I don’t see any mentions about the fact Google Pixel Camera embeds C2PA metadata that can be used by Google to trace down an individual who posted the photo online.
This was implemented starting from Pixel 10. I’d like to hear from the GrapheneOS users on Pixel 10 also.
C2PA isn’t about tracking down specific people that make images (although you can add your name and other metadata if you want) it’s all about provenance and knowing if an image is real/AI generated/photoshopped, that kind of thing. Google made an interesting blog post about it that’s worth a read:
A private-by-design approach to C2PA certificate management, where no image or group of images can be related to one another or the person who created them.
C2PA signing generates a digest image that is being sent to a remote service for signing. Google knows which signature was provided to which device and so on. This coupled with SynthID embedding allows Google to know where an image has originated from.
C2PA is easy to forge btw. C2PA isn’t about proving the authenticity of an image either, at least in it’s current implementation.
Do you mind sharing the source for C2PA forging?
From what I currently understand, C2PA acts similarly to code signing certs, where there is a chain of trust and root authorities. “Authorities”, which could be entities like Google or camera manufacturers like Sony and Nikon “sign” images using some process and return a C2PA signature that guarantees some level of authenticity for a piece of media as part of its metadata.
Unless I’m mistaken, presumably just like code signing, you can become your own authority and freely self-sign anything you please, but being self-signed doesn’t mean much unless someone else recognizes your authority (e.g. by adding your signing key to their list of trusted keys, or by being recognized further up the chain of trust by someone or some entity which is already widely trusted).
If there really is a way to truly forge a valid C2PA signature, then I’d be interested in seeing how the standard fails in protecting against forgeries, since it seems like it’d be due to the failure of some part of its cryptography. Otherwise the only realistic way I can see legitimate forgeries becoming a thing is if a signing service is exploited/abused to arbitrarily sign media regardless of source.
So just to clarify: IP address being logged by Google servers each time a photo is being taken coupled with the fact Google already knows which user has a specific Google Pixel, which IP address does he have due to GMS being present on a device somehow isn’t attached to user identity in any way? Pinky promise from google? 
Please keep replying in a condescending manner while providing 0 value to the conversation.
Pixel camera does send a digest. Pixel camera uses both embedded JUMBF and a remote manifest store, per C2PA recommendation. Google vouches the image, it’s just a fact.
Read the source instead of linking to a journalist, please.
Each watermarking configuration you use should be stored securely and privately , otherwise your watermark may be trivially replicable by others
I never said that SynthID was easy to break. C2PA is, SynthID isn’t.
I recommend spending your time doing a research instead of making blind assumptions based on web articles. The fact you don’t know how C2PA behaves on Pixel 10 tells me everything i need to know.
In Google’s C2PA implementation, it excludes signing EXIF, JUMBF C2PA manifest itself, XMP data incl. extended attributes. This means that everyone can alter EXIF and XMP metadata while keeping the C2PA signature valid as it only covers the visual content and not how it was created.
And did i mention that hardware hackers can swap the cameras and C2PA wouldn’t know a thing?
AI-generated content is strictly forbidden. Please familiarise yourself with our rules:
https://discuss.privacyguides.net/faq#ai
I’m sorry. I didn’t realize the nature.com link was a republished paper and not an article from nature.com. The reference paper is hosted on c2pa website so i assumed you quoted a journalist, judging by the fact we’re in disagreement about c2pa and my assumption of you taking web articles at face value.
Very condescending, but not.
Please explain to me in your words what gets sent to Google’s servers. I’m tired of playing games. C2PA doesn’t become more private just because you said so or tried to obscure the fact what fields are being sent in the first place for a verification. Take an image on your Pixel 10, extract the metadata, verify the claim using c2patool and then explain to me how a literal hash of an image paired with the fact google knows which IP address sent a request doesn’t allow google to track in image down to a user.
"assertion_store": {
"c2pa.hash.data": {
"exclusions": {
literally states that XMP, EXIF of a given image are excluded and thus can be forged.
You would’ve know that if you actually tried taking a picture yourself, you know
This isn’t relevant to Google Pixel. I am well aware of the fact C2PA has multiple attestation levels.
C2PA isn’t about provenance either as i can spoof MPF, EXIF, XMP as they’re excluded. I can insert an arbitrary device model, software version, backdate an image etc. With C2PA, you can’t assert the fact an image came from a certain device as Google reuses the same root certificates across the pixel 10 lineup. And i think i’ve already mentioned the fact Google can’t stop anyone from taking an unaltered photo due to reliance on imaginary hardware attestation.
If anythinh, C2PA makes it harder for forensics experts to assert claims of forgery since they have to deal with this bullshit.
Asking AI to back up your bogus claims was a cherry on top.
I’ve read the c2pa specification, including newest 2.2 revisions and have read the specification number that is used by Pixel 10. Even 2.2 doesn’t protect anything besides the timestamp itself in the manifest.
I never claimed this.
Just to recap:
It does mean that XMP and EXIF can be forged as they’re not part of a C2PA and are excluded. Once again, you don’t know what Pixel 10 does or does not include into a C2PA claim and are clearly dishonestly engaging in this conversation. Why do you think it’s ok for you to claim to know what parts of an image metadata Google’s C2PA implementation covers when you’re assuming how C2PA works instead of verifying your spoken assumptions about reality?
Such a nice saying you have 0 clue how Pixel 10 implements C2PA but want to engage in bad faith dialogue nonetheless. We do know what information is excluded. I called you out multiple times on that.
Google reuses 4 root certificates across the entire Pixel 10 lineup. Google’s C2PA cannot guarantee claims about hardware. Google’s C2PA implementation literally omits everything that’s relevant to hardware, the metadata with claims like Shot on Pixel 10 model_name etc. They omit anything useful to identifying the hardware, we can only assume it with the root certs.
“C2PA Generator Product Security Requirements” only requires HRoT. Google cannot guarantee that a hacker didn’t modify the hardware and sent an image by impersonating a Camera sensor.
C2PA can only guarantee the fact an image wasn’t tampered with after the fact of signing. It cannot guarantee anything about the hardware/software.
Even if all this would be true (I haven’t checked) it wouldn’t mean that Google know’s which photo belongs to which person
Google doesn’t receive image hashes when photos are taken, at least not for the C2PA features to function. It’s possible Google tries to send a hash if there is internet but I have not observed this when I checked. There are some articles which claim this but I think they’re either misinformed or the protocol has been updated since they were published.
A Pixel 10 can remain fully offline for days, take a photo with the Google Camera app, and you can transfer that image over USB while still offline. The resulting file will still contain a valid C2PA timestamp checkable with Content Credentials or offline tools. I’ve tested this myself on both the Pixel 10 and 10 Pro.
The phone does need to connect to the internet periodically to maintain an accurate clock and update certificates receive security patches , but the actual timestamping works offline. This makes the Pixel 10 surprisingly useful for offline proof‑of‑existence. For example, you could hash a file—like an assignment you can’t upload due to no signal—and photograph the hash. That gives you strong evidence the file existed before the due date and has not been changed since.
Is the C2PA implementation attackable? Yes, but doing so requires significant expertise and resources, making it trustworthy for most real‑world uses. Some metadata fields remain unprotected and could mislead someone inexperienced, but the critical elements—the image data and the C2PA timestamp—are protected.
There is a concern that Google implemented the per signing photo certificates in a way which is actually tracible to a particular phone. I think it’s unlikely but if it’s completely essential the image can’t be linked to you, I wouldn’t use it.
Overall, it’s a reliable way to prove a real camera captured a real scene at a specific time.
I only wish Google extended this capability to video.