I was thinking about how hard it is to accurately determine whether a screenshot posted online is real or not. I’m thinking there could be an option in the browser to take a “secure screenshot”, which would tag the screenshot with the date, url, and whether the page was modified on your computer. It could then hash both the tag and the image data and automatically upload this hash to some secure server somehow. There would need to be a way to guarantee that only the browser could do this, or at least some way to tell exactly what the source was. I’m not much of a cryptography person, but I would be surprised if it isn’t possible to do this. Then, you could check if the screenshot you see is legitimate by seeing if it’s hash exists in the list of real hashes.

  • doylio
    2·
    12 hours ago

    This is a very hard problem to solve, and people have tried.

    Let’s say you do as you said: hash the data (screenshot, date, etc) and upload it to a trusted server. Nothing can stop me from generating fake data, hashing that and uploading it instead.

    Ok, so maybe you decide to add a cryptographic signature to prove that it was the web browser that made this hash, not an unauthorized one. That might work for a while, but the private key needs to be shipped with the browser software, so a sophisticated person could extract that key and then generate fake data. Especially is the browser is open source (like most are).

    Alright, what about if we add a special chip on the device that is hard to tamper with and keep the private key on there and do all the signing on that chip. Those do exist somewhat already, but hackers have found ways to break them.

    Ok then you move everything to the cloud. Have the entire web browser running on a cloud machine by a trusted authority. Maybe then you can do what you’re discussing, but you’ve also entered a privacy nightmare where everything you’re doing can be monitored in real time.

    What would be a better situation (and where I think we’re going eventually with Gen-AI) would be to put the responsibility on the website publisher to provide cryptographic proof of their content. For example, the NYTimes could create a digital signature of a photo and publish it on a blockchain or other trusted tamper-proof ledger as they publish the photo. Then anyone can verify that the photo is from the NYTimes and the date it was created.