Slashdot Mirror
Camera Makers Resist Encryption, Despite Warnings From Photographers (zdnet.com)
An anonymous reader shares an article from the security editor of ZDNet:
A year after photojournalists and filmmakers sent a critical letter to camera makers for failing to add a basic security feature to protect their work from searches and hacking, little progress has been made. The letter, sent in late 2016, called on camera makers to build encryption into their cameras after photojournalists said they face "a variety of threats..." Even when they're out in the field, collecting footage and documenting evidence, reporters have long argued that without encryption, police, the military, and border agents in countries where they work can examine and search their devices. "The consequences can be dire," the letter added.
Although iPhones and Android phones, computers, and instant messengers all come with encryption, camera makers have fallen behind. Not only does encryption protect reported work from prying eyes, it also protects sources -- many of whom put their lives at risk to expose corruption or wrongdoing... The lack of encryption means high-end camera makers are forcing their customers to choose between putting their sources at risk, or relying on encrypted, but less-capable devices, like iPhones. We asked the same camera manufacturers if they plan to add encryption to their cameras -- and if not, why. The short answer: don't expect much any time soon.
Although iPhones and Android phones, computers, and instant messengers all come with encryption, camera makers have fallen behind. Not only does encryption protect reported work from prying eyes, it also protects sources -- many of whom put their lives at risk to expose corruption or wrongdoing... The lack of encryption means high-end camera makers are forcing their customers to choose between putting their sources at risk, or relying on encrypted, but less-capable devices, like iPhones. We asked the same camera manufacturers if they plan to add encryption to their cameras -- and if not, why. The short answer: don't expect much any time soon.
not excusing the camera makers here, but couldn't this be designed into an SD card?
With smartphones approaching 20MP, they are an alternative in a lot of situations.
(No, you dont have to argue that a 5mm Optic isn't the same as a 50mm Optic, i know. But if encryption is important for you, currently, the Camera Makers wont give you a choice)...
High resolution, more stops of dynamic range, and the ability to use different lenses does. For really high end models, there are a few other things too, like full frame DSLR formats, high frame rates (for shooting sports etc.), the ability to shoot HD video, etc. The vast majority of people shooting with a camera other than the one on their phone (which is already a shrinking market) don't care about encryption (which would slow down their camera even more), so don't expect the Nikons, Canons, and Sonys of the world to invest a lot of R & D on a feature that there's really not much of a market for.
If you're a photojournalist leaving a dangerous field assignment then there's a high likelihood you will be stopped and searched. If you hand over your camera and it comes up with a prompt for an encryption password then your camera and its media will be confiscated or destroyed in front of you. There go your photos.
As for protecting sources, why would you photograph them if you didn't intend to publish the photos anyway, which would still put them in danger?
Just google. Their are attachments for many phones, and some of them even support it officially.
Interesting.
The workaround, for photographers, has to be that if the pictures are sensitive they need to download their pictures to their laptop (or other device) which is encrypted as soon as they leave the photography site.
... then take a lot of pictures of the floor, to overwrite the images on the camera's storage...
http://www.geoffreylandis.com
You will simply be forced to turn over said password or have the device confiscated.
ObApple: What's a camera?
...reporters have long argued that without encryption, police, the military, and border agents in countries where they work can examine and search their devices. "The consequences can be dire," the letter added.
Holy fuck! The ignorance in that statement is astounding!! To all reporters - when you're in another nation that doesn't have freedom of the press and/or other constitutional rights, you do as you're ordered by authorities. If a police officer in China for example tells you to hand over the password to decrypt the data, you better do it or risk being thrown into a cage!
Life is not for the lazy.
when all phones have cameras built in...?????????
It looks like it's possible using Magiclantern open-source firmware for Canon cameras: https://www.magiclantern.fm/fo...
Why aren't these expensive cameras programmable by their "owners"?
The people who really care about encryption should be able to easily program "their own" devices in order to support such encryption.
The core issue isn't economics; the core issue is, as always, ownership.
https://www.digitaltrends.com/... Wonder if this is one of the reasons for this patent.
Sure, it'd be a useful feature for a small number of people, but the vast majority of users of high end cameras (and there aren't that many) wouldn't need it. And doing it this would either require a special encryption chip, increasing the cost for all users, or would be so terribly so that it would make the camera effectively unusable.
still, they're called film cameras. Nobody can see the pictures before the film is processed, and good luck to find a shop that still processes films nowadays.
Slashdot, fix the reply notifications... You won't get away with it...
it's just that simple.
If you're not doing anything wrong you shouldn't have anything to worry about. Don't you hate it when people say that?
It's not just encryption that cameras need, they also need a cryptographic signature to indicate that the image it took is fresh from the camera and has not been edited since the photo was taken. (Obviously this can be defeated by photographing a photoshopped image, but still...)
The lack of encryption means high-end camera makers are forcing their customers to choose between putting their sources at risk, or relying on encrypted, but less-capable devices, like iPhones.
Or, you know, pulling the memory card out of the camera and hiding it.
I've seen wifi SD cards for cameras, so it should be easy to have your high-end camera send it's pictures to your smart phone, tablet, etc. as soon as you take it, then the photojournalist can simply delete the local copy on the camera. when your camera is searched, no images are found, they are all on your secure, encrypted smartphone, and who knows, maybe the smartphone could sync with a cloud service to get the images out of the region moments after captured?
Ken
If you delete the image from the camera, you need a method of securely wiping the memory.
Have your camera connected to your smart phone via an SD Wifi adapter. Automatically transfer the photos and delete them on the camera as they are taken.
Would it take a rocket appliance to use steganography?
Serenity now, insanity later.
Good luck when you're stopped by the police/military in some shit-hole country. Encrypted files? No problem, just beat them until they decrypt.
Given the remoteness of most of these regions, and that RAWs can be upwards of 50MB each, I don't think a phone's data connection would cut it.
Syncing via WiFi to another device could be an option, depending on the scenario, but it's relatively battery intensive so it requires preparation & knowledge of exactly when you're going to shoot. Not so great for journalists travelling in remote regions, often off-the-grid, who need to be able to whip out their camera at a moment's notice.
Encrypted device could make you suspect and become detained without warrant for indefinitely time. So better think of the children.
Canon offers a kit that includes an encrypted SD and flash drive. There are also a bunch of hackers around that do anything from running Arkanoid to implementing zlib on their dSLR camera. There are options, a bit of research and/or a knowledgeable it staff would help them more than bitching at the manufacturers.
Custom electronics and digital signage for your business: www.evcircuits.com
One would think that the camera memory would hold photos of flowers and whatnot, whilst the sdcard with the good shit on it is nestled securely up your ass.
I can easily imagine a program that detects a new photo on the SD card, transmits the message to the linked-to device (smartphone), then overwrites every sector the photo occupied with a random bit pattern before deleting the photo entry from the file directory on the device.
Sure, a curious regime could send the SD card out for data recovery, but the actual sectors the photo occupied would contain the random bit pattern - a brute-force search of the device would be fruitless.
Ken
You want a niche feature that would be detrimental or confusing to most users. An average photographer's nightmare is losing an amazing shot and encryption is likely to screw up any recovery attempts. Others would get in more trouble because of encryption than because of actual photos. Sounds like a good case for a Kickstarter project to make an Android-based camera where you can use a photo app that suits your specific needs. If there is mobile data, you would ideally upload shots to your studio and the securely erase them locally so that no evidence, including evidence of hiding evidence, is left.
Im not sure there are any standards where this wont cause more hassle for regular customers of course it could be optional. I could be wrong but I dont know of a standard where a sd card could be encrypted then popped into a computer and asks for the password. If the camera just encrypts the files then we need to agree on a file format that may or may not already exist and build it into software and os's to make it transparent I think the filesystem would be a better way once its unlocked apps could just use it as normal.
I don't think it would make much difference if the photographer (journalist or whatever) had the best encryption there was for their photos, if an authority in a repressive/dictatorial state asks for their media and they (the authorities) can't access it.....what do you think is going to happen to that media. I don't see the authority figure just saying "Oh, never mind then..." and giving it back! More than likely both the media and the photographer will be investigated more thoroughly in a less than friendly manner.....
If cellphones already implement some sort of encryption and their camera quality is good enough, why not taking pictures with them?
I hate signatures
Encrypted SD photo cards are easily decrypted by hitting the fingers of the photographer one at a time with a ball-peen hammer.
I think it's called a brute force attack.
First thing I thought when I read the article.
I have not tried the encryption functionality, but Magic Lantern rocks.
The photographers plea for encryption lacked the phrase "Please, think of the children" which is always used to pull at the heart-strings of bleeding-heart liberals to pass laws (or pressure corporations) that have NOTHING to do with the safety or well-being of children.
Nothing wrong with the reporting, but it is comical that ZDnet is saying this when their OWN WEBSITE doesn't use HTTPS.
OK, so you're in a country where they're suspicious of photographers. A cop comes up and asks to see what's in your camera. Sure, you say, and let him download your files. Oh, I see they're encrypted, he says...well, thank you for your time. Right?
"Without encryption, police, the military, and border agents in countries where they work can examine and search their devices."
Seems like countries like that would just confiscate any device that the owner won't unlock.
I would say: have a lot of (micro)SD cards around and hide the ones that could harm you.
I believe that hiding (a few) micro SD's is not the biggest challenge for a professional photographer.
Since most Cameras have usb port, be it USB 1.0, USB 2.0, USB 3.0, just build a third party add-on with the size of a smartphone. Or better yet an adaptor from camera to smartphone with Camera App for encryption. You can set the storage area to your third party add-on (or smartphone) with all types of encryption suites from aes, camellia, cast, idea, blowfish, seed, 3des, rc6 etc. When you're done with your sensitive photo shoot, disconnect the adaptor/cable.
Can also be done with a different hardware, other than a smartphone but would be bulkier.
When you become a billionaire with this idea, please share your profits with me.
Good idea. You could call this attachment a "smartphone" or a "laptop". It could have a bunch of other software that could run on it too. Genius!
NK soldier gets your camera.
NK soldier sees encrypted files.
NK soldier throws your camera onto the fucking floor and shoots it.
How is your fancy encryption helping you? How will encrypted photos make you look? Not suspect at all?
Every human endeavor can be used for both good and evil. In this case, those who are arguing for protection against a government agency looking at the contents of the cameras are ignoring the fact that the cameras can be used for illegal purposes.
This way we can prevent manufacturers from using it to limit cross-compatibility (encrypted SD card). They may also utilize it in updates in a way that's similar to programmed device death. And, it keeps them from requiring the device to act as a bridge, which whomever pays them enough, may prevent support for other systems.
Absolutely.
Until all devices are encrypted.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
canon cameras have an aftermarket open source firmware with encryption:
https://www.magiclantern.fm/forum/index.php?topic=10279.0
as far as I can tell it could use a security review to be usable but it does work...
WTF? If some authority can't browse the photos in your devices, they will simply seize the devices. Encryption isn't going to help you there.
Adding a digital signature, created by the camera before compression, etc.. to an image, would be a much better value add. This could help assure that images aren't tampered with after they are taken. Heck, my name is even on one of those patents, though I wouldn't get any $ from it.
It looks like it's possible using Magiclantern open-source firmware for Canon cameras:
https://www.magiclantern.fm/fo...
I think what is being requested in the article is AES grade encryption. What magiclantern provides might be better than having nothing but is still far from being AES. As stated by the author, "the encryption [he] implemented is *not* military grade." For cameras that are taken by border security guards, a make-shift XOR "encryption" probably is not going to be good enough.
There is still the principle that what they don't know can't be used against you. Sure, you might be found guilty of something and punished for being uncooperative, but usually the scope of their suspicion is limited by what they already know, so why fuel their imagination by giving them something to actually prosecute you and then maybe push their suspicion a few more steps further?
Maybe taking the picture of a few poor orphans might put you in trouble, but they might find the pictures you took at a nuclear power conference elsewhere an even more interesting target.
I once had a signature.
This will just usher in a new era of proprietary storage formats and the need to use some dumb, unsupported after 2 years vendor created app to unlock and view the contents of your memory card. It will be the late 90's/early 2000's all over again.
Encryption should be handled at the card level in hardware, and support be built into OSes. So the SD card org needs to come up with some solution.
It looks like it's possible using Magiclantern open-source firmware for Canon cameras: https://www.magiclantern.fm/fo...
Interesting. But it should be pointed out that the implementation is very badly done from a security perspective. I only spent a few minutes looking at it and found several showstoppers in both design and implementation. Among them:
1. The basic file encryption algorithm is a stream cipher construction using a simple LFSR as the stream generator. This is almost certainly trivial to break; standard LFSRs are in no way designed for cryptographic security. I suspect the LFSR was used for performance, and I'm sure it does in fact perform much better than, say, AES in CTR mode (where AES is used to generate a bitstream XORed with the plaintext in the same way the LFSR output is). While no good stream cipher is likely to match the LFSR performance, there are several that would provide moderate performance and high security, such as ChaCha20 -- or perhaps even a reduced-round variant like ChaCha12 or even Salsa20/12.
Note that someone has contributed an XTEA implementation which is much better, security-wise, than the LFSR but actually slower than AES. If you're going to do that, just use AES.
2. Even if the LFSR-based encryption algorithm were good, it uses 64-bit keys, which is just too small. Oddly enough, when you use the provided RSA mode for asymmetric write-only encryption (decryption can only be done on your PC), the author seems to recommend a 4096-bit RSA key size, which is roughly equivalent to a ~160-bit symmetric encryption key, and which is quite slow. It makes no sense to use such a huge, slow RSA key to protect small symmetric keys.
3. Password hashing uses the same LFSR plus some shifting and masking. Almost certainly insecure, and there's really no reason at all not to use a good password hashing algorithm like Argon2, or at least scrypt.
4. In asymmetric mode, the code appears to use random padding for RSA operations. There are really good reasons for the PKCS#1 v1.5 and RSA-OAEP padding modes that are normally used. It's possible that a very careful analysis of this implementation may show that under certain operational assumptions random padding is okay... but I seriously doubt that any such careful analysis has been done. I would never bother doing anything of the sort and would simply use OAEP. (Or, better yet, avoid RSA and instead use an elliptic curve algorithm -- less tricky to use correctly, faster, smaller keys and even the provides possibility to derive keys from passwords. There's really no reason to use RSA for anything anymore unless you have to interoperate with legacy infrastructure that already uses it.)
5. RSA key generation is done on-device, with the private key written to the SD card, then later deleted. You can't actually delete things from SD cards, not with any confidence. Much better to do keygen off device so only the public key ever exists on the SD.
6. A glance at the RSA key generation code throws up a number of red flags. I suspect the key generation is buggy.
7. I didn't find the random number generator, but given all of the above, I'd be shocked to find that it's actually good. A bad RNG can easily destroy the security of the best cryptographic design.
When I get some time (ha!) I'm going to see if I can get ML running on my 70D and hack together a better version, using Curve25519 ECDH and ChaCha20 with 128-bit keys, with asymmetric keygen done off-device, and a decent PRNG plus the best seeding mechanism available. To make it more usable, I'll see if I can keep the last few dozen per-file keys in RAM, which will allow the photographer to look at the images on the camera, until the camera is turned off. More paranoid users should be able to disable the retention of keys in RAM.
Sounds like a fun project. One which I may or may not get to before 2025 or so...
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Can't you just carry a small computer, copy the pictures to that and encrypt them? You could even encrypt them on the SD card, and then hide it.
How about this: I'm not spending one red cent on any hunk of metal and glass where I have to screw around with encryption / decryption in order to use it. Screw that. The camera I have now, a Nikon D4s, will last me the rest of my life since I'm 70, and any further camera is really going to have to rock in order to beat it and lure me into spending another $6K - $10K for a subsequent camera. It is guaranteed that if I have to F around with crypto, I will not buy it.
obviously you don't use data. You use Wifi in most cases where you download straight to a phone.
Fill the SD card with random numbers and xor the photo data on top of it. Keep a little space aside for keeping track of the directory content.
Nullius in verba
Most modern DSLRs (e.g. Canon EOS 5D IV, Canon EOS 6D II, Canon EOS 80D) have built-in WiFi now, and you can trivially send all photos from the camera to a smart phone (ideally one with support for removable micro-SD cards) where you could have encrypted storage set up. I have done this on many occasions (e.g. post a photo from my 80D to the internet while at an event).
(I am not as familiar with Nikon models, but I am sure they have some models with built-in WiFi).
Sure, it may be slightly more fiddly than being able to write directly to encrypted SD (or CF) cards on-camera, but much easier to set up as plausibly-denaible.
Of course, if your camera doesn't have WiFi support, you can do the same thing with a bit more fiddling by using a cable (or the "camera connectivity kit" if you use a phone from a vendor who artificially limits the capabilities of their products in order to extract more money from their customers), but then it may be more obvious to nefarious people what you have done with the photos you took.
When we get some sort of failure and all the files are encrypted, those files need to be as retrievable as they would normally be. I would be surprised if more than 20 people in the whole world are worried about security though. If they are, just take the card out and swallow it before you reach customs!
In another thread someone contributed a chacha20 patch. But the main problem is that since there is no hardware support any strong implementation is very slow. I think the idea is to try to obfuscate hidden pictures is the supposed noise of deleted files.
iPhones don't have a removable SD card. Encryption for digital cameras is just plain stupid..
If you're taking pictures of things the local authorities don't wan you to be photographing, perhaps you deserve to face whatever consequences they see fit.
No, the major camera manufactures will not implement the needed encryption in their cameras, but there are other ways to handle this without them. For instance, we at Zifra Tech are currently developing special memory cards that can perform the encryption directly in the camera (while still allowing the user to look at the images until turning off the camera). For more info, check out our webpage https://zifra.tech/ [zifra.tech] Cheers, Robin
Have a look at https://zifra.tech/. They have developed an SD card that encrypts the files on the fly, with photo journalists in mind.
The top end cameras have ethernet jacks in them? Why? Journalists have to get their images to HQ in a hurry so they plug the camera into a computer and transfer the files that way.
Moreover, the cameras also have image processing tools built in so that they can adjust colour, crop and sharpen in camera. The images need to be readable for this toolset to be of any use.
Moreover, the top end cameras have audio notes that can be associated with images. Typically these are used to record the person spelling her or his name.
Finally, the Jpeg is the lingua franca of the working photo journalist. Sure, they have 45 mb raw files to contend with if they want to but typically they ship jpegs to HQ because of the timeliness needed.
Re-read OP
...and who knows, maybe the smartphone could sync with a cloud service to get the images out of the region moments after captured?
if you are taking photos in an area where " the situation is dire " enough that you need encryption for your photos, then you are also in an area where they will beat the shit out of you until you give up your passcode / keys to unlock them. Or they will just take your camera and no one will ever see you or your compromising photos ever again. Encrypted or not.
Very few will buy the " Reporters Special Edition " camera for this feature because it will slow the camera down. A camera with encryption in it limits where it can be sold and would only appeal to a very tiny niche market. I don't see camera vendors getting too excited about this.
Raw files in modern cameras are already touching 100MB in size ( Nikon D850 ) depending on the sensors resolution. Encrypting that would take time which would probably kill one of the selling points of many cameras: framerate.
A flagship Nikon D5 raw file sizes are only ~40MB in size due to lower resolution sensor, but it can take 12 images per second, so your encryption would need to keep up with 480MB / sec if you want things encrypted before landing on the card.
I suppose you could do so after the images arrive on the card but it would eat up processor cycles doing so ( slowing the camera ) unless you add a custom chip to offload it to.
Then comes the whole making software work with your encryption scheme. Is bad enough we have different flavors of raw files from different vendors, now you want to add encryption into the mix ? Good Luck.
Nope. Nope. Nope.
http://web.canon.jp/imaging/osk/osk-e3/index.html
OSK-E3
"Note: Currently only compatible with EOS-1Ds Mark III, EOS-1D Mark III"
I'm on a family vacation taking pictures of my kids with one spare battery that needs to last all day. Encryption is going to drain power faster, and encryption reduces the frames/sec that I can take when junior is diving into that pool. I am sorry journalists feel bad someone is going to search their camera, but hey, they're not the majority of the market, and I don't want to have less camera just so they can have a false sense of security. No encryption please!
If the CPU load of encryption is that bad, it makes me wonder if you could play games with "half-encrypting" the file.
For example, the first part of the file (encrypted) is a JPEG-compressed version of the image, and the second part (unencrypted) is the residuals between the JPEG and the raw image.
It wouldn't be nearly as good as strongly encrypting the entire file, but still much better than weakly encrypting it.