing it at a screen that emits at the same wavelength
LiDAR emits a pulse, then times how long it takes to get a pulse back, so your exploit got a lot more technically complicated since of course these pulses travel at the speed of light.
>substitute its electrical output as the input to the signing hardware
The LiDAR scanner is part of an integrated circuit (IC) that encrypt the data from the LiDAR scanner. To get at the unencrypted data, you would have to uncap the IC and use a scanning electron microscope or such.
How do I know so much about iPhone hardware? I don't, except I know that Apple is widely believed to be the world's leader in hardware security, so I strongly suspect that every single data path in a recent iPhone is encrypted before it leaves any IC.
>Until one of the people with the capacity to do it sets up a website where anyone can submit an image and have it signed.
The web server behind the site would have to be connected to a compromized iPhone Pro. As soon as Apple becomes aware of the web site, they will disable that iPhone Pro. Specifically, they will be able to determine its ID number (term?) from the attestation, and I'm pretty sure they already have the ability to disable an iPhone by ID number.
>Moreover, isn't "most people can't do this but some people still can" actually worse?
If Apple cares and is willing to expend the necessary engineering resources, then anyone (other the Apple itself) who makes any sort of notable or economically important or culturally important use of their ability to create a false attestation will retain the ability for only a brief time.
The last time a public jailbreak was released for modern iPhone hardware running the actively signed, latest iOS version was in May 2020, which is over six years ago. It is possible that someone will publish a jailbreak in the future, but the lifespan of that jailbreak will probably be only a few days. I expect Apple could exert a level of control over "camera remote attestation" similar to the level of control it has already achieved over which OSes (and which apps) can run on its iPhones. In general, these "technical regimes" are designed to make it easy for the engineering organization to recover from exploits as soon as the organization becomes aware of the exploit.
Again: do you really want photographic evidence to stop being useful in almost every situation (e.g., in court)? If not, then what is your alternative to "technical regimes" reliant on remote attestation similar to the regime I just described?
> I know that Apple is widely believed to be the world's leader in hardware security
That's a pretty rich qualification. "I know" suggests you can prove it, but you have to qualify it with "believed" because you can't. You can't cite anyone that audited Apple's source code, or ask a knowledgeable stakeholder for a credible architectural understanding. You haven't written an exploit, or reverse-engineered one.
It's purely faith. You're making an argument "you know" based on the loyal assumption that Apple's marketing is correct. You could be citing security theater muppets for all you know, but apparently your argument isn't contingent on veracity or transparency.
> Again: do you really want photographic evidence to stop being useful in almost every situation (e.g., in court)?
Yes? Do you really want a purity spiral where people that get abused, subjected to police brutality or sexually assaulted are discredited because they're too poor for a LIDAR camera? I would lobby day and night for this two-tiered evidence system to be reversed because it would force the miscarriage of justice as a marketing gimmeck for iPhone technology. It's not a scalable, holistic, trustworthy, accessible, or safe option for anyone, let alone Americans. There is not a single company in the United States that can implement a system like this protected from domestic or foreign adversaries.
Truly, go fuck yourself if you genuinely think this false dichotomy is the only worthy perspective.
> LiDAR might spread to all smartphones if its starts to become important to society.
You expect $50 phones to have LiDAR hardware?
> LiDAR emits a pulse, then times how long it takes to get a pulse back, so your exploit got a lot more technically complicated since of course these pulses travel at the speed of light.
That's assuming you're trying to detect the pulse rather than sending back photons with particular timing from when you expect it to come. Notice that you can also try more than once and only publish the image where you got the timing right.
You also have the advantage because you can have something which is directly in front of the sensor but is sending back photons later than that because you're pretending to be something which is further away.
> The LiDAR scanner is part of an integrated circuit (IC) that encrypt the data from the LiDAR scanner. To get at the unencrypted data, you would have to uncap the IC and use a scanning electron microscope or such.
With the right equipment you can affect electrical signals within an IC without disassembling it.
Or you can disassemble it. It doesn't have to be easy when only one person has to do it.
> The web server behind the site would be connected to a compromized iPhone Pro. As soon as Apple becomes aware of the web site, they will disable the iPhone. Specifically, they will be able to determine ID number (term?) of the iPhone from the attestation data, and I'm pretty sure they already have the ability to disable an iPhone by ID number.
So they set up an apparatus where they can put any such a phone, buy them in bulk and resell them immediately after use for the same price they paid. Then most are never detected and even if a few of them are, Apple is only disabling the phone of the innocent third party buyer, likely outside of the return window, and thereby negatively impacting the resale value of their own brand.
Also, your premise was that this would be in every phone and then they're not buying late model iPhones, they're getting e-waste phones with dead batteries or cracked screens by the pallet for ~free to use once on their way to the scrapper.
> The last time a public jailbreak was released for modern iPhone hardware running the actively signed, latest iOS version was in May 2020, which is over six years ago. It is possible that someone will publish a jailbreak in the future, but the lifespan of that jailbreak will probably be only a few days.
You're assuming they publish their methods for Apple to patch instead of setting up the service to sign images without documenting exactly how they do it.
And also that every phone OEM cares to that extent, which they obviously don't.
I have stock Android on a Pixel 10 and RCS group texts don't work here either. Some people just can't be added to the group and some people just don't receive the texts.
I flashed my 10 with Graphene as soon as it was supported and RCS was a bit of a challange as well. Both because of the recipient's device/settings as well as my own privacy settings.
If food has harmful uses, and I think any one sensible would have to agree that it does, then giving everyone unrestricted food is likely to make it worse.
You can do this with cars, tools, computers, ... whatever you want. So, no, I think your point is wrong.
Safety laws are the wrong category, the equivalent regulations would be those that forbid the use of cars for drive-by shootings or as robbery getaway vehicles, and regulations against the use of food to provide crime energy.
> Haven’t tried getting a gun in California. How bad is it? How could it be improved?
You have to pass a basic knowledge test, have a clean background, prove residency in the state, be 21 (or 18 for hunting rifles, IIRC) and then wait 10 days.
Which is to say that it’s a very burdensome process if you think you should be able to go to Walmart, exchange cash for goods, and walk out with a gun, but pretty simple by the standards of regulated goods. The basic knowledge test is very basic, so the pain points are just that sometimes background checks are incorrect, the waiting period can be inconvenient, and just the general annoyances of government bureaucracy.
Yes, we define crimes based on what you say. For example, libel or yelling “fire” at a movie theater.
But you are allowed to say whatever you want. If what you say is reflected as an offense, then you get some consequence (I am not speaking of UK where you can post something about immigrants in Facebook and get arrested; I’m speaking only of USA).
There are gun regulations too. Most are reasonable, but many are not. Liberals think that they can simply restrict the right to guns unconstitutionally because “guns are scary.” That is clearly not a sufficient basis to deny a right.
In the case of LA County, they just settled with the Feds because they had approved 2 concealed carry permits out of thousands of applications. That clearly shows the government was simply curtailing your right.
It depends on the county. Some Sheriffs think it’s them who gives you your RIGHT to own a gun or a concealed weapon license. They don’t understand they are servants.
LA just settled the Fed lawsuit over their terrible practices:
I don't live in the US, but yes. I've seen people get into punch-ups because of the queues (although that happens with gas queues as well). All I'm saying is that queues are not improved by having longer servicing times. If you have the same ratio of cars to fuel pumps / chargers, the one that takes 30 minutes to fill up will be worse.
This prompted me to check how the UK Costco rollout of EV chargers is going, which seems to be proceeding slowly and is not all that much of a discount at £0.50/kWh. Type 2 plugs so slowish?
I didn’t write the previous comment, but I think the point here is that there is a long-running trend aiming to protect users both from malicious intent and to a certain extent from themselves.
In the past, viruses had it easy to infect and spread computers because of both inattentive users clicking on mails claiming someone loved them, and the default access mode for any user granting them admin access.
Even though review processeses generally do not exist for computers, they are part of that same trend.
And outside stores we have Windows’ UAC and Mac’s annoying-but-understandable “this dmg is sus” dialogues. Granted they are review processes but they’re often what keeps common users from wrecking their devices.
I never claimed it did explain all their poor decisions. But it increases the chance they'll have to go to their alternate if the first landing attempt results in a go around.
All good points. So, why don't we use CO2 in minisplits? Split systems are most popular in new construction and retrofits, so why are we settling for modern refrigerants like R32 with a large GWP of 675?
It's because CO2 has to be run at more extreme temperatures and pressures, fine for factory-made connections inside a single unit but a showstopper for field joints.
You can tell that I'm skeptical. Kernel code tends to be pretty tight.
reply