Public Key Authentication for Media Files: Why Isn't This a Thing?
I'm just writing down my thoughts here in the hopes that Someone Smarter Than Me might be able to shed some light on the idea, or perhaps even work with me to make it happen.
I'm reading more and more about how fake news stories are circulating, and how technology has developed to the point where we can literally create images, audio, and video of events that never happened but appear as though they did. The effort so far seems to be in the area of somehow detecting a fake by searching for evidence of tampering, but this to me feels wrong-headed: it's expensive, slow, and will always be a step behind the fakes.
Why instead do we not simply sign each file on a sub-channel so it can be easily proven to be legit from the source?
For example, the BBC does a story about a politician and includes with it a picture of her doing something interesting. This picture is then circulated around the web with two bits of information hidden inside the EXIF data:
- The original source organisation (BBC)
- The signature of the image based on the BBC's private key
- The original URL of the image (maybe?)
The image is then re-shared onto Facebook, where they've got simple software that:
- Reads the original file and authenticates its origin against the BBC's public key
- Resizes the image for its own purposes
- Appends a second signature using Facebook's private key
- Posts the video into the user's timeline with a "Verified BBC image, resized original from Facebook" caption
If the image is re-shared onto Twitter, or Google+, or Diaspora, these services will only be able to know that the image came from Facebook, but theoretically this still means more than not knowing the origin at all.
The goal is to create a means of authenticating the original source -- or at least a source more credible than "Jim's computer", and perhaps even the chain of modifications to said source There's also no reason this couldn't be applied to all kinds of media.
Maybe this technology already exists, though a cursory search didn't turn up anything for me. Anyone have any bright ideas?