Peripheral Literature for C2PA
C2PA use case
- Community story: Pixelstream, CAI, 2022
- empower individual journalists to compete w/ established media by giving credibility
- version control: fork image, evolution tree
- How a voice cloning marketplace is using Content Credentials to fight misuse, CAI, 2024
- they use GlobalSign as certificate authority (CA)
- want everything to have C2PA just like HTTPS
- How we’re increasing transparency for gen AI content with the C2PA, Google, 2024
- show C2PA in image search result & ad
- Partnership on AI Unveils New Case Studies from Supporters of Synthetic Media Framework: Meta, Microsoft, Thorn, and Truepic
- How Truepic used disclosures to help authenticate cultural heritage imagery in conflict zones: Project Providence: gather evidence from image of attacks to Ukraine to prove war crime
- rotate certificate daily “for granular invalidation”
- hardware-backed keystore
- opt-in for various metadata for creator for privacy & safety
- importance to stay secure & credible
- future: election monitoring
- acknowledge C2PA need to be widely adopted & problem of metadata removal
- policies to come in place to mandate disclosure in AI output
- need to display info w/o clicking
- tiered AI content labeling, e.g., AI-generated vs AI-modified
- How Microsoft and LinkedIn gave users detailed context about media on the professional networking platform:
- LinkedIn shows “CR” watermark by images with C2PA
- use “synthetic media detectors” when C2PA is missing
- technically not verify, but know signer
- How Truepic used disclosures to help authenticate cultural heritage imagery in conflict zones: Project Providence: gather evidence from image of attacks to Ukraine to prove war crime
- Use of C2PA in real-world workflows, Brendan Quinn, Jay Li, David Beaulieu, Jonathan Dupras, Nigel Earnshaw, Charlie Halford, Gavin Peacock, Pia Blumenthal, IPTC Photo Metadata Conference 2022
- Azure Media Services use C2PA during video encoding (unclear what exactly)
- CBC/Radio-Canada use C2PA for news
- BBC JavaScript library to edit/show C2PA
- Ongoing by Tim Bray · C2PA
- public education of C2PA & attack & defense
- How Wrapt’s end-to-end platform protects creative workflows with Content Credentials
- platform to sign C2PA for content creator for intellectual right & charge them
C2PA implementation
- Truepic
- claims to do software-based on-device signing securely on smartphone
- secure boot & verify device integrity
- hardware-backed keystore on phone
- no implementation details
- need to sign up; ludicrous pricing ($499+/mon)
- claims to do software-based on-device signing securely on smartphone
- Panel 1: AI and Image Authenticity, Leonard Rosenthol, Dennis Walker, Neal Krawetz, Bofu Chen, Adobe, C2PA, Camera Bits, FotoForensics, Numbers Protocol, IPTC, 2024
- browser extension to find C2PA data from embedded watermark & fingerprint (photo search)
- disclosed watermark can be easily erased
- fingerprint can be forged
- metadata for “do not train”
- implementation bug: demo changing date w/o invalidating C2PA
- C2PA agnostic: work w/ cloud & blockchain
- trust list will include anyone w/ okay implementation
- browser extension to find C2PA data from embedded watermark & fingerprint (photo search)
- How Click Camera App Brings Content Credentials to Phones
- Click, 👍 free C2PA camera (photo + video) app on Android & iOS by Nodle
- proprietary app and ContentSign
- 👎 require Internet to sign, store on Ethereum blockchain
- 👎 no privacy: no way to choose what metadata to include; associate public key; everything on chain
- counter argument: no association between person & public key; can use approximate location
- no defense against photo of photo
- ❗ can post C2PA photo to public channel ⇒ reservoir of C2PA photo
- ❗ mention difficulty of scaling PKI & help w/ blockchain
- lie? blockchain reference does not imply same level of trust as certificate
- 👎 can verify by default, but cannot verify if using certificate trust list
- mention joining C2PA working group to integrate blockchain
- Three pillars of provenance that make up durable Content Credentials
- TrustMark: open-source watermark & removal (useless?)
- simple-c2pa
- SimpleC2PA Audio Credentials
- ProofMode app
- do not use hardware protection for private key
- self-signed certificate
- Capture Cam app by Numbers Protocol
- claim to preserve ownership by C2PA + blockchain + NFT
- company seems hacked up
- 👎 sign C2PA after capture after request
- 👎 no privacy: no way to choose what metadata to include; can see all photo of user if know one
- 👎 require Internet to sign; store on blockchain (their own)
- active open-source Capacitor app
- inactive open-source Android app repo
- Starling Lab Framework
- Stanford EE & USC Shoah Foundation
- blog from Filecoin Foundation for the Decentralized Web
- claim to use Numbers Protocol
- Inside Starling Lab, a moonshot project to preserve the world’s most important information - Fast Company
- claim blockchain is for preserving data
- 78 Days archive photo claim to use “Numbers Protocol” but show no C2PA in “verify”
- all verify link broken
Image metadata
- Secret message sharing using online social media, IEEE CNS, 2014
- hide message in pixels, survive image manipulation
Phone keystore security
- phones are claimed to have hardware-backed keystore considered secure for private key Android Keystore system | Security | Android Developers & Keychain data protection - Apple Support
Last edited: