I don't understand the vector of this:

An insurance would either assign #1 an insurance agent or mechanic to initially assess the damage (trusted) or #2 ask the customer to send pictures (untrusted).

Tendency is #2 for cost-saving of the insurance, and 3rd party apps are used to execute this.

Now the idea is that the insurance company discontinues the App and the (untrusted) customer must have an iPhone 18 Pro to make an insurance claim?

Or is the insurance agent / mechanic an untrusted entity who will now be required to have an iPhone 18 Pro?

What is the fraud vector here, and how can the insurance service provider continue cost-saving on damage-assessment by offloading to the customer, if the customer is required to own a specific device?

> This is really clever from Apple. The journalist use case is just the PR story. This will be really useful for identity verification and insurance apps, and has the potential to shift from "you need a smartphone to be able to live normally" to "you need an iPhone to be able to live normally".

You have it all wrong.

Apple Reference Image is not an id system; it's primarily a way to attest that the pixels recorded by the camera sensor have not been altered in any way; the pixels, metadata and timestamp are all cryptographically signed.

There's no way to link a reference image to a person; it's also not possible to determine if a pair of images came from the same device.

> And while "a nation state actor can spoof this" is a problem for the journalism use case

This is incorrect:

    When the image sensor is first initialized in the factory, it creates a
    cryptographic signing identity, sharing only the public key with the
    factory. The SEP similarly creates a separately-attested signing
    identity. These identities are bound together into the device manifest,
    allowing us to later check whether a particular sensor and SEP are from
    the same device.

    The final signature on a reference image is a composite post-quantum
    signature combining RSA-3072 and ML-DSA-87. To our knowledge, Apple
    Reference Image is the only image provenance system that provides
    quantum-secure defenses.

> Also, the journalism use case suffers from the same fundamental issue all of these use cases suffer from: People will "verify" the picture by looking at the repost of a screenshot of the verification UI, not by verifying the original themselves.

I would imagine there will be a way to confirm an Apple Reference Image on the web. Pretty soon, 3rd parties will be able to verify the image themselves:

    Reference images can be viewed in the Photos app alongside the main
    image, like a digital negative, to visually compare the two assets and
    determine if any edits were made. APIs are available in iOS, iPadOS, and
    macOS 27 for third-party apps to enable viewing of these reference images.

I don’t understand what this brings to the table beyond what we’re currently doing.

Insurance companies can have a native app and require the device’s camera. Companies already have tools to combat a liveliness check. Even if you’re using a modified app that pulls from the photo album instead of the camera? A video recording with the appropriate liveness verification easily avoids that mess.

The main way we combat insurance fraud is by throwing people in jail who do it. I dont think AI faked photos is a major cause of fraud.

> […] the potential to shift from "you need a smartphone to be able to live normally" to "you need an iPhone to be able to live normally".

Why do you believe Android manufacturers and SOC makers like Qualcomm won’t be able to offer a similar solution?

The one issue I have it that it lets Apple determine if two reference images were taken by he same defice. In particular if one of the images is of an ID, or otherwise contains identifying information, that is a privacy downside, and authorities can subpoena Apple to check for and reveal this connection between multiple images.

Insurance agencies worried about fraud could just do what they did prior to smartphones: have you bring the car to a claims adjuster at your local office. I’ve brought cars to be inspected, because I got T-boned at an intersection by a careless driver before smartphones existed; it was reasonably quick and hassle-free.

Sadly, people will happily go with this crypto-lockdown until there's no personal computing whatsoever. Only way to fight is not to play, or hack this in some way.

> looking at the repost of a screenshot of the verification UI

I don't follow. It's my user agent that's verifying the image, and my device will tell me that it's not verified.

Yrs; that is what world needs, complete dependency on one giga corporation... I cannot wait for it to happen!

I think you’re on the ball, but also all KYC flows, photo proof for shipping returns (Chinese platforms were getting destroyed on this) etc. etc. It’s a very very clever solution and a very opportune time.

> People will "verify" the picture by looking at the repost of a screenshot of the verification UI, not by verifying the original themselves.

True.

> raises the bar but could be bypassed with enough effort.

Anyone can spoof this.

Apple cannot stop spam iMessages. They can't stop someone from rendering their privileged UI inside a browser viewport. People copy and paste remote script executions from convincing captchas.

This whole provenance thing is a red herring. You agree with me, but there's truly not a single application for this that won't be exploited.

Claim 7 in this patent application describes how depth sensors are used as part of an image authentication process, which would make such a workaround more difficult:

https://image-ppubs.uspto.gov/dirsearch-public/print/downloa...

The Apple Reference Image feature is here launched on iPhone 18 Pro and iPhone 18 Pro Max that both have built-in LiDAR sensors that could be used for this process.

It also doesn't prevent you from staging an image or anything that's existed since photography was invented. But that's not the problem they're trying to solve.

> Today, powerful, widely available AI tools allow users to easily generate or alter photorealistic images to a degree that was difficult to imagine just a few years ago.

Photoshop has existed for decades and so has fake images. This is a low friction way to attest "this image came from an iPhone sensor and Apple approved it". It will still take the usual image forensics to determine if the scene it depicts is legitimate.

Sony's analogous solution (https://authenticity.sony.net/camera/en-us/) claims 3d depth information is built in, I'm sure Apple could do the same given at least some iPhone models have LiDAR on the back

This sounds like it could be done, but the costs for doing so are comparably high.

I think the idea is to control the easy, cheap mass production of AI gen picture and not 100% coverage.

That’s a tradeoff I can live with.

It's even easier than that. You just wait for someone else to figure out, some photography professional with fancy equipment and a hacker-y mindset, and you pay them to sign your photos for you.

Once a defeat device (a camera pointed at a screen) is functional, whoever has it, can simply automate a "receive API request, display image on screen, photograph it, return signed image" pipeline. A cheap internet service. I'd WAG a hundred thousand signatures per day per phone, limited by the sensor speed.

Since there's no way for anyone, Apple included, to correlate photo signatures with the device that signed them, it's also true there's no way to stop one device from signing millions in bulk. ("...an outside observer cannot determine whether any pair of reference images were taken by the same device..."; "...avoid even implicit public association between different photos taken by the same sensor...")

It's the same economic asymmetry as DRM vs. movie piracy (as soon as one group defeats a technical challenge, millions instantly benefit, at zero marginal cost). Apple has no chance of winning.

> I can't wait to see Apple Verified™ photos of UFOs flying over the Golden Gate Bridge.

While I'm on board with you about the inabsolute security of this (relative to what's typically expected of cryptographic systems), the fact that their 'verified' state requires a live certification and can be revoked means that the sensor responsible for obviously faked images will see those images and that device no longer certified.

It all relies a lot on trust in Apple, and integration with Apple, and relatively unmotivated attackers.

> Paint the inside of the box using Vantablack

But you're only allowed to do that if your name if Anish Kapoor

>I can't wait to see Apple Verified™ photos of UFOs flying over the Golden Gate Bridge.

There’s no such thing as a Golden Gate Bridge.

Prove it.

> take a picture of an already edited image

I think the "reference image" means a photo is taking by a real iPhone 18 device at a certain time, what the content actually means is another matter.

The "digital negative" in DNG format can be used to analyze the authenticity of the content.

It's less about proving a photo's truth than about attesting it.

Yeah, such systems have been tried (and been hacked) for decades now.

https://www.elcomsoft.com/news/428.html

https://blog.elcomsoft.com/2011/04/nikon-image-authenticatio...

You don't even have to travel to the location, you can just spoof GPS. And of course that will only be needed until some eastern european kid gets bored one weekend and the signing keys magically appear on pastebin.

It's funny to see Apple fall into this same trap.

I suspect they have ways to ID at least some things like this somehow in ways that will lead to key revocation.

Won't the focus length of the camera be wrong?

Is this really that big of a flaw in this implementation? I don't think it's worth the additional complexity to address it. (Encoding depth information in some way, trying to detect "flat" surfaces, whatever).

Discerning a camera taken image of an image is typically very very easy. The collors/exposure/etc will all be obviously wrong in ways to a human, even without doing any analysis.

Exactly, a wave of “verified” fake images are coming.

Because it’s impossible to implement this feature in open source and out in the open. It relies on a locked down image pipeline and hidden key.

I’m pretty sure “certified real” aren’t the words Apple will use, nor do they use it in this document. The words to describe the technology were chosen with care: semantic verification, attestation, tamper evident, etc.

The average person already does this with obvious AI slop.

> images that were confirmed to be "taken like this on an iPhone"

No, because images will be confirmed to have been taken on "this iPhone". The New York Times will be able to publish an article and to attest that the photographs shown were taken by their journalists, and then your user agent will verify that provenience.

It looks like the reason for the custom timestamp setup is to assert and upper and lower bound on time. A normal timestamp server can asset it saw the image at a certain time but not that the image wasn’t created much earlier. This setup, the image processing pipeline can immediately attach the last seen timestamp to the photo as a lower bound, and then connect to the network to get the upper bound time.

If there is too much of a gap between the upper and lower bounds then the image becomes suspicious.

I’m fairly sure that the contact tracing feature has been removed now. And it wouldn’t be needed anyway, the iPhone location services are far more useful. I imagine the geotag could be included with the verification.

Location services is quite hard to trick. To the point people have gone to the lengths of putting iPhones inside a microwave for RF shielding and setting up fake phone tower signals inside to trick the phone in to unlocking the hearing aid feature on AirPods for unapproved countries.

Too much potential for revealing the identities of others there.

How do you plan to replace the sensor of your phone's main camera (with a device you need), and let it authenticated by the OS, and then create authenticated photographs with it?

Apple/iOS already have part authentication pipeline on its security sensitive devices (TouchID/FaceID). How can camera sensor can't be considered one of those and needs attestation before enabling?

From the document:

> Apple Reference Image leverages custom-designed image sensors in iPhone 18 Pro and iPhone 18 Pro Max to ensure reliable capture of image data, and relies on Private Cloud Compute, which provides a computational environment for secure photographic processing that cannot be subverted even in the case of device compromise. (emphasis mine)

Very much agreed.

I believe many of the problems we have, need social and human solutions, especially when the technical solutions are hard or impossible.

Like here, where we can no longer trust images to depict reality and act as proof. While its admirable that people look for technical solutions, the obvious social solution is to admit that images are no longer absolute proof and will become less and less trustworthy¹.

And, by admitting that, change our relation to these artifacts. Sure, that will change journalism, police work, legal systems, etc etc.

But pretending that we can rely on images might allow journalists, police, judges to continue relying on them as if they're authentic, which is a far bigger problem over a longer period.

Social solutions require effort, demand flexibility, take time and are messy. But this is what humans are and do. Not everything has a technical solution. Not every technical solution is the best option.

¹ we already saw this when people claimed "someone must have hacked my iphone and put it there". For decades we've seen this with images that are deliberately taken in a way to spin a story (like the illusion of a large crowd or spacious room through carefull angles or fancy lenses). And I predict we will see this with security footage, "live streams" or even bodycams with "ai enhancement". Just imagine a bodycam or a dashcam that manipulates the output to benefit the owner. "A dashcam that will prove your innocence in assumed traffic violations" or such.

You'd need to jailbreak the camera sensor chip and the phone's secure element. Which isn't exactly impossible either, but it's harder. I don't think it has been done yet (but I'm sure it will be at some point).

It seems like the two signatures on device are processed on the camera sensor itself, and then post processing is signed by the SEP. Neither of these would be compromised even if you have a full jailbreak.

Yes.

A camera has literally tens of millions of thermal noise sensors...

Presumably you would only do this for images you plan on sharing to social media anyways, to prove that it's not AI generated.

PCC is quite good, about as close to private remote compute we can get without doing HME.

Edit^2: On triple reread it sounds like the first pass ("Image Capture") sends the image metadata hash to be timestamped, whereas the second pass (Reference Image Development) sends the image itself but is not what actually creates the timestamp attestation. According to Apple[0][1] it sounds like the second pass (development) only happens when the reference image is actually viewed, which means that your image isn't sent if you never view the reference image?

[0] https://support.apple.com/guide/iphone/view-reference-images...

[1] https://www.apple.com/legal/privacy/data/en/reference-image/

> When you take a photo in Reference mode after tapping Reference Mode, your device will include reference image information in the photo’s metadata. If you then view that photo and tap the Reference badge on your iOS device or click it on your Mac, the device will send the raw photograph, metadata about the photograph like the sensor’s signatures and the time frame in which the photo was captured, as well as the sensor’s unique hardware identifiers to Private Cloud Compute.

Edit: On reread it seems they do in fact send the actual photographic data to PCC, which I presume has some reason over signing metadata on-device? Original mistaken post is below for transparency.

You can always not use the reference image mode, and according to the article you send a hash of the signature of the photograph, so all they would know is you took a photograph in reference image mode at some point in time before the request.

Though, on second thought, "government X could force Apple to disable feature for members of group Y" seems possible. I'm sure you can come with "Y" quite easily, heard anything about Ed Sheeran's tour?

I mean, the obvious one is that they can revoke certification of a photo despite it being real.

The harder one is they can force apple to certify a fake photo.

the part that would be very hard but not outside the realm of plausibility, is that gov could force apple to introduce a bug in its pcc platform to link photos to the photographer in order to track and arrest inconvenient people. Apple says there are a bunch of protections against that but ultimately you are trusting apple to do it the way they say they are.

This entire system relies on trusting apple

Apple would have to be the only company around and by the time Apple “loses” in court its too late.

[dead]

The iPhone Pros do have a depth sensor, I don’t think it's exported but it does stay in Photos' library.

Don’t know why this was downvoted but this is the right take. A photograph is evidence, but isn’t a proof in and of itself.

Jailbreaking is connoted as bad because it's something criminals do so they can do more crime.

Was photo not authentic? Think of it "as seen by an iPhone", not "this is authentic event" verification.

But Apple likely would reject such photo because of inappropriate depth map / LiDAR data.

The timestamp wouldn’t match the event being depicted and the geotag would show the studio. And the depth sensing would show the image as flat.

That’s a lot of money and effort for a fake photo

presumably the metadata reader app would be integrated into the photo viewer app which would verify the digital sigs.

I have my doubts about this scheme but this is not one of them. If the point is that someone in principle could verify, that is enough for it to be useful, even if not everyone does.

By the time you made your comment, such a system had already been invented, even partially rolled out: https://en.wikipedia.org/wiki/Content_Credentials

Apple's protocol differs in that it requires a timestamping server to sign the file and centralising Apple as the single arbiter of truth. An excellent addition, if you trust Apple and the governments they're friendly with (I don't, especially the latter part).

According to the description in the article, "an outside observer cannot determine whether any pair of reference images were taken by the same device." and they "avoid even implicit public association between different photos taken by the same sensor"

Whatever that means in detail...

I dont think this is relavent to that use case. It seems like this proposal would be an optional off by default feature. They also seem to be going to lengths to make it privacy first so the verified photos cannot be linked to a specific photographer.

Nothing stops you not verifying, or simply stripping the verification off.

What you are prevented from doing is adding a verification to a photo outside of the iOS image pipeline, or modifying the photo with the verification still in tact.

Or have I understood the feature's capability completely wrong?

> it sounds like its an optional mode you have to enable

It’s opt-in because your photo is sent to Apple’s servers. Only if it were on-device should they even consider making it default.

> i guess you need internet to take a picture

Not really, internet is required to process the reference image, but that can happen later if you’re not currently connected.

> are complex hardware attacks really that important?

No, but the floor shouldn’t be “trivially exploitable” like C2PA[0]. It’d be interesting if there were a middle ground but we don’t have anything like that as of now.

[0] https://www.da.vidbuchanan.co.uk/blog/android-c2pa.html

Some of us never left :D

Sure, if it’s believable that the shot was perfectly flat at, what, 2 feet away?

All slop? I'm sure that some "Shrimp Jesus" or "Talking Strawberry" was never considered to be authentic by anybody. There is a lot of useless AI generated content of which everybody knows it's AI generated littering the web. Having it marked as AI will not stop that.

It's extremely dystopian. This will result where you need an Apple or other big tech device in order for anyone to believe you.

How do you figure?