Thread

1. tgsovlerkhgsel · 1789535685 · focus · HN ↗

   This is really clever from Apple. The journalist use case is just the PR story. This will be really useful for identity verification and insurance apps, and has the potential to shift from "you need a smartphone to be able to live normally" to "you need an iPhone to be able to live normally".

   There are already plenty of insurances that require you to submit claims through a smartphone app that tries to essentially do this by capturing sensor metadata etc. - those don't need to be nation-state resilient, just Joe the Crackhead Insurance Scammer resilient, so this works. Likewise, more and more things online require identity verification (either officially or disguised as age verification).

   Edit: And while "a nation state actor can spoof this" is a problem for the journalism use case, the insurance/ID verification use cases are perfectly fine with anything that raises the bar but could be bypassed with enough effort. Also, the journalism use case suffers from the same fundamental issue all of these use cases suffer from: People will "verify" the picture by looking at the repost of a screenshot of the verification UI, not by verifying the original themselves.

   1. alwillis · 1789551144 · focus · HN ↗

      > This is really clever from Apple. The journalist use case is just the PR story. This will be really useful for identity verification and insurance apps, and has the potential to shift from "you need a smartphone to be able to live normally" to "you need an iPhone to be able to live normally".

      You have it all wrong.

      Apple Reference Image is not an id system; it's primarily a way to attest that the pixels recorded by the camera sensor have not been altered in any way; the pixels, metadata and timestamp are all cryptographically signed.

      There's no way to link a reference image to a person; it's also not possible to determine if a pair of images came from the same device.

      > And while "a nation state actor can spoof this" is a problem for the journalism use case

      This is incorrect:

          When the image sensor is first initialized in the factory, it creates a
          cryptographic signing identity, sharing only the public key with the
          factory. The SEP similarly creates a separately-attested signing
          identity. These identities are bound together into the device manifest,
          allowing us to later check whether a particular sensor and SEP are from
          the same device.
      
          The final signature on a reference image is a composite post-quantum
          signature combining RSA-3072 and ML-DSA-87. To our knowledge, Apple
          Reference Image is the only image provenance system that provides
          quantum-secure defenses.
      

      So… a nation-state can't really do anything here unless they acquire alien technology. If something crazy happens (solar flare or EMP?), a fraudulent reference image can be revoked.

      > Also, the journalism use case suffers from the same fundamental issue all of these use cases suffer from: People will "verify" the picture by looking at the repost of a screenshot of the verification UI, not by verifying the original themselves.

      I would imagine there will be a way to confirm an Apple Reference Image on the web. Pretty soon, 3rd parties will be able to verify the image themselves:

          Reference images can be viewed in the Photos app alongside the main
          image, like a digital negative, to visually compare the two assets and
          determine if any edits were made. APIs are available in iOS, iPadOS, and
          macOS 27 for third-party apps to enable viewing of these reference images.

      1. cvoss · 1789574406 · focus · HN ↗

         > You have it all wrong.

         > Apple Reference Image is not an id system

         GP does not have it all wrong. A company desiring you to prove your identity often asks for a photograph of your government ID. Now that this is easily faked, it is reasonable to expect that the company will ask for a verifiably authentic photograph of your government ID.

         That the Apple Reference Image itself is not traceable to the device/user is beside the point in this use case.

         1. slester · 1789575806 · focus · HN ↗

            Why would anyone be using images of government IDs when modern documents have NFC chips with the data, signed and with anti-cloning mechanisms on them? If they can verify an Apple Reference Image they can verify an NFC document.

            1. JumpCrisscross · 1789577066 · focus · HN ↗

               > If they can verify an Apple Reference Image they can verify an NFC document

               Interfacing with images is easy. Interfacing with NFC takes work. I have experienced precisely zero identity-verification workflows which NFC'd anything, and that includes my banks, which could easily ask for my debit card's NFC but don't.

               1. inquirerGeneral · 1789578440 · focus · HN ↗

                  [dead]

               2. lxgr · 1789578870 · focus · HN ↗

                  ICAO doc 9303 validation is about 10 lines in Python (on top of importing the right packages) last time I did it around 2012. I doubt it has become harder since then.

                  1. fweimer · 1789580028 · focus · HN ↗

                     Was the public key directory even operational in 2012? What about revocation checking?

                     I think processing that information is mandatory now, but probably was optional/largely unimplemented in 2012. But maybe I'm off by five years or so?

                     1. lxgr · 1789592955 · focus · HN ↗

                        Revocation checking seems like a big gap, yeah. I’m not aware of any public revocation lists (but I’m also not super familiar with the industry), so I can only assume (hope?) that there are some shadowy but highly accurate databases that KYC providers are tapping into.

                        The CA public key I just got off my country’s website, they were kind enough to just publish it :)

               3. crote · 1789581278 · focus · HN ↗

                  Counterpoint: all of the identity-verification flows I have experienced in the last few years used NFC to read the chip in my identity documents - from car rental apps to my bank doing KYC.

                  If anything, verifying NFC is easier than images. Asking the chip in my identity card to provide a cryptographically-signed "This document belongs to Jane Doe" request is a handful of lines of code. Doing the same with images? Good luck coming up with an approach which isn't fooled by a photocopy!

                  1. JumpCrisscross · 1789585070 · focus · HN ↗

                     Cool! Where are you geographically? I’m mostly in North America, Europe and South Asia.
               4. microtonal · 1789628289 · focus · HN ↗

                  My credit card company’s app (in Europe) reads my ID through NFC when logging in for the first time (besides requiring ID photos).

                  Our national app for logging into government sites and confirming things also requires a step where the ID’s NFC is read to reach the highest trust level.

                  So it’s definitely becoming more and more common here.

            2. tmp10423288442 · 1789578290 · focus · HN ↗

               There are tons of online services that require you to take pictures of your face, driver’s licenses, passports, etc.
            3. happyopossum · 1789578335 · focus · HN ↗

               How exactly am I expected to upload my nfc chip to my insurance company’s website?

               1. lxgr · 1789579027 · focus · HN ↗

                  They just have you tap your identity document against your phone. Works pretty well in my experience.

                  The phone is just a relay to a remote server here, as newer ICAO machine readable travel documents intentionally don't support signatures/non-repudiation anymore, so you have to run the entire exchange against a component you trust (i.e. your server, not so much your app on a rooted/manipulated phone).

         2. rickdeckard · 1789579396 · focus · HN ↗

            I agree, but for this to matter, a critical amount of fraud should be based on people uploading modified photos of ID's.

            If someone took a picture of a fake ID in the past, this method will bring no benefit, it will just add Apple as a paid service-provider.

            It also doesn't change the trust-relationship between the two parties: If I need to prove my identity by uploading a government ID, _I_ am doing the photo attestation that this is the ID matching the data I provided, with or without an Apple Reference image.

         3. alwillis · 1789583962 · focus · HN ↗

            > Now that this is easily faked, it is reasonable to expect that the company will ask for a verifiably authentic photograph of your government ID.

            The image will be authentic, but an authentic image of a fake id isn't useful to them.

            Also--only two iPhone models support this technology. It'll be years before the DMV or whoever could count on enough adoption before they could support it.

         4. vablings · 1789590042 · focus · HN ↗

            I think this is a good thing. Proof that an image is actually real is a valuable underpinning of society and being able to provide that is incredibly important.

Unofficial Hacker News client; not affiliated with Y Combinator.