Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

Is this Fake? Content Provenance Tech to Fight Online Disinformation

Christian Paquin

Threat IntelTalks22 minBeginnerOpen on YouTube ↗

Where

Talks
ShmooCon 2025

Duration

22 min

Explains how cryptographically signed content credentials like C2PA can help verify whether online images and videos are authentic.

Summary

The talk starts with a familiar problem: AI-generated images, audio and video are now easy to make and are being used for pranks, personal revenge, and election interference. Detectors tend to lag behind new generators, so the speaker argues for the opposite approach, which is to attest cryptographically to genuine content at the point of creation.

The main example is C2PA, a coalition of technology companies, news organizations and camera makers that defines content credentials. A credential is a digital signature embedded in an asset, and it works like a change log: a camera signs a capture using a key stored in its hardware, and each editing tool that touches the file verifies the previous signatures and appends its own signed entry. Because the signatures follow the same certificate model as web PKI, forging a history requires private keys. The hard part is trust establishment, meaning deciding which devices, software and newsrooms get to sign. The speaker showed a browser extension that checks signed images on a web page, and noted that a BBC clip carried a valid signature while a social media repost showed a different signer.

The talk then turns to privacy. Signing everything leaves a traceable record, and journalists or whistleblowers may need to prove origin without being identified. The speaker presented zero-knowledge proofs, released in a library called Crescent, that let someone prove attributes such as employment or age without revealing identity, and described redacting exact times or locations in signed metadata. In the question period, critics raised concerns about industry leadership and specification weaknesses. The speaker responded that a newer specification version addressed public critiques, that the trust-list process is still incomplete, and that retractions would follow existing newsroom practice. For practitioners, the takeaway is that provenance will roll out over years, and its value depends on trust lists and key governance.

Related talks