Comment

Comment by ixwt

The point of the key (as the for some reason dead comment points out), is not to prove who took the photo, but what device took the photo. Just as if someone stole a hardware token with a PGP key on could impersonate the owner. The key itself doesn't prove a person, just a device.

If a key was reset, a revocation of the original key could be issued, showing that the key was associated with the device for this particular time span. And then the new key registered.

This is ripe for abuse though, so resetting a TPM might not be accepted for this use case. I'm not certain in which case you'd want to reset a TPM for this use case though. Unless you took enough photos with the device to risk a birthday attack if you were using something like ECDSA.

parent ixwt 2 months ago

No comments yet

Be the first to share your thoughts.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton