Is this Fake? Content Provenance Tech to Fight Online Disinformation
Where
Talks
ShmooCon 2025
Duration
22 min
Explains how cryptographically signed content credentials like C2PA can help verify whether online images and videos are authentic.
Summary
The talk starts with a familiar problem: AI-generated images, audio and video are now easy to make and are being used for pranks, personal revenge, and election interference. Detectors tend to lag behind new generators, so the speaker argues for the opposite approach, which is to attest cryptographically to genuine content at the point of creation.
The main example is C2PA, a coalition of technology companies, news organizations and camera makers that defines content credentials. A credential is a digital signature embedded in an asset, and it works like a change log: a camera signs a capture using a key stored in its hardware, and each editing tool that touches the file verifies the previous signatures and appends its own signed entry. Because the signatures follow the same certificate model as web PKI, forging a history requires private keys. The hard part is trust establishment, meaning deciding which devices, software and newsrooms get to sign. The speaker showed a browser extension that checks signed images on a web page, and noted that a BBC clip carried a valid signature while a social media repost showed a different signer.
The talk then turns to privacy. Signing everything leaves a traceable record, and journalists or whistleblowers may need to prove origin without being identified. The speaker presented zero-knowledge proofs, released in a library called Crescent, that let someone prove attributes such as employment or age without revealing identity, and described redacting exact times or locations in signed metadata. In the question period, critics raised concerns about industry leadership and specification weaknesses. The speaker responded that a newer specification version addressed public critiques, that the trust-list process is still incomplete, and that retractions would follow existing newsroom practice. For practitioners, the takeaway is that provenance will roll out over years, and its value depends on trust lists and key governance.
Related talks
Talks·42 min
Dana Gretton · Jaguar Kristeller
Presents a peer-to-peer model that stores and shares body-worn data across personal devices instead of cloud services.
Talks·52 min
Dejan Štrbac · William Lessard
Presents OpenEmail, an open pull-based messaging protocol meant to replace spam-prone, surveillance-friendly email.
Talks·47 min
Mikalai Birukou
Presents a client-side federation framework that keeps data private and off central servers, with a live demo.


