rh-app-dev

Without giving away the keys to the kingdom, when someone registers their device to use the app, it creates a few objects on the backend and the device that generate the cryptographic signatures in the content. It's designed to prevent fakes, multiple ways. Install the app to see how it works and the question will answer it self.

Witness is the app.

Easier said than done, as I just went through it. And if they did, and it did all the checks to ensure the device is valid, the backend that tracks the devices and issues the certificates, accounting for the various methods of altering content to fake a valid one, then I'd applaud them.

This system works with both mobile device platforms and content created with it can be validated by the app on any other device. There will also be a web validation tool soon.

The security behind the solution is designed to withstand legal and audit challenges. Making your own signing system is not as simple as it sounds.

It's a chicken and egg situation. Many people have said they wish this existed, but it didn't when they said it. Now that it does, they don't know that it exists. If 2% of every mobile device user used this app to take pictures and videos, eventually someone would record something unbelievable. And the proof that it was real would make other people want to use it too.

So yes, this is the inception of a tool like this. Honestly, if someone else makes a similar tool, great. I made this because I think we shouldn't ever have that question "is it real or is it AI?". This removes the question.

We haven't started that phase of development yet but the original image would still be immutable. Subsequent edits to the image metadata would be would be done via Photoshop with a plugin for tracking those edits and then saving and certifying that the original image was still locked with the added visual changes. Haven't decided how those additional changes would be tracked, but I'm guessing it's necessary to do so.

Yes it does. It uses the camera but creates its own content files and stores in its own location. The content files can be exported via sharing in the app.

Haven't tried that, but the big hurdle is getting validation of those test cases from App Attest and Play Integrity. Those are required for running the app.

The timestamp is based on the device. However, some of the security data comes from the Witness validation server and others from the platform (Google Play Integrity/Apple App Attest). Altering the date/time on the device would conflict with that information, and possibly fail the device validation. One of the key criteria for using the app is it will only run on a device that passes validation from the platform. So rooted devices can't run the app, as they can't pass validation.

Making the app and the validated content files editable is actually the next major feature. Once we conquer that, its onto making it work for live content.

Timestamp is already there. Geo-location will be added at a later date. Some devices already add that information but the app doesn't use it. It will be added eventually though.

The security in the app does. The signatures use the captured content and other data as criteria. If any of it or the file is tampered with, it fails validation. And you can only apply the signature to content captured by the camera. Can't be added afterwards.

Witness is a camera app that certifies your photos and videos as real the moment you take them. It embeds a cryptographic signature directly into the file, no cloud or upload. This makes every image and video self-verifiable. Free for regular users on iOS and Android.