Slashdot Mirror
Camera Makers Resist Encryption, Despite Warnings From Photographers (zdnet.com)
An anonymous reader shares an article from the security editor of ZDNet:
A year after photojournalists and filmmakers sent a critical letter to camera makers for failing to add a basic security feature to protect their work from searches and hacking, little progress has been made. The letter, sent in late 2016, called on camera makers to build encryption into their cameras after photojournalists said they face "a variety of threats..." Even when they're out in the field, collecting footage and documenting evidence, reporters have long argued that without encryption, police, the military, and border agents in countries where they work can examine and search their devices. "The consequences can be dire," the letter added.
Although iPhones and Android phones, computers, and instant messengers all come with encryption, camera makers have fallen behind. Not only does encryption protect reported work from prying eyes, it also protects sources -- many of whom put their lives at risk to expose corruption or wrongdoing... The lack of encryption means high-end camera makers are forcing their customers to choose between putting their sources at risk, or relying on encrypted, but less-capable devices, like iPhones. We asked the same camera manufacturers if they plan to add encryption to their cameras -- and if not, why. The short answer: don't expect much any time soon.
Although iPhones and Android phones, computers, and instant messengers all come with encryption, camera makers have fallen behind. Not only does encryption protect reported work from prying eyes, it also protects sources -- many of whom put their lives at risk to expose corruption or wrongdoing... The lack of encryption means high-end camera makers are forcing their customers to choose between putting their sources at risk, or relying on encrypted, but less-capable devices, like iPhones. We asked the same camera manufacturers if they plan to add encryption to their cameras -- and if not, why. The short answer: don't expect much any time soon.
not excusing the camera makers here, but couldn't this be designed into an SD card?
With smartphones approaching 20MP, they are an alternative in a lot of situations.
(No, you dont have to argue that a 5mm Optic isn't the same as a 50mm Optic, i know. But if encryption is important for you, currently, the Camera Makers wont give you a choice)...
High resolution, more stops of dynamic range, and the ability to use different lenses does. For really high end models, there are a few other things too, like full frame DSLR formats, high frame rates (for shooting sports etc.), the ability to shoot HD video, etc. The vast majority of people shooting with a camera other than the one on their phone (which is already a shrinking market) don't care about encryption (which would slow down their camera even more), so don't expect the Nikons, Canons, and Sonys of the world to invest a lot of R & D on a feature that there's really not much of a market for.
If you're a photojournalist leaving a dangerous field assignment then there's a high likelihood you will be stopped and searched. If you hand over your camera and it comes up with a prompt for an encryption password then your camera and its media will be confiscated or destroyed in front of you. There go your photos.
As for protecting sources, why would you photograph them if you didn't intend to publish the photos anyway, which would still put them in danger?
Interesting.
The workaround, for photographers, has to be that if the pictures are sensitive they need to download their pictures to their laptop (or other device) which is encrypted as soon as they leave the photography site.
... then take a lot of pictures of the floor, to overwrite the images on the camera's storage...
http://www.geoffreylandis.com
It looks like it's possible using Magiclantern open-source firmware for Canon cameras: https://www.magiclantern.fm/fo...
https://www.digitaltrends.com/... Wonder if this is one of the reasons for this patent.
Sure, it'd be a useful feature for a small number of people, but the vast majority of users of high end cameras (and there aren't that many) wouldn't need it. And doing it this would either require a special encryption chip, increasing the cost for all users, or would be so terribly so that it would make the camera effectively unusable.
still, they're called film cameras. Nobody can see the pictures before the film is processed, and good luck to find a shop that still processes films nowadays.
Slashdot, fix the reply notifications... You won't get away with it...
it's just that simple.
If you're not doing anything wrong you shouldn't have anything to worry about. Don't you hate it when people say that?
It's not just encryption that cameras need, they also need a cryptographic signature to indicate that the image it took is fresh from the camera and has not been edited since the photo was taken. (Obviously this can be defeated by photographing a photoshopped image, but still...)
Talking about ignorants... Journalists weigh personal risks vs. getting the story out since the profession exists and you think it's all a super-easy choice and you always should just obey the authority.
The lack of encryption means high-end camera makers are forcing their customers to choose between putting their sources at risk, or relying on encrypted, but less-capable devices, like iPhones.
Or, you know, pulling the memory card out of the camera and hiding it.
I've seen wifi SD cards for cameras, so it should be easy to have your high-end camera send it's pictures to your smart phone, tablet, etc. as soon as you take it, then the photojournalist can simply delete the local copy on the camera. when your camera is searched, no images are found, they are all on your secure, encrypted smartphone, and who knows, maybe the smartphone could sync with a cloud service to get the images out of the region moments after captured?
Ken
I've always wondered what would happen in such a regime if the password you give them doesn't work for them because it's biometrically keyed to work only for you?
And what would happen if further, the biometric protections utilize mechanisms that go so far as to examine your brain waves to evaluate your emotional state at the time you are attempting to unlock the device, and will not unlock, not even for you, while you are experiencing above average levels of stress or otherwise under any kind of duress to unlock it?
And of course, throwing you in a cage because you used such impenetrable encryption wouldn't change anything, and would in general only make it even *more* difficult for you to unlock the device for them.
File under 'M' for 'Manic ranting'
Have your camera connected to your smart phone via an SD Wifi adapter. Automatically transfer the photos and delete them on the camera as they are taken.
Would it take a rocket appliance to use steganography?
Serenity now, insanity later.
You're presenting a false dichotomy and are apparently completely ignorant of the profession. Journalists reporting from crisis & war zones, on violent crime and from regimes with undue process have always been taking risks, and they have always weighed them against the obligation to report the story. It's part of the job, but only a small number of journalists work in this field and are willing to take the risks. Despite all that, dozens of journalists are killed every year while doing their work, just so you can get their news in your comfy living room. You should to tone down your attitude and show respect where it's due.
Good luck when you're stopped by the police/military in some shit-hole country. Encrypted files? No problem, just beat them until they decrypt.
Wow, I'd think the better approach would be a fingerprint reader that can store two fingerprints - one that operates normally, allowing access to all the images on the device, a second finger that only allow access to a curated area of storage, with pictures of puppies, children, and sunsets. A more aggressive option would be a third-finger that wipes the contents of the card...
For example:
such an arrangement would allow the photojournalist the option of providing access as the situation warranted, choosing to either protect their subject's privacy/security or save their bacon if they are afraid for their life.
Ken
Given the remoteness of most of these regions, and that RAWs can be upwards of 50MB each, I don't think a phone's data connection would cut it.
Syncing via WiFi to another device could be an option, depending on the scenario, but it's relatively battery intensive so it requires preparation & knowledge of exactly when you're going to shoot. Not so great for journalists travelling in remote regions, often off-the-grid, who need to be able to whip out their camera at a moment's notice.
Canon offers a kit that includes an encrypted SD and flash drive. There are also a bunch of hackers around that do anything from running Arkanoid to implementing zlib on their dSLR camera. There are options, a bit of research and/or a knowledgeable it staff would help them more than bitching at the manufacturers.
Custom electronics and digital signage for your business: www.evcircuits.com
I can easily imagine a program that detects a new photo on the SD card, transmits the message to the linked-to device (smartphone), then overwrites every sector the photo occupied with a random bit pattern before deleting the photo entry from the file directory on the device.
Sure, a curious regime could send the SD card out for data recovery, but the actual sectors the photo occupied would contain the random bit pattern - a brute-force search of the device would be fruitless.
Ken
You want a niche feature that would be detrimental or confusing to most users. An average photographer's nightmare is losing an amazing shot and encryption is likely to screw up any recovery attempts. Others would get in more trouble because of encryption than because of actual photos. Sounds like a good case for a Kickstarter project to make an Android-based camera where you can use a photo app that suits your specific needs. If there is mobile data, you would ideally upload shots to your studio and the securely erase them locally so that no evidence, including evidence of hiding evidence, is left.
If cellphones already implement some sort of encryption and their camera quality is good enough, why not taking pictures with them?
I hate signatures
When they enter into the arena of conflict and choose to 'show the truth' in a way that one side in the conflict opposes, they are entering into the conflict as a participant on one side and are no longer being a journalist. They can suck air in prison if they're caught.
It's not themselves they're trying to protect - if they wanted to stay safe then they wouldn't be in that line of work. They're trying to protect their sources and their evidence.
--- Most topics have many sides worth arguing, allow me to take one opposite you.
First thing I thought when I read the article.
I have not tried the encryption functionality, but Magic Lantern rocks.
An easier option - use asymmetric encryption, and leave your private key at home. You can't give them what you don't have, even if they break you and you really wish you could. Of course, if they break you then you can probably just *tell* them most of what they want to know, but it at least ensures that you are the weakest link.
--- Most topics have many sides worth arguing, allow me to take one opposite you.
Cameras use SD Cards. "Secure Digital". The standard already exists, so all that camera manufacturers need to do is to implement the protocols for entering a password.
Have gnu, will travel.
OK, so you're in a country where they're suspicious of photographers. A cop comes up and asks to see what's in your camera. Sure, you say, and let him download your files. Oh, I see they're encrypted, he says...well, thank you for your time. Right?
Wow... just wow. In every conflict on earth you have a side that opposes covering aspects of the conflict at one time or another. According to your bizarre logic journalists could never get any footage from any war zone anywhere without 'taking sides' and 'no longer being journalists'. The world does not work the way you think it does.
By the way, in many cases war correspondents who miscalculate their risks can be happy if they end up in prison. Often they are killed. But I guess the beheading of James Foley by ISIS was just alright from your point of view, because he was 'taking side'. Retard.
> I've always wondered what would happen in such a
> regime if the password you give them doesn't work
> for them because it's biometrically keyed to work
> only for you?
Similar issue: A company I used to work for always but ALWAYS required travel with loaner laptops only. (Didn't matter if it was just to LA, or all the way to China. And, by his own decree, the policy included everyone up to and including the CEO.). All of the important data was on an encrypted partition, with just the basic OS unencrypted. Tricky bit was: we used a split-key system where the traveling employee had to:
1) Plug in his USB key, input the PIN on the USB, and its password on the computer to unlock his half of the key.
then
2) Connect to the company VPN, from which he would fetch the other half of the key, which was only stored in RAM and never swapped to disk.
Only with both parts of the key could the encrypted partition be accessed. And we always suspended VPN access while the employee was en route; making it literally *impossible* for him/her to give up the secured data, even to "rubber hose decryption". If some airport security goon got the notion in his little head that he wanted to see the contents of the laptop, he could go tell it to a real LEO, who could tell it to a judge, who could issue a subpoena or warrant, which our lawyers could fight. The ASG itself could go get bent. That data was OURS, not the employee's, and certainly not the airport's.
It was an issue only once while I worked there. An employee was returning from Singapore & vicinity; and some ASG wanted to see the contents of his laptop. After explaining the situation that the data was privileged and protected to them, our guy actually called up InfoSec, put him on speaker with the airport goon, and reportedly grinned ludicrously as InfoSec told the ASG not just that we wouldn't be unlocking the laptop, but also exactly what we thought of him, his kind, his agency, his "mission", his manhood and the lack thereof, his family and it's canine/porcine pedigree, and so on (Said InfoSec guy had been an army drill instructor in his past. So he had the talent. And I understand that the looks on the faces of the other overhearing travelers was fairly priceless.); with an admonition to not-so-kindly go fuck himself sideways with some rusty farm implements and to call legal if he had a problem and could somehow conjure up the mental wherewithal to operate a telephone himself. The laptop did stay at the airport; but not for long. Legal wrote a nastygram, in blood, on asbestos paper, and delivered by a black raven. And I think it only took about a month or so to get it back.
Imagine all the people...
Good idea. You could call this attachment a "smartphone" or a "laptop". It could have a bunch of other software that could run on it too. Genius!
Every human endeavor can be used for both good and evil. In this case, those who are arguing for protection against a government agency looking at the contents of the cameras are ignoring the fact that the cameras can be used for illegal purposes.
Absolutely.
Until all devices are encrypted.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
In 2000 and at the end of their 25th. independence celebrations I took some pics of the Angolan government plane being boarded by some VIP's. :). (Olympus C-900 Zoom)
Within seconds security confiscated my camera.
A good hour later they came back explaining they could not get the film out, indeed they had never seen a digital camera
So I showed them the photo's and deleted the ones' they objected to.
Little did they know or understand I had already taken more pictures on a different card.
A couple of hours later when back in South Africa I undeleted the photo's from the affected card.
I'm afraid these days such won't work any more...
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
WTF? If some authority can't browse the photos in your devices, they will simply seize the devices. Encryption isn't going to help you there.
Adding a digital signature, created by the camera before compression, etc.. to an image, would be a much better value add. This could help assure that images aren't tampered with after they are taken. Heck, my name is even on one of those patents, though I wouldn't get any $ from it.
Leaving aside the legal costs, and the costs of the loaner laptops, that solution sounds pretty expensive. But very effective.
Your ad here. Ask me how!
There is still the principle that what they don't know can't be used against you. Sure, you might be found guilty of something and punished for being uncooperative, but usually the scope of their suspicion is limited by what they already know, so why fuel their imagination by giving them something to actually prosecute you and then maybe push their suspicion a few more steps further?
Maybe taking the picture of a few poor orphans might put you in trouble, but they might find the pictures you took at a nuclear power conference elsewhere an even more interesting target.
I once had a signature.
It looks like it's possible using Magiclantern open-source firmware for Canon cameras: https://www.magiclantern.fm/fo...
Interesting. But it should be pointed out that the implementation is very badly done from a security perspective. I only spent a few minutes looking at it and found several showstoppers in both design and implementation. Among them:
1. The basic file encryption algorithm is a stream cipher construction using a simple LFSR as the stream generator. This is almost certainly trivial to break; standard LFSRs are in no way designed for cryptographic security. I suspect the LFSR was used for performance, and I'm sure it does in fact perform much better than, say, AES in CTR mode (where AES is used to generate a bitstream XORed with the plaintext in the same way the LFSR output is). While no good stream cipher is likely to match the LFSR performance, there are several that would provide moderate performance and high security, such as ChaCha20 -- or perhaps even a reduced-round variant like ChaCha12 or even Salsa20/12.
Note that someone has contributed an XTEA implementation which is much better, security-wise, than the LFSR but actually slower than AES. If you're going to do that, just use AES.
2. Even if the LFSR-based encryption algorithm were good, it uses 64-bit keys, which is just too small. Oddly enough, when you use the provided RSA mode for asymmetric write-only encryption (decryption can only be done on your PC), the author seems to recommend a 4096-bit RSA key size, which is roughly equivalent to a ~160-bit symmetric encryption key, and which is quite slow. It makes no sense to use such a huge, slow RSA key to protect small symmetric keys.
3. Password hashing uses the same LFSR plus some shifting and masking. Almost certainly insecure, and there's really no reason at all not to use a good password hashing algorithm like Argon2, or at least scrypt.
4. In asymmetric mode, the code appears to use random padding for RSA operations. There are really good reasons for the PKCS#1 v1.5 and RSA-OAEP padding modes that are normally used. It's possible that a very careful analysis of this implementation may show that under certain operational assumptions random padding is okay... but I seriously doubt that any such careful analysis has been done. I would never bother doing anything of the sort and would simply use OAEP. (Or, better yet, avoid RSA and instead use an elliptic curve algorithm -- less tricky to use correctly, faster, smaller keys and even the provides possibility to derive keys from passwords. There's really no reason to use RSA for anything anymore unless you have to interoperate with legacy infrastructure that already uses it.)
5. RSA key generation is done on-device, with the private key written to the SD card, then later deleted. You can't actually delete things from SD cards, not with any confidence. Much better to do keygen off device so only the public key ever exists on the SD.
6. A glance at the RSA key generation code throws up a number of red flags. I suspect the key generation is buggy.
7. I didn't find the random number generator, but given all of the above, I'd be shocked to find that it's actually good. A bad RNG can easily destroy the security of the best cryptographic design.
When I get some time (ha!) I'm going to see if I can get ML running on my 70D and hack together a better version, using Curve25519 ECDH and ChaCha20 with 128-bit keys, with asymmetric keygen done off-device, and a decent PRNG plus the best seeding mechanism available. To make it more usable, I'll see if I can keep the last few dozen per-file keys in RAM, which will allow the photographer to look at the images on the camera, until the camera is turned off. More paranoid users should be able to disable the retention of keys in RAM.
Sounds like a fun project. One which I may or may not get to before 2025 or so...
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
How about this: I'm not spending one red cent on any hunk of metal and glass where I have to screw around with encryption / decryption in order to use it. Screw that. The camera I have now, a Nikon D4s, will last me the rest of my life since I'm 70, and any further camera is really going to have to rock in order to beat it and lure me into spending another $6K - $10K for a subsequent camera. It is guaranteed that if I have to F around with crypto, I will not buy it.
obviously you don't use data. You use Wifi in most cases where you download straight to a phone.
Fill the SD card with random numbers and xor the photo data on top of it. Keep a little space aside for keeping track of the directory content.
Nullius in verba
Most modern DSLRs (e.g. Canon EOS 5D IV, Canon EOS 6D II, Canon EOS 80D) have built-in WiFi now, and you can trivially send all photos from the camera to a smart phone (ideally one with support for removable micro-SD cards) where you could have encrypted storage set up. I have done this on many occasions (e.g. post a photo from my 80D to the internet while at an event).
(I am not as familiar with Nikon models, but I am sure they have some models with built-in WiFi).
Sure, it may be slightly more fiddly than being able to write directly to encrypted SD (or CF) cards on-camera, but much easier to set up as plausibly-denaible.
Of course, if your camera doesn't have WiFi support, you can do the same thing with a bit more fiddling by using a cable (or the "camera connectivity kit" if you use a phone from a vendor who artificially limits the capabilities of their products in order to extract more money from their customers), but then it may be more obvious to nefarious people what you have done with the photos you took.
It wasn't so bad as you might think. Our lawyers were mostly full-time on-staff. While we brought in dedicated specialists from law firms when needed; for routine matters like griefing ASGs, our salaried guys could generally keep the requite steady stream of bile flowing as part of their 9-5. Also, due to the nature of the business, a number of said lawyers in addition to many of our execs, had contacts in the federal government and knew exactly who to go over-their-heads to, so as to expedite the shit rolling downhill to the ASGs. (Our CEO had had a very bad experience with the TSA not long after it got started... circa 2003 or so... which left him with something of a burning hatred of the agency. So various surliness, circumvention, uncooperativeness, and outright hostility towards it, and the various TLS spinoffs comprising the rest of the ASGs, while not mandatory, was actively encouraged.). Finally, the laptops themselves were insured.
And at the end of the day, the laptop is nowhere near as valuable as the data; and not just for our own sake. For a decent number of our customers, including the part of the federal government we directly dealt with, we were contractually obligated to protect said data. And releasing it to some ASG yahoo was NOT part of those contracts (Not even with the feds.). And the penalties for leaking it would have been well in excess of the cost of eating a laptop, assuming we never got it back and insurance never paid out.
Imagine all the people...
When we get some sort of failure and all the files are encrypted, those files need to be as retrievable as they would normally be. I would be surprised if more than 20 people in the whole world are worried about security though. If they are, just take the card out and swallow it before you reach customs!
In another thread someone contributed a chacha20 patch. But the main problem is that since there is no hardware support any strong implementation is very slow. I think the idea is to try to obfuscate hidden pictures is the supposed noise of deleted files.
No, the major camera manufactures will not implement the needed encryption in their cameras, but there are other ways to handle this without them. For instance, we at Zifra Tech are currently developing special memory cards that can perform the encryption directly in the camera (while still allowing the user to look at the images until turning off the camera). For more info, check out our webpage https://zifra.tech/ [zifra.tech] Cheers, Robin
Re-read OP
...and who knows, maybe the smartphone could sync with a cloud service to get the images out of the region moments after captured?
if you are taking photos in an area where " the situation is dire " enough that you need encryption for your photos, then you are also in an area where they will beat the shit out of you until you give up your passcode / keys to unlock them. Or they will just take your camera and no one will ever see you or your compromising photos ever again. Encrypted or not.
Very few will buy the " Reporters Special Edition " camera for this feature because it will slow the camera down. A camera with encryption in it limits where it can be sold and would only appeal to a very tiny niche market. I don't see camera vendors getting too excited about this.
Raw files in modern cameras are already touching 100MB in size ( Nikon D850 ) depending on the sensors resolution. Encrypting that would take time which would probably kill one of the selling points of many cameras: framerate.
A flagship Nikon D5 raw file sizes are only ~40MB in size due to lower resolution sensor, but it can take 12 images per second, so your encryption would need to keep up with 480MB / sec if you want things encrypted before landing on the card.
I suppose you could do so after the images arrive on the card but it would eat up processor cycles doing so ( slowing the camera ) unless you add a custom chip to offload it to.
Then comes the whole making software work with your encryption scheme. Is bad enough we have different flavors of raw files from different vendors, now you want to add encryption into the mix ? Good Luck.
Nope. Nope. Nope.
http://web.canon.jp/imaging/osk/osk-e3/index.html
OSK-E3
"Note: Currently only compatible with EOS-1Ds Mark III, EOS-1D Mark III"
For a mid-to-large company, that's fine. A small company won't even have one lawyer on-staff to start the vitriol. And, as an individual, it's hard for me to imagine anywhere near as complete a system.
As I said, a great system. I wonder if there's some way to supply it as a service to the general population.
Your ad here. Ask me how!
Thank goodness you've diagnosed the problem. All those years in fucking medical school have paid off.
Journalists from all sides in most conflicts have access. Usually under the escort of one side or the other. During World War II there were journalists reporting most everything as it happened, to the degree that the public needed to know. Credible professional journalists who work within the system to report the facts.
And then there are people who fancy themselves as being journalists who engage as renegades and pretend they don't need to take sides.
It's impossible not to take sides, and you're defrauding yourself, and whomever else you're reporting your 'journalism' to if you pretend you haven't taken sides.