Injecting hidden GUIDs into local files without explicit user consent is a massive privacy overreach. It makes you wonder what other local tools are silently tagging user generated content.
It could also mean they are lying. It could be they are being forced to downplay how good the watermarking is because gov agencies want that tool available to them without people knowing about it. We'll have to wait for the next Snowden to find out.
I still don't see how this is supposed to work for text content that I copy and paste somewhere else. And with models getting better and better to "human language", wouldn't the false positives also rise as "real text" is flagged to be AI generated?
I don't know either, and maybe it doesn't or can't work. But also maybe it does and can. I do not have any where near the expertise to know which is the case.
No it's not ok, and most people are horrified when they learn. It's just a reality check that we've lived in a surveillance state for quite a while and it's time we take a stand. And a reminder that the government has done a good job of suppressing these realities from public awareness.
And it's a reality check that we live in a surveillance state. To a degree that most people find appalling, but the government is good enough at suppressing public awareness enough to cause an outcry.
It's also not whataboutism, the comment specifically wondered how else were being surrupticously tracked without our knowledge. This is a concrete example and I think many would be surprised such tracking also exists outside the digital realm.
Also why color laser printers refuse to print b/w documents when they run out of color toner since they can no longer print the yellow DocuColor tracking dots.
I am doing metadata auditing for government documents these days and there are UUIDs in lots of files going back a very long time. I have certainly seen them in PDFs and Word and Excel documents that long predated the current AI integrations.
Edit to add: I just tested LibreOffice/26.2.5.2 and it is not injecting a UUID into the metadata either for a ODT or a DOCx (2007) file. I do not have native MS Office available on hand to test at the moment. I do see these UUIDs in published government documents but cannot swear to exactly what step of the pipeline is stamping them. Definitely on files that predate the AI integration push by Microsoft.
Your printer has been doing this for decades. There's an invisible-to-human dot matrix pattern that encodes things like model, serial number and i don't remember what else.
AI-generated text warning (I submitted - but did not author - the piece), but it seems MS Paint and MS Photos add both a visible (can be turned off) and invisible (cannot be disabled and happens silently in the background with no user notice) watermarks to photos that have been AI-manipulated, even when using a local model to perform the action. It's not clear if this applies to even things like using AI-enhanced background delete/remove, but the invisible watermark is embedded in both the image pixels and the image metadata, both containing a GUID that can be linked to the exact prompt that was used and the originating device/user (on Microsoft's end).
Obvious next step is to explore if you can replace watermarker.dll with a (signed) no-op shim or MITM the API call to at least use your own (nil?) GUID that isn't linked to your device/account.
In case it's not obvious, my bigger concern isn't "this image can be identified to have been generated with/by AI" so much as it is "digital yellow printer dots have been forced upon us, except they can identify and retrieve the exact user/device/time/place/document/etc", completely destroying any and all illusions of privacy left.
I'd like to know more about the GUID part and how easy is it so deanonymize yeah.
But if it's only on ai generation and not on all images it seems easy enough to work around that part? Still better than printers doing it no matter what you're printing.
Sounds better to do postprocess filtering explicitly? For example, adding random noise with amplitude 1/255 (which should be as invisible as the watermark), followed by a smart blur that blurs more in directions where the colors are more similar (making the blur less obvious to humans).
But this is all moot really, if MS Paint is watermarking shit, it’s better to just use something else. Nothing from Microsoft is trustworthy.
There are several paragraphs where output looks very AI-like (and Claude flavored one at that), e.g.
> In other words, “generated locally” does not mean that the complete operation is local. Microsoft receives and moderates the prompt, then issues the unique GUID that Paint embeds into the locally generated image. Paint also sends the previous promptGenerationId as lastPromptGenerationId with its next moderation request, allowing successive requests to be linked explicitly.
> That relationship is important. C2PA calls this a soft binding: a value derived from, or embedded into, the content so that the content can still be matched with its provenance record after the file-level manifest has been removed. For a watermark soft binding, the value is the watermark’s content identifier. Microsoft cryptographically signed this assertion.
> After an AI result is applied to the Paint canvas, the available formats are still restricted to PNG, JPEG, GIF, and Paint’s own .paint format. BMP—the classic Paint format—is conspicuously absent.
The AI aspect of this is a red herring. The real problem is that they're secretly adding in a unique identifier into every image you create. If somebody does not like your meme, they can just send a copyright subpoena to Microsoft to instantly get your full name, address, email, phone number, and any other data associated with your Microsoft account. Just like age verification, this is another weapon in the war against internet anonymity.
It does kind of say: The GUID is coming from the moderation endpoint, which is hit when you generate a local or cloud AI image based on your prompt. If there is no prompt, there is no endpoint, and likely no GUID.
Obviously Paint could have been watermarking prior to AI though, but this specific AI watermarking appears to be only that.
Since the watermarker runs locally, you could also do the reverse: generate some porn with a different open model, then run that code to tag it as "Content watermarked by Microsoft Responsible AI"
Probably both so they can change what they censor without waiting for you to run windows update and also so they can collect your information (IP, timestamp, etc) to associate with whatever you did
Do not tell Microsoft where you sleep. IANAL but they are not a government or financial institution and do not have a right to that information.
Make sure you register mailing addresses with your credit card institutions in addition to your residential addresses, and make your mailing address your billing address so that you aren't forced to tell a thousand businesses like Microsoft where you sleep.
Windows 11 effectively forces users to register with a Microsoft account. Once that's established, all it takes is for an unaware user to fill out an e-commerce form and save an address for auto-fill.
My comment was in regard to the average PC user. The kinds of folks who would never install an operating system and would likely agree to use Edge while signed in to their Microsoft account.
Microsoft has also been pushing hard for Recall and recording all local activity forever. Not impossible to imagine that anything looking like a home address “somehow” gets ingested in the telemetry.
A bypass existing is actually not good because that's how the frog is boiled. Ignorant users get an account while power user are placated for now. Then at some point the bypass is removed and when power users speak up they will be told shut down by all the drones with "you have needed an account for years, why are you throwing a fuss now".
> Windows 11 effectively forces users to register with a Microsoft account.
While it's definitely a dark pattern that I 100% do not agree with, Pro editions still allow you to do a local account. No need for the oobe /bypass command, still can be done through the OOBE GUI setup by selecting a Work/School account option then selecting Sign in options to then specify a local account to create.
> This is broadly impractical for the average citizen.
No it's not. Sign up for a virtual mailbox for $15-$25/month.
> A scalable solution would be to make this sort of thing illegal.
I'm posting this in the genuine interest of people being able to maintain anonymity from data leaks, privacy leaks, and in general not needing to tell businesses more personal information than is necessary to render services. This is in a country that has no protection of personal safety whatsoever, and any business data leak could mean life or death to average citizens who are being threatened by criminals, stalkers, and more.
It seems every time I post something of this flavor the same handful of you come out of the woods and want to make privacy illegal, and I'm not sure who you are trying to support.
Ahhh okay if that's what they meant, then yes, I 100% agree and apologize in advance.
I fully agree that businesses should not be asking for addresses. Non-financial businesses don't need to KYC in the first place, and financial institutions can KYC without needing to know where you sleep.
I got triggered because people seem to always want to come out of the woods and say "addresses should be public record" or things of that sort and I vehemently disagree in the interest of privacy, in a country where a stalker can just look you up, terrorize you, and the police will do nothing about it.
They (the ones wanting to make privacy illegal) are just the ones that want to develop the tools and consume the data for it because it'll be good for their resume or some bullshit, or they're just intrinsically broken humans.
> No it's not. Sign up for a virtual mailbox for $15-$25/month.
Did you notice that it's an affordability crisis out there? An absolutely enormous number of people are skipping bills, taking on credit, and using predatory lenders to make end meets, and your recommendation is to add another fee on top of things.
It's not practical or useful guidance for the vast majority of people. I strongly agree with supporting privacy, but this sort of behaviour (adding trackers, etc) to normal functions without a full disclosure and opt-out mechanism must be made illegal, otherwise we are just creating markets for "privacy preserving" technologies that are increasingly less likely to actually be effective for that purpose but sure do put on a good theatre of seeming that way.
At least in the US it's not even a good method either. Own a house? Boom, your information is publically available and you won't be able to remove it without a court order, which in most states is impossible to get. In most states, you don't even need to own a house, decide to vote? You information again is publically available. Tie your real name to a single account to purchase something, and you are trackable. Want privacy? You'd need to remove yourself from the internet, dump your phone, destroy your ID and work underground for cash. We can push against iot, and people have been forever, but at the end of the day the government will always they have a vested interest in being able to identify it's citizens.
My sister was a member of Scientology for 2 decades and she was encouraged to do this. As a result, she has almost no Social Security earnings and her Social Security check is about 1/4 of what she would be getting if she reported (and paid taxes to the government instead of to her "church") her income.
> decide to vote? Your information again is publicly available
I ran for elected office in the past. When I asked the voter registration office for a "walking list", they only checked that I did get on the ballot and I was provided with a list of every registered voter in the district I was running for. It had names, addresses, phone numbers, political party and a list of what elections you voted in (I think it went back 8 years). Some people were rather upset that I had access to that information when I knocked on their door and asked them to vote for me.
> Sign up for a virtual mailbox for $15-$25/month.
That isn't going to stop Microsoft from collecting your address by collecting your wifi info, or from the data you enter into websites or documents. When the maker of your OS is the enemy you will always lose.
> IANAL but they are not a government or financial institution and do not have a right to that information.
As soon as you purchase something from Microsoft - e.g. your Office 365 subscription - they have at the very least your billing address on file for the credit card.
Seems to me that it's a challenge to make an apple account without adding a credit card to your account as well. A carfully chosen Linux distro (so many options!) is the way to avoid the brunt of these privacy issues, lots of open software calls home in some way or another so user beware!
We gotta stop normalizing that. Why do you need my address to receive my money? My birth date?
Even in places with strong privacy regulations requiring businesses not to collect data they don’t need, businesses apparently get away with asking this.
The problem is CC processors. You can get away as a merchant with just a number and expiration date, that's the minimum you need to process a CC payment, but you pay exorbitantly higher fees. The more details you collect and pass on, the lower your processor's risk fee will be because the more info, the more likely it is that the customer is actually the cardholder and not using fraudulently obtained data.
And as soon as you connect with telephony systems (e.g. VoIP numbers) or rent out servers, some countries' telecom KYC laws apply that also force MS to collect validated address data.
Even without the CC processor requirements they would want to be able to identify you in case of a payment dispute. Digital payments are more like an IOU than like cash.
In the rest of the world CC processing uses a PIN code + online revocation check (when the card is present) or a redirect through your bank (which hopefully uses some type of 2FA). Works a lot better & safer, and you should wonder why they pretend to need to violate your privacy in the USA…
Because of the volume of stolen credit card numbers. If you have the address, you are much less likely to be someone using stolen CCs. Seriously, most of the crooks are that lazy. So the real reason is the credit card processing companies.
Also, post 911, there is this thing called "know your customer". It was set up to fight money laundering and financing terrorists.
As the article explained, the EU does not mandate a prompt-specific GUID, only the ability to identify the content as AI-generated. The highly privacy-invasive level of provenance tracking which Microsoft has added goes beyond the EU’s new mandates.
So you will defeat chat control by sitting there going “but you don’t have muh gdpr consent for that!”?
The whole EU vision is they know what the little people do all the time, think all the time, and spend their money on all the time. For the children, obviously.
If you think "chat control" is going to pass, I've a bridge to sell you.
In the meantime, the GDPR is your friend. The amount of FUD spread about it on here by those working in Adtech (and whose very salaries are dependent on invading peoples privacy) is insane.
> If you think "chat control" is going to pass, I've a bridge to sell you.
I genuinely wish you were right, but you are so naive it is frightening.
> The amount of FUD spread about it on here by those working in Adtech
You are confused. You are arguing with people that want to protect privacy. The EU demonstrably is not doing that, as WhatsApp gets ever more de facto mandated by the day.
This a variant of the provenance scheme: C2PA its implemented by all major Camera maker, and Google it seems, Apple support it with 3rd party apps on iPhone, but they have something called "Apple Reference Image" brewing.
Personally I think there is a good argument for being able to distinguish AI generated image and video...
> I think there is a good argument for being able to distinguish AI generated image and video...
Neat but that's not what's being built here. What's being built is "we can trace back this content to who made it" which is bad. Doesn't matter if today that it's limited to AI generated content. Won't be tomorrow. Your devices should not act against your best interests. No cop in my pocket please.
No - there is a huge difference between "this AI created this image" and "this user did it" - the first we need more of, and the second is a big privacy concern. The article does not say anything about identifying a user.
A guid isn’t a user id, if it is in this case, it’s an abuse of how guid is used, at least colloquially. I haven’t read enough to understand if it is user / machine id, I.e. only globally unique in the sense it’s a globally unique entity identifier.
Exactly. Forget the AI aspect, this is entirely to identify users for any purposes they deem necessary. People are ignoring the surveillance state aspect of this. Reminds me of the device id debacle they have attached to their outbounds Windows network calls
While it does make a difference, their willingness to quietly integrate watermarking features into what people saw as simple apps for doing simple tasks is unnerving. It only takes a small change for them to start baking your identifiable information into all images they edit, or some government politely asking them to do that.
I wonder if in ten years we'll have a horrifying world where everything that leaves a machine is imprinted with its permanent identifier. Every file comes with a verifiable history of who created it, what computers it passed through, who made edits. We're closer to that world than we think.
There is a certain convergence of wills here: watermarking AI products on the one hand, and infusing AI into everything on the other hand. When you layer generative AI into Notepad, once just a raw text buffer, then you’re setting the stage for watermarking everything because AI touches everything.
We already live in that world, and the sky hasn't fallen so far. Even in the worst case scenario, the world isn't going to be as horrifying as the alternative, because people react to the proliferation of scams, they will not keep falling for fake impersonation for the 10000th time a row. In this scenario, we simply will stop taking factual-looking images at their word in the same way how you don't take any piece of writing on the internet as factual, verifiable truth. Journalism will rely on a person vouching for their images with their reputation, and images with unknown sources will be looked at with suspicion.
I am not willing to pay the price of sending every bit I create to some megacorporation's server or stamp it with my only identity so the computer can tell me what's AI and what isn't. Especially not while the average quality settles into an uncanny valley that's often discernible with the naked eye, both for text and images.
Printing (even text) is also a risk: It's very likely your printer is secretly adding marks to the page that contain its serial number and the current timestamp. [0]
Meanwhile Microsoft (and Apple) have "telemetry" harvesting those serial numbers of all internal and external devices you've ever had connected or reachable. Then they link them to your MS/Apple account, IP addresses, and the extended social-graph of all computers that were ever in the same room or shared the same bluetooth speaker.
In short, your "anonymous" flyer critiquing The Regime and depicting Dear Leader as a clown could lead thugs straight to your door. Or to the door of whomever you're staying with.
and then in few years a new mono-mustachioed or mono-browed leader will emerge who declares memes a blasphemy punishable by death and will call up all the telemetry gathered to punish all involved.
"I don't worry because I have nothing to hide, based on my perfectly accurate perception of today's political and legal forces in my state and nation which will stay safely static forever."
You know a certain dictator denies access to the country they control based on whether visitors "like" them? They use a private militia, funded by stealing from taxpayers, in contravention to that country's laws, to target citizens who are not supporters of them. Some of those citizens get shipped abroad to foreign prisons by these militia. Others get shot in summary executions in the streets - the controlling regime covers it up with false media reports, and uses corrupt judges to evade scrutiny ... a certain software company support that regime, even acting against foreign scrutiny on their behalf.
Essentially all of that country's businesses that are close to the regime need to be considered hostile.
We don't need to wait a few years, the revolution already happened; the insurrectionists were freed. These companies paid their tributes, in dollars, to the regime.
Maybe next ML will be integrated into software suites to enforce that regime's lies? Most Western governments use such software, the distributers of which have already shown they'll act in the regimes interests against supposed allies...
I had assumed parent-poster was making a sincere but humorous point, as opposed to sarcastically dismissing the risks of a change in management, but I suppose it's ambiguous.
> It's very likely your printer is secretly adding marks to the page
It's most likely how the FBI caught NSA leaker Reality Winner:
> Both journalists and security experts have suggested that The Intercept's handling of the documents, which included publishing the documents unredacted and including the printer tracking dots, was used to identify Winner as the leaker.
Yeah - these criminal agencies use this to protect their billionaire buddies on top. The Epstein network must be really huge. I always wondered how one or two person can meta-coordinate +5000 underage girl and their +10000 customers. That never made any sense to me, yet suspiciously enough only Ghislaine is in prison. That does not add up.
You don't need reverse engineering if it's publicly known fact for 20+ years, telemetry just identifies you. 20 years ago, you would need to find the printer.
>Then they link them to your MS/Apple account, IP addresses, and the extended social-graph of all computers that were ever in the same room or shared the same bluetooth speaker.
Did it get revealed that Apple did that? This is news to me
Can this also be weaponized? Get an innocuous image from someone you don't like, grab their GUID, add it to another image, sent it to the thin skinned politician in power.
It depends on which version of GUID it is. Only version 3 and 5 are hash based. The other versions are random, time, and/or MAC address based. Version 3 uses MD5 and its cheap to get the same hash for different images: https://crypto.stackexchange.com/questions/1434/are-there-tw...
Why would they need to subpoena Microsoft and why will Microsoft hand them the data if someone doesn't like my meme? I understand what you are trying to say but it does not make a whole lot of sense even from Microsoft pov. They are not bound by law to hand over personal data to anyone without a warrant issued. If a warrant is issued then it is their lawful duty to give that data, the same would be done by you if you were in their shoes or your office or your family. Law is not optional to follow. But Microsoft doesn't need to do watermarking on memes to track you or to do this as a war against "internet anonymity".
I would say the watermarking is not really a puzzle piece at all when it comes to the surveillance state, which was my point. They don't need watermarking to know who you are or to get information about you. So why would they work on this really visibile method if their intention was to progress the survelliance state? Microsoft with all their resources (and assuming it is an evil corporation purely acting from the state's interest to spy on you) will use this to track you?
You can incentivize cooperation without having to compel action with a warrant. This sort of corrupt quid pro quo is quite common, in other countries at least...
I was forced to create multiple as part of the mojang migration - truly a nightmarish experience to use their AuthN, haven’t seen something quite as bad since
Nah I sunk many thousands of hours into these accounts; definitely not a small cost.
Sure I could get a new account and pay twice for the game I already purchased multiple times - that would’ve ground my gears too
I think the new account would have to be a Microsoft account also, so you wouldn't have even gained anything by not migrating.
Some servers allow joining without a Microsoft account even these days, but probably can't play on any of the servers you regularly play on, if you don't have a Microsoft account.
A few months back, MS incorrectly tried to stamp a Copilot "watermark" (just an auto-added note) to any and all Azure DevOps commits, regardless of whether an LLM was actually involved. They removed it after a lot of github issues were submitted to the source of the issue which was a VS Code Copilot extension.
MS has been very sloppy in their implementations. I would recommend against using Paint or any other LLM enabled app they use as a result. Things may be getting incorrectly stamped.
They have only themselves to blame for this. They've spent decades developing technology to spy on and micro-regulate what their captive customers can do with their property. Now that they have this technology, it's only logical that they be held responsible for misuse.
The only (and inevitable) solution at this point is for big tech to get micro-regulated like the banking industry. The same mindless greed that drove them to take control away from their customers will be responsible for the same control to be taken away from them.
Be careful what you wish for. I'm sure Microsoft and Google would love the kind of regulation we apply to big banks. It has become a moat that makes it impossible for other (snaller/foreign) financial institutions to compete because they don't have massive specialized regulatory departments.
The more complex the rules become, the more difficult it will be for alternative providers to exist, unless they have explicit carve outs. So far, with age verification and user id laws, there doesn't seem to be much appetite from politicians to create exceptions for open source and smaller projects. By comparison, in the US the regional banks have special exemptions for many of the really onerous regs, which is why they are still a bunch of them.
You don't think that regulation would require everyone to embed watermarks and guids to make sure that nothing objectionable is being generated or created?
This has nothing to do with generating harmful content and everything to do with fascist surveillance. This is an OS level functionality that get utilized before AI even existed.
Microsoft is still the best Indian OS manufacturer. And as such, it's forced upon people throats by corrupt Indian IT department heads, so a few non Indian people who actually care don't have a choice.
"privileged take"?, sorry I am not from the US, so I don't compete in the sorry-o-lympics.
Nothing is stopping you from using it for free at home, everyone is privileged in that regard.
And it was obvious to everyone else, I was talking about decisions you can take yourself. I'll try better in the future to be hyper explicit about this, so people who are looking for a reason to feel hurt will have a harder time.
If you work at a company and it's a company device, then its not your privacy to worry about - you don't use your work device for personal matters, and the concerns are someone elses.
IBM, SAP, Capital One, GE, Cisco, Intel, Deloitte offer a Mac/Windows choice program. Better than just one choice, and arguably a bit better of a privacy record than MS (especially of late)
I had this trigger the other day incorrectly and went and installed Paint.net. I pasted in a screenshot I took and just wanted to resize it. I got a banner saying it was made with AI and would be updated to reflect that.
I guess it shouldn't be surprising if an application called "paint.net" can determined if AI was used when connected to the internet. (I have used Paint.net more than a decade ago).
I was stating that MS Paint mis categorized a Print Screen screenshot as AI generated when pasted. Which pushed me to install PaintdotNet onto my laptop instead.
> mis categorized a Print Screen screenshot as AI generated
Maybe. Question is, was that a false positive, or merely a bad user-facing message?
Assuming you didn't have any AI-generated images caught in the screenshot (e.g. some advert - plenty of those even in Microsoft apps like Weather, nowadays), what if - and I'm speculating here; I don't know if anyone actually does it yet, but it's so obvious they eventually will -
- what if parts of your screenshot already had an invisible watermark on it, like the ones for tagging AI images? You can imagine an app rendering its window to texture, and embedding a watermark on those pixels before sending it over to the system compositor, and the reasons have nothing to do with AI.
Watermarks are DRM tech. "AI generated" is just a specific kind of metadata that can be put in one, and a huge red herring for discussions.
It's only a matter of time before we'll need to have software for detecting and removing real-time watermarks from display output at OS level. (Unless, of course, platforms decide to add app window live watermarking as a "feature", and given the story with remote attestation, I think it's more than likely.)
I admit it’s a while since I’ve used windows, but it’s such a shock to hear that MS Paint isn’t just a point and click pixel coloring app anymore. It seems like they could have left it as a pure “paint” app and added the fancy stuff to some new image editor or something.
I guess they’ve optimized their workforce to just keep making changes so they get promoted rather than just creating really good software.
If you read the article instead of the headline…….. it’s adding a fairly standard mark to AI generated images to let’s others know, in the same manner a giant swath of the GebAI industry has agreed to.
That's just nostalgia. Why do we set the bar at windows XP paint instead of windows 1.01 paint which was different? Probably because winXP paint is the one we grew up with, and also the best version. But if we said no new features ever, we'd be stuck on win1.01 paint. The best version of Paint was a complete UI redesign away from the original.
I don't think adding an identifier which can most likely be mapped back to user is "standard mark".
It doesn't explicitly say it, but there is hardly any other reason why it would add server generated ID (from authenticated session) to the saved file.
We've probably lost the fight over GenAI marks, at least for now, and I do understand the need for them. However the same technology that can embed an invisible watermark that survives a round of photographing, printing, crumbling and scanning back - can be used to embed more information than just "it's AI generated". Encoding GUID is just a harbinger; as a next step, why not encode the app that produced the image? Also a hash of its license key? Hell, what's stopping an app from doing it itself, watermarking its own window before passing the pixels to OS for compositing?
EU law requires the mark. Did you know about the level of the “so many levels”? If such a large market requires behavior by law, and quite reasonably so, it’s also quite reasonable to mark AI generated content as such.
All the slippery slope nonsense on this page has failed so many times it’s not worth debating. If you don’t like this tool, use another. When they embed your social security number and face and address in the mark get back to me.
I wanted dark mode, tabs, and autosave, and now I don't have to use a different app to get those, so that works out great for me. Not sure what "breaking changes" even means for that though. Did it suddenly stop being able to open text files? No, it still just works.
That's a really fair point, but i'm not sure if that's what they meant by "breaking changes" if that was followed with "autocorrect, rich text, and Copilot"
"Breaking change" is a pretty common term, especially here, so I don't get the confusion about what it means. It means an interface-breaking change, so that the same input produces a different output, and is generally to be avoided because it forces the user to have to adapt and means the new version isn't strictly better[1].
The inclusion of autocorrect (that I mentioned) would be example here: previously, it would accept whatever text you gave it verbatim. Now, it will sometimes change non-dictionary strings to dictionary words.
(Another thing that bothered me was that, on the update, it forgot my font settings and I had to work to re-find them.)
I'm happy to admit my phrasing was confusing, but not enough so that you would be unable to see the relevant failure mode.
For a long time I used metapad as a notepad replacement https://en.wikipedia.org/wiki/Metapad (I even renamed the exe to notepad). Very fast and minimal.
It automatically saves and reopens whatever you previously pasted in there. Quite a shock the first few times it happens. It's not a safe temporary holding area anymore.
Yeah I switched to Windows 11 recently and was a little annoyed by that - Notepad was always a place to paste formatted junk to get the plaintext - I don't need anything persisted.
Someone got their use of child porn leaked this way. They opened notepad on a twitch stream and a bunch of CP links came up. I don't remember who it was.
He still streams on Twitch, he got a temporary week "long" ban and then came back claiming it was a virus or an accident while also claiming he has a porn addiction problem... but don't worry he's very "sorry" (to have been caught).
The state of this Amazon-owned streaming platform is wild... and that's without even looking at the rampant antisemitism (their second top political streamer, Hasan Piker, currently has a bipartisan US House resolution (H.Res.1239) in progress calling him and Candace Owens out for their antisemitism), repeated call for violence (their top political streamer, Asmongold, was recently banned for a few days for calling for the murder of immigrant's children by ICE) and the repeated reckless/distracted car and even truck driving streams with some even leading to accidents (luckily enough without any deadly one... yet).
All these are against Twitch rules, but the staff and even the CEO (who cosplays as a streamer) selectively apply the rules and unban the streamers who are under contract with Twitch or are well connected with the staff.
I have no idea why Amazon or Twitch shareholders have not cleaned house already (e.g. ousting the CEO and the people in charge of the moderation), especially considering the fact that even with all these transgressions, Twitch isn't profitable after years of activity.
They are waiting for someone to actually die I think, with clear links to Twitch... if that ever happens there are plenty of evidence that Twitch and Amazon know what is going on and barely does anything about it.
You definitely shouldn't assert that someone is antisemitic based on the current US House, even if bi-partisan. And I thought bills of attainder were unconstitutional?
To answer your question of why, it's probably because they make money.
There are plenty of evidence of Hasan Piker's antisemitism to the point that people have been collecting and contextualizing them: https://whoishasanpiker.com/antisemitism
Also plenty of groups fighting against racism and antisemitism have come out against him (ADL, AJC), it's easy to Google.
That House resolution is just the latest good indication that it's not just some isolated incidents.
Piker's only answers are that he's taken "out of context" or that he's "joking", there's literally no context that make his public statements better or less antisemitic though, if you have any I'm interested. He also publicly voice his support to groups that are openly antisemitic (Hamas and Hezbollah) and recognized as FTOs (Foreign Terrorist Organization) by the US government.
Now, it's his First Amendment right to be this way but Twitch/Amazon share a responsibility when they platform this content, and even more when they apply moderation selectively, in my opinion that should forfeit their Section 230 protection. They are deliberately shaping the discourse on their platform by permanently banning other streamers with opposing views and never taking similar actions against Piker.
EDIT: Regarding the bills of attainder, it likely doesn't apply here because they aren't trying to punish these two antisemites specifically, they just use them as examples of the proliferation of antisemitic content on platforms like Twitch and want Congress to condemn this practice and encourage platforms to address the issue.
I only skimmed the first half of this list but I believe truth is an absolute defense to antisemitism just like defamation, right? You're really gonna say that "netanyahu is a jewish supremacist" is antisemitism, when it's well documented and probably relevant to whatever he was talking about at the time?
He must've really pissed someone off to get his own hate site. I think we all know who he pissed off. That hate site would be illegal in the EU btw.
You asked for evidence, I've provided plenty, with context.
Skimming them and picking one that doesn't fully meet your criteria, then call it a "hate site" and then use vagueries like:
> He must've really pissed someone off to get his own hate site. I think we all know who he pissed off.
Tells me you have no interest in engaging in this in good faith.
Also nobody cares if a website quoting someone being hateful would be illegal outside of the USA. Piker is an American citizen, spewing hateful antisemitism on an American platform... but nice attempt at a red herring.
Are you aware of the bullshit asymmetry principle?
When you cite a parade of bullshit I'm not obligated to refute all of it. A representative sample is enough to demonstrate that it's bullshit and that the bullshit asymmetry principle applies.
Yeah, I've been working around that for now by uninstalling notepad. Which actually uninstalls the store app, which in turn exposes the actual notepad executable that ships with Windows. Really confusing, and will probably break in some future version of Windows.
I don't understand why they didn't just stuff all the AI things and new features in Write, where it belongs…
I don't use Windows, but I have to say that TextEdit on the Mac is absolute crap. Literally every default is wrong. Text is too small, looks like crap, cut-and-paste always brings absolutely crappy styling with it, its autocomplete and autocorrect is bad and wrong and annoying. No one at Apple uses this application with any regularity and it shows.
Background removal is really useful though, saves a bunch of time.
Unfortunately, some of the regular paint tools like eraser don't erase in a smooth antialiased way and just end up looking jagged (also only a square shape for eraser...no eraser brush mode unfortunately), so it ends up being a better looking option (well, when it works properly, which it does often enough to be useful). For whatever reason a bunch of tools and transforms (scaling, rotating), just produce such garbage jagged looking results, it's not serviceable even for those basics.
It's been a "bug" for several decades now. Not everything was of shitty jagged quality in either 90s or 00s. Particularly when using some more capable image editors.
There's a bunch of smaller editors that don't have such problems, like paint.net for example. It's an arbitrary "limit" (accidental even) stemming purely from bad quality implementation of basic features, not from how basic that feature set is.
Again, even a "pure" paint app with very limited functionality can have it be implemented badly, and it has nothing to do with how "fancy" or complex or advanced of a feature set it has.
I've been using ComfyUI to do fine background and watermark removal. Might take a look into that as an alternative. Run Flux.2 Klein or Comfyui's own workflow.
Key point, saves a bunch of time. Copy, paste, click button, done in three seconds. The app is also just there, preinstalled. It's great precisely because it doesn't require "looking into" anything. Yes, there's a bunch of other apps and services, but that's all besides that point. It also works pretty much on any pc made in past decade and half without crazy gpu/vram requirements for a relatively miniscule task.
If you don’t mind CLI, rembg is a good option for background removal. It lets you swap between different models depending on the type of image so you can use something like `birefnet` for photorealistic images and `toonout` for illustrations.
It's a pixel-perfect modern clone (with some actually useful extras that won't get in the way unless you look for them), and yes, you can clone the repo and run it locally.
it is kind of interesting when you think about it. what utility does something like paint actually have? did it ever have any real utility? (icon editing?) it always kinda felt like a demo that came with early versions of windows that didn't actually do anything useful.
Used to be you saved and shared screenshots by pasting into Paint and saving it. Printscreen didn't save a file and only some programs (Skype) let you paste the screenshot directly from the clipboard. That's how I remember it anyway.
The utility of Paint is that lightweight software is an absolute fucking godsend (which, Microsoft being Microsoft, is on a mission to ruin). I have all manner of professional tools - Photoshop, Aseprite, Manga Studio, etc, and if the edit is something that can be done in Paint, I will use Paint over any of the others, because I'll be done editing before I've even managed to open the file in another program.
Xusheng here! I have not gone through all comments, but wish to clarify a few things:
1. The watermark only applied to AI-generated contents through the in-app AI (copilot/cocreator, etc). If you draw something by hand it is not watermarked
2. Privacy implications: I believe your MS account is linked to the prompt and the GUID. And the GUID is embedded into the image as both an insivible watermark and a file-level C2PA metadata. I did not write about this very deeply in my blogpost, but when I do an image generation, it deducts my AI credits (yes, MS gives you like 60 free AI credits), so MS surely knows where the prompt is coming from. Though I am not sure about their storage and retention, e.g., do they actually store the data, and if they do, for how long, etc
I get the privacy concerns, and we are right to expect Microsoft to say that this is what their tool may be doing. However, I fear that one day we will look back and wonder why we didn't do more to sign and preserve human authenticity. Having a stamp saying "AI manipulated" should be a part of digital lineage tooling.
I would be surprised that anyone is surprised by this. They've been making local accounts harder and harder now to the point of being impossible.
Anyone not deep in tech will accept the "think of the children" defense without much worry, and anyone who is deep in tech already knows that if you really want an OS that doesn't spy on you, you need to go to a *nix of some flavor.
That's nothing new. Ever tried to develop a driver? Or replace a system file? Or install an app on iOS not from the store? That war was lost two decades ago with the iPhone
The request is JSON and contains at least these fields:..."prompt": "..."
Local SD (especially the earlier versions) is already uncensored, so they're effectively crippling it with additional spyware that phones home to tell Microsoft what you're doing and asking whether they approve of it. IMHO the invisible watermark isn't the worst part, but rather the fact that MS is logging every interaction you have with the model, which doesn't ever need to leave your machine.
As another Linux fan, I don't. What Microsoft does to their users changes the overton window of what's acceptable in tech. Before you know it there will be a politician demanding that all software systems that don't implement such tracking will be outlawed and there will be no one left to speak up to you because they are all already used to the tracking so why should you get a pass.
This is gonna sound a bit harsh, but from the outside it genuinely looks like Microsoft is actively looking for new ways to degrade and humiliate their users. (And having no trouble finding them!)
The visible watermark toggle giving users a false sense of control while the invisible GUID persists regardless is the worst part. People who turn off the watermark think they opted out.
This reminds me that in the USSR they had typewriters that added an identifier somehow that could be traced back to that particular typewriter (and who it was sold to)
the GUID is the giveaway that it's not about protecting artists, it's about being able to prove provenance later. nobody embeds a unique id in a local file for the user's benefit.
It is quite likely that Snipping Tool is also doing this. Every camera also leaves device specific signature because of its inherent silicon sensor defects.
If you want to stay anonymous, don't share images you can't verify at the byte level. Apply filtering to decrease the low bit noise that could hide cryptographic signatures. Don't trust complex container formats.
These days entire scenes can be tweaked by AI to add unimportant but identifying marks, at a level far above signal processing tricks, like moving objects in the scene. Verify from multiple sources.
If Anthropic can manipulate text to add a watermark, what’s preventing providers from doing the same to generated images? Modifying the container format can’t protect you from a signature in the image’s visual representation, unless you apply noise to that (and know it’s enough noise/the right kind of noise to counteract whatever unknown technique they’ve applied).
Anthropic's watermarking technique is possible, and worryingly could effect low frequency choices (eg as I said, with object placement or style). However, this has to be a generation time decision, you can't really do that with a small edit. In fact small edits tend to be detectable spectrally.
Okay, there are watermarks on AI stuff, interesting, not good but everyone else already talked about.
My question..how does it work? Is it robust? I remember that young me hid data in pixels of png with simple stegonagraphy and it was a fun little project..but brittle. How exactly does the fingerprinting survive jpeg compression? Is it repeate over and over the images or is it just one area? If that one is pure black by chance the jpeg algorhitmen would erase it all no?
I'm pretty sure the robustness of watermarking has been a solved problem for at least 30 years, I remember visiting the mit media lab in the mid 90s and they were explaining how they could watermark digital audio by imperceptibly adjusting the acoustics as if the walls of the room the audio has been recorded in were changing distance relative to the microphone according to a wave function
There is no robust-without-qualifiers watermarking. There is only robustness against common operations but as soon as someone is actually trying to remove the watermark they can at the very least use exactly the same technique to embed random noise instead to overwrite your watermark.
Interesting find. Overall it makes sense from a deepfake-fighting perspective and EU requirements. But what's concerning is that users aren't really told about this, as far as I can tell. Would be cool if someone checked if it can be bypassed, like swapping the DLL or intercepting the API call. But yeah, it's another step toward every digital trace becoming personally identifiable...
People worried about other people tracking them while using local stable diffusion models built on fraudulently obtained training content, to produce images which cannot be owned. Thug on thug violence.
Obviously it's bad and we can all say "fuck Microsoft" once more, but "we" probably don't use Windows anyway, right? I have no idea, really, but if you willingly use closed-source spyware that is notorious (for AT LEAST 15 years) for all kinds of invasive telemetry it forces upon you, you probably wouldn't find this new piece of information concerning anyway.
And ironically, I think that this one is kinda fair. I mean, you specifically asked your software to generate whatever pseudo-random bytes it wishes to loosely based on some text prompt. It did that. Now, apparently, these pseudo-random bytes turn out to be personally identifiable. So what? I suppose they didn't claim their PRNG to be cryptography-grade. They could even make it seem like an accident, should they be bothered to. Make it way less obvious.
Now if it would insert watermarks on save (like printers do), that would be really outrageous. But when you trust software to produce "whatever", you probably shouldn't be really mad about it doing anything more than you asked to.
Microsoft is in a pretty good position to do something that can be valuable to certain institutions.
Imaging every pdf file, every image, every office documents, and every video has a hidden record of the associated Microsoft accounts of all computers it has ever passed through. This should sell well, and realistically nobody can stop them. Why haven't Microsoft done this much earlier?
It's both and the main reason why anti-cheat is needed is the central matchmaking model, which is itself a form of DRM. If people were still hosting smaller community-moderated servers there would not be a need for invasive anti-cheat but people could also pay on cracked servers without paying.
I have the same issue on Windows 11. It's been bugging me to press a button or "check my drive" on every startup for at least half a year, no matter how often I let it run the check...
Why have you linked a bug report for a niche userland application that may be causing disk corruption as evidence against linux reliability? That seems like a pretty uninformed conclusion.
This supports my initial reply. This was an f2fs bug in a bleeding edge kernel released only seven days earlier. The thread suggests perfectly reasonable mitigations, especially for an arch user: use the lts kernel or downgrade to 6.8.9.
If you're not familiar with linux and/or don't want to deal with trivial issues periodically, don't hang out at the bleeding edge. There are plenty of boring and/or beginner friendly choices out there.
I'm not saying linux is perfect, but your conclusions in this instance appear to be uninformed rather than supported by the facts.
Ok fair point, here's plenty more of the same on stable. My point is Linux is always fine right until it isn't. Then you're back to a day of debugging your update.
Most of these links weaken your claim rather than support it. The lkml links are patch submissions in a _development_ discussion, not ordinary users running a stable distro. The f2fs bugzilla links are the same issue we already discussed, a regression in the brand-new 6.9 kernel released only days earlier, with the fix landing in 6.9.3. The suse bug is an upstream e2fsprogs issue. This is precisely the kind of issue distro package maintainers can catch, patch, or avoid before it reaches ordinary users on a stable release. The launchpad link is another development discussion, not an example of ordinary users experiencing a bug in a stable release.
Linux does experience regressions, but your argument conflates upstream development, bleeding edge releases, and stable distro releases. Those distinctions are fundamental to how linux distributions work, and these links don't support the claim you're making.
>Most of these links weaken your claim rather than support it.
Yep. Good catch, I think you win the argument. These are all distros that are under development and their underlying issues should never be called-out as handing the user frustration as they willingly chose to become a victim of the kernel.
Do those users use the OS that randomly takes hours to shut down because it desperately needs to install updates right now - and then it won't shut down at all and reboot instead. And even if it doesn't do that shutdown takes ages and you need to attend it and can't just walk away because the OS will drop you in a logged in desktop when some random application decides to interrupt the shutdown process.
Essentially any Linux distro protects privacy. You'd kinda have to go out of your way to find one that doesn't, because there's no online account connected to your install for any of them.
If you're reasonably technical, you can make nearly any use-case work on nearly any distro, but if you have choice paralysis, my top recommendations would be CachyOS if you plan to play games, and Mint otherwise.
Personally I'm happy with EndeavourOS. I picked it to find a general purpose distro similar to the Steam Deck (KDE and arch based) but with a more user-friendly installer.
Pretty much all of them. None require online accounts or anything like that. Browser choice is probably more important.
For something that just works I recommend Fedora or Ubuntu. It's what I'd put on my mom or wife's PC.
Currently using Omarchy on my laptop though which is a tad more exotic, it's Arch + Hyprland and is pretty polished for that stack (at least the current version, 4.0) but still a tiny bit of jank.
> Some say "i do nothing illegal" "have nothing to hide".
I hate how pervasive this argument is. I'm so tired. Sometimes I wish they'd get the total panopticon they want so much. I'm sure the government will be able to find some crimes to hang them with.
When people claim they have nothing to hide, always point out that's not up to their determination. That freaks them out, it disarms their shrink-from-confrontation move.
And you can point it out super fast, in a plain six word statement. No need to launch into a deep discussion unless prompted.
Alternatively, simply respond with: yes you do. When they reply: "what?" - "every single thing you have ever done wrong across your entire life." Everybody has done something they would prefer to keep hidden, the cowards just lie about it.
I always say, "okay, unlock your phone and give it to me for 30 minutes". of course they refuse. "so you don't give your phone to a friend for half an hour, but it's fine if the government and intelligence agencies spy on you 24/7?"
Scanning the comments, I see some curiosity and outrage but little recognition that this is legally required in places like California and Colorado and Texas and probably some more places.
And federally, the C2PA strongly encourages digital providence albeit without legal consequences... yet.
All AI content coming from companies that service the US market are watermarking things.
Use free software. Proprietary software is used by its owners to control you. This is nothing new, just another example to add to the countless ones we already have.
Thanks Microsoft, for adding my signature so I won't have to claim authorship when it ends up in a museum in 200 years, and the NSA archives are declassified for art historians filing a FOIA in 2226, who find out, "yep, it was from his PC."
No, I wasn't suggesting that. I was saying that if there was digital art (human made) aesthetically significant that a curator would want to display it in a museum, Microsoft's GUID supplied to a data collection agency would make it possible to retrieve if ever/whenever that data were declassified (assuming it isn't purged)
It's possible a very bad curator with a terrible taste in art might select slop to display, but I was refering to "fine art" or at least finer art that is digital.
Microsoft quietly embeds a hidden tracking identifier in every AI-generated image you create using Paint or Photos on Windows.
A researcher discovered that these apps embed a server-issued GUID (a globally unique identifier) as an invisible watermark in locally generated AI images.
The watermark is tied to the prompts you type. And since those prompts are associated with your Microsoft account, Microsoft could "theoretically" trace any watermarked image back to the user who created it.
This is recycling an idea from the 80s. Back then, laser printer manufacturers added tiny yellow dot patterns to every printed page. With this, they could identify the printer.
Now Microsoft has brought the same idea to AI image generation, and added it to two of the most widely used default Windows apps.
Microsoft had disclosed its AI safety measures in official documentation, but the practical implication, that your output image file carries an invisible fingerprint linked to your identity, was never clearly mentioned, of course.
The researcher found this by reading Microsoft's own published documentation and analyzing the watermarking mechanics.
AI watermarking is a requirement by law in the EU. But "this image was generated by AI" is different than "this image was generated by AI by Mr. Winston Smith".
For anyone who values privacy, this is something to worry about. If you generate an image locally, on your own device, why should it carry a tag that can identify you to the company whose software you used?
But then, anyone who values their privacy won't be using Microsoft Windows anyway."
Since the cat is out of the bag, I wouldn't be surprised if Microsoft generates an invisible watermark for ALL files and not just AI generated ones. The real story is that since AI watermarks are possible, there is no technical barrier to them adding personal EXIF metadata to a file where it can't be seen, removed, or decrypted, whether it is media, a document or other file.
Interesting. I really didn't think watermarks would end up going anywhere, but maybe with enough adoption we can have easy ai generated content flagging after all?
It actually might make the new horrible world even worse. Imagine the populace getting used to a AI image detector flagging things as fake using this fairly easily defeated GUID marker system. Most people are just making memes or cat videos and don't even try to remove this so eventually the populace starts to believe these things actually work.
Now some one slightly more sophisticated starts creating deepfakes of a woman and uploading them or fabricating video of an political event without this marker. The subject protests it's fake and AI generated but a loud majority of ignorants feed it into Microsoft AI detector and call you a liar and say it's confirmed real. Most people don't know any better and eat it up because a computer said so.
US Social Security Numbers are a useful analogy: The designers knew they weren't something anyone could securely depend on, and told people not to do it... but companies did it anyway, for their own convenience and cheap security-theater. Ultimately a lot of individual victims suffered for it.
It would have almost been better if one big incident blew the "knowing an SSN means something" myth apart early on.
This muddle of an article makes it totally unclear to me if this GUID is attached by the AI generation call or every image I edit in MS Paint. I'm going to assume the former unless they release a clarification.
Edit: Actually trivial to test, just save an image of all black and see if it suddenly has other values on save.
Assuming the watermark works like the upcoming AI watermark for text, then it uses the content's entropy to embed the information. An all-black image doesn't have much entropy, so it's unlikely you'd find anything.
Don't use them if it does not fit your requirements. The last ten years I am more that happy with Lazpaint or Libreoffice Draw. The last year I have added Imglass to the mix.
With regards to Microsoft being ... uhm ... "transparent":
> The same page says that generated images:
> “will contain C2PA manifest helping users identify that it is an AI generated image.”
> [...] That is a meaningful disclosure of remote filtering and C2PA metadata.
> C2PA manifest contains a GUID identifying the invisible pixel watermark
> Calling the feature “Content Credentials” is accurate, but it does not
> make this prompt-associated identifier obvious to a Windows user.
I don't think this is accurate, because without that detective work, most
people would have no idea that Microsoft tags and tracks the images here.
This reminds me of printers printing identifiers to ID individuals. What this
to me means is that I can no longer use any such Microsoft services, because
there is no trust for me here. Microsoft sniffs on me, if I were to use these
software products. AI is a big spy-op too.
Microsoft could easily admit "we watermark all your images, whether you like it
or not", but corporate speak forbids this and they don't really admit to it.
They do not use the word watermark officially, but their .dll names reveal it.
That means they resort to deceit and propaganda.
It really is time to strengthen the whole open source ecosystem. I no longer
want my taxpayer's money to go into traitorous US companies that abuse EU
citizens here. (Note: the same would apply to EU companies, but the USA dominates the software sector, unfortunately. This also has to change permanently.)
With every new thing Microsoft goes trying so hard to come out as the good person, but they just cannot help themselves but to inject their evil. It had to be changed with Nadla coming, but their enshitification is just keeps getting worse and worse. What on Earth is this.
Misleading title IMO... here they are using "locally generated output" to specifically mean only AI-generated images, not your "500hrs in MS Paint" hand-made masterpiece.
Until proven otherwise via open-source audits and reproducible binaries, you should assume that all commercial photo editing software is embedding watermarks in any way they can get away with. This includes the professional software that you pay quite expensive licenses for. You should also assume that even if they're not today, they will eventually be coerced into doing so, in the same way that printers embed tracking dots.
You should however not accept this state of affairs even if you exclusively use open source software because the next step is that it become illegal to have photo editing software that doesn't include the tracking information needed to protect the children, fight terrorists or whatever the boogeyman of the day is.
I'm honestly surprised they don't upload the entire image to apply the watermark server-side, to the point that I'd like someone else to repeat this investigation and confirm it's not happening.
Shipping the watermark generator on user's machine would make it very easy for someone motivated to find how it works and write a "watermark remover".
Ya know, this would probably be pointless but if I were a programmer (I'm not -and refuse to be a vibe coder) I'd probably just grab appropriate libraries and make my own replacements for this shit. GLTK+ (?) is an obvious choice to use for recreating mspaint, and to replace notepad -I was told making a simple editor was an excercise they have you do when you learn programming to begin with?
I already replaced the 'solitaire' games suite with pysol running on WSL2 and it's a vast improvement!
tldr -if MS is going to screw us, why don't we mitigate it by using replacements?
Presumably the OP is proposing something like a TPM attached to the image sensor that signs the sensor output or something like that. You can’t sign it because you can’t get the key out. The key could be per-camera and be a published list.
I suppose a dedicated fraudster could still stage an appropriate scene. An appropriately lit matte image might even suffice.
That's assuming they don't just have a backdoor inserted expressly for this purpose. Now only the rich or powerful can produce an "authentic" recording of an event and the same system can be used to hunt down whistleblowers and political enemies by looking up who bought the camera.
At the very least there is always the analog hole where you point the camera at a sufficiently high quality screen. The sensor can't tell whether the light it receives was emitted by sunlight reflecting (and refracting) from someone's face or by a bunch of LEDs pointed at the sensor.
Keys could be stored in something like TPM on Camera, and could sign the image. The key could then be verified from the camera itself to prove the authenticity of the image.
If we as a society deemed it necessary, the camera manufacturer could also provide a list of keys for devices they have manufactured. And an image/key could be provided, and the manufacturer could verify the authenticity that way.
The TPM signing could be tied into the sensor hardware itself, making it difficult, but not impossible, to sign arbitrary images with the TPM.
The point of the key (as the for some reason dead comment points out), is not to prove who took the photo, but what device took the photo. Just as if someone stole a hardware token with a PGP key on could impersonate the owner. The key itself doesn't prove a person, just a device.
If a key was reset, a revocation of the original key could be issued, showing that the key was associated with the device for this particular time span. And then the new key registered.
This is ripe for abuse though, so resetting a TPM might not be accepted for this use case. I'm not certain in which case you'd want to reset a TPM for this use case though. Unless you took enough photos with the device to risk a birthday attack if you were using something like ECDSA.
If the TPM signs the original image taken by the camera, then even the slightest image processing on another device would invalidate the signature. Routine changes like cropping, scaling, converting between image formats / quality levels, or applying image filters would invalidate the signature.
An adversary can manipulate the date/time settings on the camera and forge evidence to frame someone. "This cryptographically signed photo, with timestamp, proves that you were here at this time!"
And camera sensors can get damaged and need replacement. But if replacement of the TPM-and-sensor chip is allowed, then you can just as well replace it with a sensor from another camera. In which case a signature from a specific TPM+sensor doesn't prove that a specific camera took the photo, at best it might be evidence that a specific camera model took the photo.
If the manufacturer will happily ship a replacement TPM+sensor for a specific camera, someone can fraudulently claim that their sensor is broken and be given a new TPM+sensor for the same camera. And there will now be multiple TPM+sensors in existence that have the same key. Since this module can be switched between cameras, there could be multiple cameras that signed a given picture.
To ship (identical) replacement TPMs, the manufacturer would also need to know the private keys of all the cameras, so the manufacturer could forge arbitrary signatures at will.
Finally maybe the manufacturer doesn't want to deal with the above problems and decides that repairing the camera's TPM is not allowed after all, or that only the manufacturer is allowed to repair a camera, but then they may be in violation of right-to-repair laws in several jurisdictions.
If C2PA and similar signature systems ever become a meaningful authenticity signal, they will create huge incentives for someone (potentially a state actor) to hack at least one camera in order to sign images of arbitrary provenance with its private keys. This will in turn inevitably lead to the same game of cat-and-mouse we have seen play out with video DRM schemes, where keys are regularly extracted from exploitable devices and used to decrypt as much content as possible before the device gets blacklisted entirely (harming all legitimate owners in the process).
I've done this btw. I went for the Pixel Camera app since they were the ones bragging the hardest about their "security". Writeup + PoC should be dropping some time tomorrow. Despite 90+ days from initial report, it remains unpatched.
I don't think that that's a good idea, because it implies trust when there actually isn't any.
Being signed with something just means that whoever has that key could've done that. That might be the owner of a specific camera, but it might also be the camera manufacturer, anyone else in the supply chain, or anyone who dumped the key.
Imagine fake evidence signed with the same key as your camera uses being used in court against you. And the court believes it because it has this signature attached and those computers are very secure and all.
Exactly that will happen. Not widespread, of course, but it will.
When I was in photography class in college, I created backplates in photoshop for still life portraits of small trinkets I was photographing. The photos were taken on black and white film and developed in the campus dark room. Led to some impressive photos. In our class's critiques, I explained how it was done. A lot of peers went from impressed to meh'd. The point: the black and white film laundered the new-age manipulation, and a digitally signed photo from a modern camera remains vulnerable to the same premise.
"I think it would be nice if all pens added a unique isotopic tracer signature to their ink. You could tell exactly who wrote everything."
"I think it would be nice if all typewriters had their unique fine-detail type artifacts registered with the government. You could tell exactly who authored a given document."
I think it would be nice if you took these ideas back to Stalinist Russia where they belong.
No. You'd only ever be able to show that key material belonging to $specific_camera was used to sign/mark the image.
Was the camera manufacturer breached? Did somebody on the factory floor steal some keys during the provisioning step? Or did somebody build their own photo-sensor simulator and plug _that_ in to the camera's motherboard to feed it a "real" image? Before going _that_ far, just point the unmodified camera at a sufficiently high resolution display...
In the imaginary dream world that Adobe, Google et al live in, the final file does indeed have a signature.
Each piece of software in the chain must use TPM-like technologies (yes, even GIMP) to make sure it's running a "legitimate" build of the software, on "legitimate" hardware, and re-sign the file at each step along the way (using keys provisioned during some flavour of remote attestation flow, or using a RA-authenticated remote-signing oracle).
The final file embeds every preceding manifest, so you can "verify" all the way back to the original.
If this all sounds patently unworkable, that's because it is.
OK, but given that GIMP is a general purpose tool, what use is the signature if all of them verify it, when I can drastically change the image to whatever I want it to be?
The manifests at each step can embed a thumbnail (although this is optional, iiuc!), so looking at the thumbnail history it should be obvious that the edit was significant.
Injecting hidden GUIDs into local files without explicit user consent is a massive privacy overreach. It makes you wonder what other local tools are silently tagging user generated content.
https://en.wikipedia.org/wiki/Information_Awareness_Office
The question is whether LLM providers are going to do this. Anthropic currently says they don’t, but it’s impossible to verify:
> Watermarking carries no identifying information and can’t be traced to a specific person, organization, or chat;
https://www.anthropic.com/news/claude-text-watermark
Probably just means they haven't (yet) figured out how to do the watermarking carrying enough bits of data to encode a GUID.
It could also mean they are lying. It could be they are being forced to downplay how good the watermarking is because gov agencies want that tool available to them without people knowing about it. We'll have to wait for the next Snowden to find out.
In other words, plausible deniability. “We aren’t watermarking your text.” (Today, and we’ll start tomorrow.)
I still don't see how this is supposed to work for text content that I copy and paste somewhere else. And with models getting better and better to "human language", wouldn't the false positives also rise as "real text" is flagged to be AI generated?
I don't know either, and maybe it doesn't or can't work. But also maybe it does and can. I do not have any where near the expertise to know which is the case.
At least, according to the very trustworthy Claude.
Haven’t printers done the same thing for decades?
Oh that makes it totally ok then...
Not saying that, but at least that there must have been ample legal precedent that this is probably allowed.
No it's not ok, and most people are horrified when they learn. It's just a reality check that we've lived in a surveillance state for quite a while and it's time we take a stand. And a reminder that the government has done a good job of suppressing these realities from public awareness.
And? Where are we going with this whataboutism?
And it's a reality check that we live in a surveillance state. To a degree that most people find appalling, but the government is good enough at suppressing public awareness enough to cause an outcry.
It's also not whataboutism, the comment specifically wondered how else were being surrupticously tracked without our knowledge. This is a concrete example and I think many would be surprised such tracking also exists outside the digital realm.
Also why color laser printers refuse to print b/w documents when they run out of color toner since they can no longer print the yellow DocuColor tracking dots.
Windows GUIDs....
I am doing metadata auditing for government documents these days and there are UUIDs in lots of files going back a very long time. I have certainly seen them in PDFs and Word and Excel documents that long predated the current AI integrations.
Edit to add: I just tested LibreOffice/26.2.5.2 and it is not injecting a UUID into the metadata either for a ODT or a DOCx (2007) file. I do not have native MS Office available on hand to test at the moment. I do see these UUIDs in published government documents but cannot swear to exactly what step of the pipeline is stamping them. Definitely on files that predate the AI integration push by Microsoft.
Do you keep a list you can share? I'd love if there was a semi-authoritative list.
Your printer has been doing this for decades. There's an invisible-to-human dot matrix pattern that encodes things like model, serial number and i don't remember what else.
AI-generated text warning (I submitted - but did not author - the piece), but it seems MS Paint and MS Photos add both a visible (can be turned off) and invisible (cannot be disabled and happens silently in the background with no user notice) watermarks to photos that have been AI-manipulated, even when using a local model to perform the action. It's not clear if this applies to even things like using AI-enhanced background delete/remove, but the invisible watermark is embedded in both the image pixels and the image metadata, both containing a GUID that can be linked to the exact prompt that was used and the originating device/user (on Microsoft's end).
Obvious next step is to explore if you can replace watermarker.dll with a (signed) no-op shim or MITM the API call to at least use your own (nil?) GUID that isn't linked to your device/account.
In case it's not obvious, my bigger concern isn't "this image can be identified to have been generated with/by AI" so much as it is "digital yellow printer dots have been forced upon us, except they can identify and retrieve the exact user/device/time/place/document/etc", completely destroying any and all illusions of privacy left.
I'd like to know more about the GUID part and how easy is it so deanonymize yeah.
But if it's only on ai generation and not on all images it seems easy enough to work around that part? Still better than printers doing it no matter what you're printing.
The article says that once converted to BMP all the metadata gets removed....so on linux:
convert file.jpg file.bmp; convert file.bmp file.jpg
It says that about the C2PA content credentials metadata, but not about the modified image pixels.
Conversion from jpg to bmp to jpg is a lossy process, so it may obscure the watermarked pixels.
Sounds better to do postprocess filtering explicitly? For example, adding random noise with amplitude 1/255 (which should be as invisible as the watermark), followed by a smart blur that blurs more in directions where the colors are more similar (making the blur less obvious to humans).
But this is all moot really, if MS Paint is watermarking shit, it’s better to just use something else. Nothing from Microsoft is trustworthy.
or maybe add 3 lsb noise, then let local diffusion model denoise the image. (is there something like convolutional diffusion denoiser?)
If it works anything like synthid, it is more resilient than that.
> AI-generated text warning
This seems incorrect to me. Are you basing that on the use of bullet points?
There are several paragraphs where output looks very AI-like (and Claude flavored one at that), e.g.
> In other words, “generated locally” does not mean that the complete operation is local. Microsoft receives and moderates the prompt, then issues the unique GUID that Paint embeds into the locally generated image. Paint also sends the previous promptGenerationId as lastPromptGenerationId with its next moderation request, allowing successive requests to be linked explicitly.
> That relationship is important. C2PA calls this a soft binding: a value derived from, or embedded into, the content so that the content can still be matched with its provenance record after the file-level manifest has been removed. For a watermark soft binding, the value is the watermark’s content identifier. Microsoft cryptographically signed this assertion.
> After an AI result is applied to the Paint canvas, the available formats are still restricted to PNG, JPEG, GIF, and Paint’s own .paint format. BMP—the classic Paint format—is conspicuously absent.
Personally it didn't bother me too much.
I have some better options. Stop using computers, or if you use a computer, use Linux.
Everything is spying on us now. Literally everything. I recently downgraded my MacBook M1 to Sonoma to avoid all this AI privacy invading BS.
Some people are suggesting systemd is spying on you because of /etc/machine-id
Don't use it then, there's at least three other init systems...
> AI-generated text warning (I submitted - but did not author - the piece)
Took me a moment to realize you're saying someone else generated it, rather than you did.
How do they add a watermark to local llm content?
The AI aspect of this is a red herring. The real problem is that they're secretly adding in a unique identifier into every image you create. If somebody does not like your meme, they can just send a copyright subpoena to Microsoft to instantly get your full name, address, email, phone number, and any other data associated with your Microsoft account. Just like age verification, this is another weapon in the war against internet anonymity.
Does it trigger on non AI images? The post doesn't say so at least.
It does kind of say: The GUID is coming from the moderation endpoint, which is hit when you generate a local or cloud AI image based on your prompt. If there is no prompt, there is no endpoint, and likely no GUID.
Obviously Paint could have been watermarking prior to AI though, but this specific AI watermarking appears to be only that.
The fact that local ai image generation uses an online moderation API is a bit worrying too....
Why not just mod the app to not call this API?
Since the watermarker runs locally, you could also do the reverse: generate some porn with a different open model, then run that code to tag it as "Content watermarked by Microsoft Responsible AI"
Probably both so they can change what they censor without waiting for you to run windows update and also so they can collect your information (IP, timestamp, etc) to associate with whatever you did
I don't think they use a model that would run smoothly on most hardware that normal people use.
Besides, you need to sign-in and pay to use that feature. It's very obvious that's not local.
did you even read the article? you're wrong on all points.
Frankly, I only skimmed it. Now I see that "On Copilot+ PCs, image generation is local but prompt moderation remains remote".
I don't have a Copilot PC, but if you still need to pay MS to run the model on your own hardware it's laughable.
No, you don’t need to pay for using on-device models.
> address
Do not tell Microsoft where you sleep. IANAL but they are not a government or financial institution and do not have a right to that information.
Make sure you register mailing addresses with your credit card institutions in addition to your residential addresses, and make your mailing address your billing address so that you aren't forced to tell a thousand businesses like Microsoft where you sleep.
Windows 11 effectively forces users to register with a Microsoft account. Once that's established, all it takes is for an unaware user to fill out an e-commerce form and save an address for auto-fill.
> Windows 11 effectively forces users to register with a Microsoft account.
It takes zero effort to bypass that with Rufus, if you set up your own pc.
My comment was in regard to the average PC user. The kinds of folks who would never install an operating system and would likely agree to use Edge while signed in to their Microsoft account.
Microsoft has also been pushing hard for Recall and recording all local activity forever. Not impossible to imagine that anything looking like a home address “somehow” gets ingested in the telemetry.
A bypass existing is good, needing a bypass in the first place is still a problem.
A bypass existing is actually not good because that's how the frog is boiled. Ignorant users get an account while power user are placated for now. Then at some point the bypass is removed and when power users speak up they will be told shut down by all the drones with "you have needed an account for years, why are you throwing a fuss now".
> Windows 11 effectively forces users to register with a Microsoft account.
While it's definitely a dark pattern that I 100% do not agree with, Pro editions still allow you to do a local account. No need for the oobe /bypass command, still can be done through the OOBE GUI setup by selecting a Work/School account option then selecting Sign in options to then specify a local account to create.
This is broadly impractical for the average citizen. A scalable solution would be to make this sort of thing illegal.
> This is broadly impractical for the average citizen.
No it's not. Sign up for a virtual mailbox for $15-$25/month.
> A scalable solution would be to make this sort of thing illegal.
I'm posting this in the genuine interest of people being able to maintain anonymity from data leaks, privacy leaks, and in general not needing to tell businesses more personal information than is necessary to render services. This is in a country that has no protection of personal safety whatsoever, and any business data leak could mean life or death to average citizens who are being threatened by criminals, stalkers, and more.
It seems every time I post something of this flavor the same handful of you come out of the woods and want to make privacy illegal, and I'm not sure who you are trying to support.
I think they meant make what Microsoft is doing illegal?
or make it illegal to ask for address, etc. definitely a little more effective than mailboxes
Ahhh okay if that's what they meant, then yes, I 100% agree and apologize in advance.
I fully agree that businesses should not be asking for addresses. Non-financial businesses don't need to KYC in the first place, and financial institutions can KYC without needing to know where you sleep.
I got triggered because people seem to always want to come out of the woods and say "addresses should be public record" or things of that sort and I vehemently disagree in the interest of privacy, in a country where a stalker can just look you up, terrorize you, and the police will do nothing about it.
They (the ones wanting to make privacy illegal) are just the ones that want to develop the tools and consume the data for it because it'll be good for their resume or some bullshit, or they're just intrinsically broken humans.
> No it's not. Sign up for a virtual mailbox for $15-$25/month.
Did you notice that it's an affordability crisis out there? An absolutely enormous number of people are skipping bills, taking on credit, and using predatory lenders to make end meets, and your recommendation is to add another fee on top of things.
It's not practical or useful guidance for the vast majority of people. I strongly agree with supporting privacy, but this sort of behaviour (adding trackers, etc) to normal functions without a full disclosure and opt-out mechanism must be made illegal, otherwise we are just creating markets for "privacy preserving" technologies that are increasingly less likely to actually be effective for that purpose but sure do put on a good theatre of seeming that way.
At least in the US it's not even a good method either. Own a house? Boom, your information is publically available and you won't be able to remove it without a court order, which in most states is impossible to get. In most states, you don't even need to own a house, decide to vote? You information again is publically available. Tie your real name to a single account to purchase something, and you are trackable. Want privacy? You'd need to remove yourself from the internet, dump your phone, destroy your ID and work underground for cash. We can push against iot, and people have been forever, but at the end of the day the government will always they have a vested interest in being able to identify it's citizens.
As a state employee, even more of my info is online. One of my coworkers pointed this page out to me:
https://transparency.ky.gov/search/Pages/SalarySearch.aspx#/...
> and work underground for cash
My sister was a member of Scientology for 2 decades and she was encouraged to do this. As a result, she has almost no Social Security earnings and her Social Security check is about 1/4 of what she would be getting if she reported (and paid taxes to the government instead of to her "church") her income.
> decide to vote? Your information again is publicly available
I ran for elected office in the past. When I asked the voter registration office for a "walking list", they only checked that I did get on the ballot and I was provided with a list of every registered voter in the district I was running for. It had names, addresses, phone numbers, political party and a list of what elections you voted in (I think it went back 8 years). Some people were rather upset that I had access to that information when I knocked on their door and asked them to vote for me.
> No it's not. Sign up for a virtual mailbox for $15-$25/month.
You are out of touch.
We stopped paying for a USPS PO Box when the price of the smallest one passed $150/year.
> Sign up for a virtual mailbox for $15-$25/month.
That isn't going to stop Microsoft from collecting your address by collecting your wifi info, or from the data you enter into websites or documents. When the maker of your OS is the enemy you will always lose.
Technically true but I don't think their engineering is advanced enough that it actually happens that way.
Why not? Collecting Wifi access point SSIDs to enhance locating has been bog standard in the industry.
Yet another subscription plus the hassle of managing that mailbox is impractical for most people.
> IANAL but they are not a government or financial institution and do not have a right to that information.
As soon as you purchase something from Microsoft - e.g. your Office 365 subscription - they have at the very least your billing address on file for the credit card.
Seems to me that it's a challenge to make an apple account without adding a credit card to your account as well. A carfully chosen Linux distro (so many options!) is the way to avoid the brunt of these privacy issues, lots of open software calls home in some way or another so user beware!
We gotta stop normalizing that. Why do you need my address to receive my money? My birth date?
Even in places with strong privacy regulations requiring businesses not to collect data they don’t need, businesses apparently get away with asking this.
The problem is CC processors. You can get away as a merchant with just a number and expiration date, that's the minimum you need to process a CC payment, but you pay exorbitantly higher fees. The more details you collect and pass on, the lower your processor's risk fee will be because the more info, the more likely it is that the customer is actually the cardholder and not using fraudulently obtained data.
And as soon as you connect with telephony systems (e.g. VoIP numbers) or rent out servers, some countries' telecom KYC laws apply that also force MS to collect validated address data.
Even without the CC processor requirements they would want to be able to identify you in case of a payment dispute. Digital payments are more like an IOU than like cash.
Right, but they’re avoiding that risk by passing on a risk to the customer, that their PII will be mishandled.
Because handling that PII is not only cheap, it’s profitable!
In the rest of the world CC processing uses a PIN code + online revocation check (when the card is present) or a redirect through your bank (which hopefully uses some type of 2FA). Works a lot better & safer, and you should wonder why they pretend to need to violate your privacy in the USA…
> Why do you need my address to receive my money?
Because of the volume of stolen credit card numbers. If you have the address, you are much less likely to be someone using stolen CCs. Seriously, most of the crooks are that lazy. So the real reason is the credit card processing companies.
Also, post 911, there is this thing called "know your customer". It was set up to fight money laundering and financing terrorists.
https://en.wikipedia.org/wiki/Know_your_customer
This really needs to be hit with the GDPR hammer. Microsoft have not obtained consent for this.
> This really needs to be hit with the GDPR hammer. Microsoft have not obtained consent for this.
At best they'd just disable it for EU... assuming they didn't successfully argue "it was in the ToS ..."
But the EU mandates watermarking of AI content.
As the article explained, the EU does not mandate a prompt-specific GUID, only the ability to identify the content as AI-generated. The highly privacy-invasive level of provenance tracking which Microsoft has added goes beyond the EU’s new mandates.
Why would the EU possibly object to this? It is exactly what they want.
Ummmmmmmm. No.
Inserting a tracker that can personally identify me without my explicit opt-in consent is a GDPR breach. I'm surprised you do not not this.
So you will defeat chat control by sitting there going “but you don’t have muh gdpr consent for that!”?
The whole EU vision is they know what the little people do all the time, think all the time, and spend their money on all the time. For the children, obviously.
If you think "chat control" is going to pass, I've a bridge to sell you.
In the meantime, the GDPR is your friend. The amount of FUD spread about it on here by those working in Adtech (and whose very salaries are dependent on invading peoples privacy) is insane.
> If you think "chat control" is going to pass, I've a bridge to sell you.
I genuinely wish you were right, but you are so naive it is frightening.
> The amount of FUD spread about it on here by those working in Adtech
You are confused. You are arguing with people that want to protect privacy. The EU demonstrably is not doing that, as WhatsApp gets ever more de facto mandated by the day.
Watermarking ai generated stuff is mandated by EU
Do they require the watermark to be a unique token that can be associated with PII?
It doesn’t need to be a personally identifiable watermark.
This a variant of the provenance scheme: C2PA its implemented by all major Camera maker, and Google it seems, Apple support it with 3rd party apps on iPhone, but they have something called "Apple Reference Image" brewing.
Personally I think there is a good argument for being able to distinguish AI generated image and video...
> I think there is a good argument for being able to distinguish AI generated image and video...
Neat but that's not what's being built here. What's being built is "we can trace back this content to who made it" which is bad. Doesn't matter if today that it's limited to AI generated content. Won't be tomorrow. Your devices should not act against your best interests. No cop in my pocket please.
No - there is a huge difference between "this AI created this image" and "this user did it" - the first we need more of, and the second is a big privacy concern. The article does not say anything about identifying a user.
Article literally says it adds a guid, not a binary field indicating that the image is ai generated.
A guid isn’t a user id, if it is in this case, it’s an abuse of how guid is used, at least colloquially. I haven’t read enough to understand if it is user / machine id, I.e. only globally unique in the sense it’s a globally unique entity identifier.
Microsoft Can Track Users via a Windows Device ID https://news.ycombinator.com/item?id=48815196
Microsoft GDID telemetry includes full browsing and gaming history https://news.ycombinator.com/item?id=48787239
They stated the GUID is used to identify the prompt used to generate the image. How are you confused as to not being able to identify the user?
"I haven’t read enough to understand". Oh, now I know the answer to my question
a GUID isn't an indicator, it's a fingerprint.
so unless you want to draw a distinction between 'user' and 'machine' , yeah it is for identifying users.
to believe otherwise, especially with Microsoft involved, would be incredibly naive to their history.
Well yeah they know my John Doe info
add your IP, location, provider, computer specs, dimensions, screen info, nearby devices, etc etc etc
Ain't nobody anon anymore thanks to the image recording GPS radio in the pocket.
Exactly. Forget the AI aspect, this is entirely to identify users for any purposes they deem necessary. People are ignoring the surveillance state aspect of this. Reminds me of the device id debacle they have attached to their outbounds Windows network calls
> every image you create
*with the help of AI*. Does in fact make a difference.
While it does make a difference, their willingness to quietly integrate watermarking features into what people saw as simple apps for doing simple tasks is unnerving. It only takes a small change for them to start baking your identifiable information into all images they edit, or some government politely asking them to do that.
I wonder if in ten years we'll have a horrifying world where everything that leaves a machine is imprinted with its permanent identifier. Every file comes with a verifiable history of who created it, what computers it passed through, who made edits. We're closer to that world than we think.
There is a certain convergence of wills here: watermarking AI products on the one hand, and infusing AI into everything on the other hand. When you layer generative AI into Notepad, once just a raw text buffer, then you’re setting the stage for watermarking everything because AI touches everything.
AI watermarking is now the law.
Imagine the horrifying world where nothing is - and a so-called AI is thereby free to impersonate anyone.
We already live in that world, and the sky hasn't fallen so far. Even in the worst case scenario, the world isn't going to be as horrifying as the alternative, because people react to the proliferation of scams, they will not keep falling for fake impersonation for the 10000th time a row. In this scenario, we simply will stop taking factual-looking images at their word in the same way how you don't take any piece of writing on the internet as factual, verifiable truth. Journalism will rely on a person vouching for their images with their reputation, and images with unknown sources will be looked at with suspicion.
I am not willing to pay the price of sending every bit I create to some megacorporation's server or stamp it with my only identity so the computer can tell me what's AI and what isn't. Especially not while the average quality settles into an uncanny valley that's often discernible with the naked eye, both for text and images.
> a unique identifier into every image you create
Printing (even text) is also a risk: It's very likely your printer is secretly adding marks to the page that contain its serial number and the current timestamp. [0]
Meanwhile Microsoft (and Apple) have "telemetry" harvesting those serial numbers of all internal and external devices you've ever had connected or reachable. Then they link them to your MS/Apple account, IP addresses, and the extended social-graph of all computers that were ever in the same room or shared the same bluetooth speaker.
In short, your "anonymous" flyer critiquing The Regime and depicting Dear Leader as a clown could lead thugs straight to your door. Or to the door of whomever you're staying with.
[0] https://www.eff.org/issues/printers
and then in few years a new mono-mustachioed or mono-browed leader will emerge who declares memes a blasphemy punishable by death and will call up all the telemetry gathered to punish all involved.
"I don't worry because I have nothing to hide, based on my perfectly accurate perception of today's political and legal forces in my state and nation which will stay safely static forever."
You know a certain dictator denies access to the country they control based on whether visitors "like" them? They use a private militia, funded by stealing from taxpayers, in contravention to that country's laws, to target citizens who are not supporters of them. Some of those citizens get shipped abroad to foreign prisons by these militia. Others get shot in summary executions in the streets - the controlling regime covers it up with false media reports, and uses corrupt judges to evade scrutiny ... a certain software company support that regime, even acting against foreign scrutiny on their behalf.
Essentially all of that country's businesses that are close to the regime need to be considered hostile.
We don't need to wait a few years, the revolution already happened; the insurrectionists were freed. These companies paid their tributes, in dollars, to the regime.
Maybe next ML will be integrated into software suites to enforce that regime's lies? Most Western governments use such software, the distributers of which have already shown they'll act in the regimes interests against supposed allies...
I had assumed parent-poster was making a sincere but humorous point, as opposed to sarcastically dismissing the risks of a change in management, but I suppose it's ambiguous.
Good satire is often indistinguishable from fundamentalism.
Also known as Poe's Law.
https://en.wikipedia.org/wiki/Poe%27s_law
> It's very likely your printer is secretly adding marks to the page
It's most likely how the FBI caught NSA leaker Reality Winner:
> Both journalists and security experts have suggested that The Intercept's handling of the documents, which included publishing the documents unredacted and including the printer tracking dots, was used to identify Winner as the leaker.
https://en.wikipedia.org/wiki/Reality_Winner
Yeah - these criminal agencies use this to protect their billionaire buddies on top. The Epstein network must be really huge. I always wondered how one or two person can meta-coordinate +5000 underage girl and their +10000 customers. That never made any sense to me, yet suspiciously enough only Ghislaine is in prison. That does not add up.
There isn't just one Epstein network. There are many similar networks.
This seems like something that could be confirmed by reverse engineering a printer’s firmware? Surely someone has done that?
It is confirmed and the algorithm has been reverse engineered, though not by looking at firmware
https://w2.eff.org/Privacy/printers/docucolor/
Seems like the algorithm is simple enough that they did it just by looking at some prints
No need to reverse engineer, printers are required to do this for decades.
You'd still need to reverse engineer it to build a better firmware without this anti-feature.
And the reason why it refuses to print this B&W document when yellow is empty.
You don't need reverse engineering if it's publicly known fact for 20+ years, telemetry just identifies you. 20 years ago, you would need to find the printer.
So what you're saying is we should use linux?
Until it gets outlawed for not telling websites what age you are.
>Then they link them to your MS/Apple account, IP addresses, and the extended social-graph of all computers that were ever in the same room or shared the same bluetooth speaker.
Did it get revealed that Apple did that? This is news to me
Can this also be weaponized? Get an innocuous image from someone you don't like, grab their GUID, add it to another image, sent it to the thin skinned politician in power.
No, because the GU in GUID stands for globally unique. Adding it to a second image would cause a detectable collision.
Also, C2PA, another technology mentioned in the article, means tampering is easily detected.
> Adding it to a second image would cause a detectable collision
So? Still the weapon worked.
Collision only detectable when you have both messages. Detecting a forgery seems more likely.
It depends on which version of GUID it is. Only version 3 and 5 are hash based. The other versions are random, time, and/or MAC address based. Version 3 uses MD5 and its cheap to get the same hash for different images: https://crypto.stackexchange.com/questions/1434/are-there-tw...
That was largely my read of the situation too - it would be a colossal GDPR breech against every EU user, surely? That's got to be a €Billion fine??
Presumably USA are complicit in this spying on allied countries - did the countries know, is it a Five Eyes thing?
Why would they need to subpoena Microsoft and why will Microsoft hand them the data if someone doesn't like my meme? I understand what you are trying to say but it does not make a whole lot of sense even from Microsoft pov. They are not bound by law to hand over personal data to anyone without a warrant issued. If a warrant is issued then it is their lawful duty to give that data, the same would be done by you if you were in their shoes or your office or your family. Law is not optional to follow. But Microsoft doesn't need to do watermarking on memes to track you or to do this as a war against "internet anonymity".
Watermarking is just one puzzle piece in the surveillance state; the legislation around it another.
I would say the watermarking is not really a puzzle piece at all when it comes to the surveillance state, which was my point. They don't need watermarking to know who you are or to get information about you. So why would they work on this really visibile method if their intention was to progress the survelliance state? Microsoft with all their resources (and assuming it is an evil corporation purely acting from the state's interest to spy on you) will use this to track you?
You can incentivize cooperation without having to compel action with a warrant. This sort of corrupt quid pro quo is quite common, in other countries at least...
It's like Snowden said (paraphrasing): "If privacy comes from policy, the policy can be changed on a whim, and in effect you have no privacy at all"
Indeed. This also means I can no longer use Microsoft apps, because they spy on me.
> Microsoft to instantly get your full name, address, email, phone number, and any other data associated with your Microsoft account.
Provided you bent the knee and created a Microsoft account.
I was forced to create multiple as part of the mojang migration - truly a nightmarish experience to use their AuthN, haven’t seen something quite as bad since
Maybe you were "tricked into", but probably not forced. We are free to refuse, at cost, but free.
The cost is that you can never play Minecraft again
It might be small cost in retrospect.
Nah I sunk many thousands of hours into these accounts; definitely not a small cost. Sure I could get a new account and pay twice for the game I already purchased multiple times - that would’ve ground my gears too
I think the new account would have to be a Microsoft account also, so you wouldn't have even gained anything by not migrating.
Some servers allow joining without a Microsoft account even these days, but probably can't play on any of the servers you regularly play on, if you don't have a Microsoft account.
Including old pre-enshittified versions.
Never play online
That's half the game.
They used dark patterns to trick me into signing up. I do not know how anyone can trust them, at all, ever.
Assuming you are on windows, you probably have
Not even. They log the IP and your ISP (or VPN provider!) knows the name/address of the person using that ip at that time.
How can they send a copyright subpoena for work which cannot be copyrighted? There is a contradiction here between "no it's FAIR USE" and copyright.
Keep an eye on this.
A few months back, MS incorrectly tried to stamp a Copilot "watermark" (just an auto-added note) to any and all Azure DevOps commits, regardless of whether an LLM was actually involved. They removed it after a lot of github issues were submitted to the source of the issue which was a VS Code Copilot extension.
MS has been very sloppy in their implementations. I would recommend against using Paint or any other LLM enabled app they use as a result. Things may be getting incorrectly stamped.
I would avoid junk from Microsoft entirely.
My goodness, this has nothing to do with AI problems.
I don't understand that people still buy an OS from a company that actively hates it's customers.
The amount of things they pull should not even be succesful on a OS you get paid FOR to use.
Not that I love Microsoft, but they would get a lot of heat if they let anybody generate harmful content as well.
They can't win on that topic.
Now I would not want to appear to defend the mess they've created out of windows, that's not the point.
They have only themselves to blame for this. They've spent decades developing technology to spy on and micro-regulate what their captive customers can do with their property. Now that they have this technology, it's only logical that they be held responsible for misuse.
The only (and inevitable) solution at this point is for big tech to get micro-regulated like the banking industry. The same mindless greed that drove them to take control away from their customers will be responsible for the same control to be taken away from them.
Be careful what you wish for. I'm sure Microsoft and Google would love the kind of regulation we apply to big banks. It has become a moat that makes it impossible for other (snaller/foreign) financial institutions to compete because they don't have massive specialized regulatory departments.
The more complex the rules become, the more difficult it will be for alternative providers to exist, unless they have explicit carve outs. So far, with age verification and user id laws, there doesn't seem to be much appetite from politicians to create exceptions for open source and smaller projects. By comparison, in the US the regional banks have special exemptions for many of the really onerous regs, which is why they are still a bunch of them.
You don't think that regulation would require everyone to embed watermarks and guids to make sure that nothing objectionable is being generated or created?
> Not that I love Microsoft, but they would get a lot of heat if they let anybody generate harmful content as well.
Nonsense. They let anyone draw any pic they like.
This has nothing to do with generating harmful content and everything to do with fascist surveillance. This is an OS level functionality that get utilized before AI even existed.
The guardrails that prevent generating adult/explicit/whatever content are a completely separate step. This has nothing to do with that.
Microsoft is still the best Indian OS manufacturer. And as such, it's forced upon people throats by corrupt Indian IT department heads, so a few non Indian people who actually care don't have a choice.
You know, you're only supposed to drink the kool aid, not chug it by the gallon.
You never met anyone from the corporate IT?
This is a pretty privileged take, isn't it?
What's the alternative? What if you work at literally any Fortune 500 company?
"privileged take"?, sorry I am not from the US, so I don't compete in the sorry-o-lympics.
Nothing is stopping you from using it for free at home, everyone is privileged in that regard.
And it was obvious to everyone else, I was talking about decisions you can take yourself. I'll try better in the future to be hyper explicit about this, so people who are looking for a reason to feel hurt will have a harder time.
How many Fortune 500 companies require you to buy your own Windows laptop as opposed to them providing one?
Also, if your laptop is work provided, your laptop is going to have little to no privacy no matter what.
If you work at a company and it's a company device, then its not your privacy to worry about - you don't use your work device for personal matters, and the concerns are someone elses.
IBM, SAP, Capital One, GE, Cisco, Intel, Deloitte offer a Mac/Windows choice program. Better than just one choice, and arguably a bit better of a privacy record than MS (especially of late)
> I don't understand that people still buy an OS from a company that actively hates it's customers.
Do you really think this is a problem confined to those who buy the OS they use?
Its not that it hates its customers , as much as it it a USA-based company that is run under the rules made by the administration.
Not that much different from running Red Star OS from North Korea, actually.
Well I will never ever buy something from Microsoft again because they do hate their customers.
I own an Xbox with an family account. Microsoft's account management is terrible. Their customer support is terrible (computer says no). Never again.
Exactly it is a legal requirement from lawmakers who either don't care or understand privacy implications to implement provenance metadata. California's act came into effect August 1 https://sd13.senate.ca.gov/news/press-release/august-3-2026/...
I had this trigger the other day incorrectly and went and installed Paint.net. I pasted in a screenshot I took and just wanted to resize it. I got a banner saying it was made with AI and would be updated to reflect that.
I guess it shouldn't be surprising if an application called "paint.net" can determined if AI was used when connected to the internet. (I have used Paint.net more than a decade ago).
Paint.net is named after the dot net framework and is not referring to a URL or the internet as I understand it.
Paint.net actually just recently got ownership of paint.net, it only took 22 years: https://www.xda-developers.com/after-22-years-paintnet-downl...
They aren’t saying that, paint.net is an open source application, Paint is the descendant of MSPaint.
Paint.net is freeware, but it is not open source.
I was stating that MS Paint mis categorized a Print Screen screenshot as AI generated when pasted. Which pushed me to install PaintdotNet onto my laptop instead.
> mis categorized a Print Screen screenshot as AI generated
Maybe. Question is, was that a false positive, or merely a bad user-facing message?
Assuming you didn't have any AI-generated images caught in the screenshot (e.g. some advert - plenty of those even in Microsoft apps like Weather, nowadays), what if - and I'm speculating here; I don't know if anyone actually does it yet, but it's so obvious they eventually will -
- what if parts of your screenshot already had an invisible watermark on it, like the ones for tagging AI images? You can imagine an app rendering its window to texture, and embedding a watermark on those pixels before sending it over to the system compositor, and the reasons have nothing to do with AI.
Watermarks are DRM tech. "AI generated" is just a specific kind of metadata that can be put in one, and a huge red herring for discussions.
It's only a matter of time before we'll need to have software for detecting and removing real-time watermarks from display output at OS level. (Unless, of course, platforms decide to add app window live watermarking as a "feature", and given the story with remote attestation, I think it's more than likely.)
I admit it’s a while since I’ve used windows, but it’s such a shock to hear that MS Paint isn’t just a point and click pixel coloring app anymore. It seems like they could have left it as a pure “paint” app and added the fancy stuff to some new image editor or something.
I guess they’ve optimized their workforce to just keep making changes so they get promoted rather than just creating really good software.
If you read the article instead of the headline…….. it’s adding a fairly standard mark to AI generated images to let’s others know, in the same manner a giant swath of the GebAI industry has agreed to.
I think their point is that paint shouldn’t have any GenAI features (or any new features other than compatibility)
That's just nostalgia. Why do we set the bar at windows XP paint instead of windows 1.01 paint which was different? Probably because winXP paint is the one we grew up with, and also the best version. But if we said no new features ever, we'd be stuck on win1.01 paint. The best version of Paint was a complete UI redesign away from the original.
I don't think adding an identifier which can most likely be mapped back to user is "standard mark".
It doesn't explicitly say it, but there is hardly any other reason why it would add server generated ID (from authenticated session) to the saved file.
It's a problem on so many levels.
We've probably lost the fight over GenAI marks, at least for now, and I do understand the need for them. However the same technology that can embed an invisible watermark that survives a round of photographing, printing, crumbling and scanning back - can be used to embed more information than just "it's AI generated". Encoding GUID is just a harbinger; as a next step, why not encode the app that produced the image? Also a hash of its license key? Hell, what's stopping an app from doing it itself, watermarking its own window before passing the pixels to OS for compositing?
"Robust GenAI watermark" today is "robust general-purpose DRM watermark" tomorrow :).
EU law requires the mark. Did you know about the level of the “so many levels”? If such a large market requires behavior by law, and quite reasonably so, it’s also quite reasonable to mark AI generated content as such.
All the slippery slope nonsense on this page has failed so many times it’s not worth debating. If you don’t like this tool, use another. When they embed your social security number and face and address in the mark get back to me.
Even Notepad isn’t a dumb app anymore! They made breaking changes after 40 years so it has autocorrect, rich text, and Copilot.
If I wanted all of that, I would have used a different app!
I wanted dark mode, tabs, and autosave, and now I don't have to use a different app to get those, so that works out great for me. Not sure what "breaking changes" even means for that though. Did it suddenly stop being able to open text files? No, it still just works.
IIRC they did make a breaking change by changing the default character encoding to UTF-8 without BOM.
They also started rendering and preserving Unix-style line endings (LF).
Very welcome breaking changes :)
That's a really fair point, but i'm not sure if that's what they meant by "breaking changes" if that was followed with "autocorrect, rich text, and Copilot"
"Breaking change" is a pretty common term, especially here, so I don't get the confusion about what it means. It means an interface-breaking change, so that the same input produces a different output, and is generally to be avoided because it forces the user to have to adapt and means the new version isn't strictly better[1].
The inclusion of autocorrect (that I mentioned) would be example here: previously, it would accept whatever text you gave it verbatim. Now, it will sometimes change non-dictionary strings to dictionary words.
(Another thing that bothered me was that, on the update, it forgot my font settings and I had to work to re-find them.)
I'm happy to admit my phrasing was confusing, but not enough so that you would be unable to see the relevant failure mode.
[1] https://stackoverflow.com/a/21703427
Words used to have meaning, now everything is "breaking" even if it's literally working and it's just "I don't like it"
For a long time I used metapad as a notepad replacement https://en.wikipedia.org/wiki/Metapad (I even renamed the exe to notepad). Very fast and minimal.
It automatically saves and reopens whatever you previously pasted in there. Quite a shock the first few times it happens. It's not a safe temporary holding area anymore.
Yeah I switched to Windows 11 recently and was a little annoyed by that - Notepad was always a place to paste formatted junk to get the plaintext - I don't need anything persisted.
They also added a settings menu where you can go and turn all of the things you don't like off, including that.
Then they should've left those things off by default, rather than messing with the expected flow of the application for everyone.
Yes, all UX improvements should be disabled by default so only the users who dig through every settings menu benefit from them. /s
Someone got their use of child porn leaked this way. They opened notepad on a twitch stream and a bunch of CP links came up. I don't remember who it was.
Lacari: https://www.windowscentral.com/microsoft/windows/csam-using-...
He still streams on Twitch, he got a temporary week "long" ban and then came back claiming it was a virus or an accident while also claiming he has a porn addiction problem... but don't worry he's very "sorry" (to have been caught).
The state of this Amazon-owned streaming platform is wild... and that's without even looking at the rampant antisemitism (their second top political streamer, Hasan Piker, currently has a bipartisan US House resolution (H.Res.1239) in progress calling him and Candace Owens out for their antisemitism), repeated call for violence (their top political streamer, Asmongold, was recently banned for a few days for calling for the murder of immigrant's children by ICE) and the repeated reckless/distracted car and even truck driving streams with some even leading to accidents (luckily enough without any deadly one... yet).
All these are against Twitch rules, but the staff and even the CEO (who cosplays as a streamer) selectively apply the rules and unban the streamers who are under contract with Twitch or are well connected with the staff.
I have no idea why Amazon or Twitch shareholders have not cleaned house already (e.g. ousting the CEO and the people in charge of the moderation), especially considering the fact that even with all these transgressions, Twitch isn't profitable after years of activity.
They are waiting for someone to actually die I think, with clear links to Twitch... if that ever happens there are plenty of evidence that Twitch and Amazon know what is going on and barely does anything about it.
You definitely shouldn't assert that someone is antisemitic based on the current US House, even if bi-partisan. And I thought bills of attainder were unconstitutional?
To answer your question of why, it's probably because they make money.
There are plenty of evidence of Hasan Piker's antisemitism to the point that people have been collecting and contextualizing them: https://whoishasanpiker.com/antisemitism
Also plenty of groups fighting against racism and antisemitism have come out against him (ADL, AJC), it's easy to Google.
That House resolution is just the latest good indication that it's not just some isolated incidents.
Piker's only answers are that he's taken "out of context" or that he's "joking", there's literally no context that make his public statements better or less antisemitic though, if you have any I'm interested. He also publicly voice his support to groups that are openly antisemitic (Hamas and Hezbollah) and recognized as FTOs (Foreign Terrorist Organization) by the US government.
Now, it's his First Amendment right to be this way but Twitch/Amazon share a responsibility when they platform this content, and even more when they apply moderation selectively, in my opinion that should forfeit their Section 230 protection. They are deliberately shaping the discourse on their platform by permanently banning other streamers with opposing views and never taking similar actions against Piker.
"Fun" fact, Twitch even had to carve out their own rules because Hasan Piker couldn't stop himself from calling Jews in general or some groups of Jews "zionist pig-dogs" and "inbred": https://www.nbcnews.com/tech/twitch-changes-hateful-content-...
EDIT: Regarding the bills of attainder, it likely doesn't apply here because they aren't trying to punish these two antisemites specifically, they just use them as examples of the proliferation of antisemitic content on platforms like Twitch and want Congress to condemn this practice and encourage platforms to address the issue.
I only skimmed the first half of this list but I believe truth is an absolute defense to antisemitism just like defamation, right? You're really gonna say that "netanyahu is a jewish supremacist" is antisemitism, when it's well documented and probably relevant to whatever he was talking about at the time?
He must've really pissed someone off to get his own hate site. I think we all know who he pissed off. That hate site would be illegal in the EU btw.
You asked for evidence, I've provided plenty, with context.
Skimming them and picking one that doesn't fully meet your criteria, then call it a "hate site" and then use vagueries like:
> He must've really pissed someone off to get his own hate site. I think we all know who he pissed off.
Tells me you have no interest in engaging in this in good faith.
Also nobody cares if a website quoting someone being hateful would be illegal outside of the USA. Piker is an American citizen, spewing hateful antisemitism on an American platform... but nice attempt at a red herring.
Are you aware of the bullshit asymmetry principle?
When you cite a parade of bullshit I'm not obligated to refute all of it. A representative sample is enough to demonstrate that it's bullshit and that the bullshit asymmetry principle applies.
Yeah, I've been working around that for now by uninstalling notepad. Which actually uninstalls the store app, which in turn exposes the actual notepad executable that ships with Windows. Really confusing, and will probably break in some future version of Windows.
I don't understand why they didn't just stuff all the AI things and new features in Write, where it belongs…
I don't use Windows, but I have to say that TextEdit on the Mac is absolute crap. Literally every default is wrong. Text is too small, looks like crap, cut-and-paste always brings absolutely crappy styling with it, its autocomplete and autocorrect is bad and wrong and annoying. No one at Apple uses this application with any regularity and it shows.
Uninstall bloated notepad will revert it to the default version.
Doing so with MSPaint removes the app, so you need to find a clean older version..
Background removal is really useful though, saves a bunch of time.
Unfortunately, some of the regular paint tools like eraser don't erase in a smooth antialiased way and just end up looking jagged (also only a square shape for eraser...no eraser brush mode unfortunately), so it ends up being a better looking option (well, when it works properly, which it does often enough to be useful). For whatever reason a bunch of tools and transforms (scaling, rotating), just produce such garbage jagged looking results, it's not serviceable even for those basics.
Pixelation was a feature back in the 90’s and 2000’s.
But yea, I guess it’s a bug in 2026.
It's been a "bug" for several decades now. Not everything was of shitty jagged quality in either 90s or 00s. Particularly when using some more capable image editors.
If you’re actually intended to Paint in MS Paint, as in create things from scratch, you need to limit the upper end of quality for it to be usable.
Otherwise you might as well use photoshop.
(But no I’m not kidding myself, I realize the days of using Paint to actually Paint are over)
There's a bunch of smaller editors that don't have such problems, like paint.net for example. It's an arbitrary "limit" (accidental even) stemming purely from bad quality implementation of basic features, not from how basic that feature set is.
I like the original commenter’s compromise.
> It seems like they could have left it as a pure “paint” app and added the fancy stuff to some new image editor or something.
Apple Text Edit vs Pages.
Again, even a "pure" paint app with very limited functionality can have it be implemented badly, and it has nothing to do with how "fancy" or complex or advanced of a feature set it has.
I've been using ComfyUI to do fine background and watermark removal. Might take a look into that as an alternative. Run Flux.2 Klein or Comfyui's own workflow.
Key point, saves a bunch of time. Copy, paste, click button, done in three seconds. The app is also just there, preinstalled. It's great precisely because it doesn't require "looking into" anything. Yes, there's a bunch of other apps and services, but that's all besides that point. It also works pretty much on any pc made in past decade and half without crazy gpu/vram requirements for a relatively miniscule task.
If you don’t mind CLI, rembg is a good option for background removal. It lets you swap between different models depending on the type of image so you can use something like `birefnet` for photorealistic images and `toonout` for illustrations.
https://github.com/danielgatis/rembg
JSPaint to the rescue:
https://jspaint.app/
It's a pixel-perfect modern clone (with some actually useful extras that won't get in the way unless you look for them), and yes, you can clone the repo and run it locally.
it is kind of interesting when you think about it. what utility does something like paint actually have? did it ever have any real utility? (icon editing?) it always kinda felt like a demo that came with early versions of windows that didn't actually do anything useful.
Cropping and editing screenshots (eg add red circle) in a very lightweight application.
Other image editing applications can do all of that, but they take 10 years to launch (during which they will ask for focus) and 2 GB of RAM.
Yeah, the main use for old school Paint seems to be just adding text, copying a selection, and pasting somewhere else.
I assume regular home users may have different expectations for what Paint should be able to do.
ahh. kde has all that built directly into the screenshot utility. highlighting, text, cropping, etc.
Used to be you saved and shared screenshots by pasting into Paint and saving it. Printscreen didn't save a file and only some programs (Skype) let you paste the screenshot directly from the clipboard. That's how I remember it anyway.
The utility of Paint is that lightweight software is an absolute fucking godsend (which, Microsoft being Microsoft, is on a mission to ruin). I have all manner of professional tools - Photoshop, Aseprite, Manga Studio, etc, and if the edit is something that can be done in Paint, I will use Paint over any of the others, because I'll be done editing before I've even managed to open the file in another program.
It's not a godsend if it lacks features, eg. it would be much more useful for editing photographs if it had a clone tool.
Googling you can see the source code for watermarking here https://github.com/microsoft/InvisMark
Xusheng here! I have not gone through all comments, but wish to clarify a few things:
1. The watermark only applied to AI-generated contents through the in-app AI (copilot/cocreator, etc). If you draw something by hand it is not watermarked
2. Privacy implications: I believe your MS account is linked to the prompt and the GUID. And the GUID is embedded into the image as both an insivible watermark and a file-level C2PA metadata. I did not write about this very deeply in my blogpost, but when I do an image generation, it deducts my AI credits (yes, MS gives you like 60 free AI credits), so MS surely knows where the prompt is coming from. Though I am not sure about their storage and retention, e.g., do they actually store the data, and if they do, for how long, etc
I get the privacy concerns, and we are right to expect Microsoft to say that this is what their tool may be doing. However, I fear that one day we will look back and wonder why we didn't do more to sign and preserve human authenticity. Having a stamp saying "AI manipulated" should be a part of digital lineage tooling.
You can watermark AI without leaking who did it. That's just using AI to add yet another layer of user tracking.
If an adversary knows how the watermark is embedded they can replace it with noise so its not like you can rely on these watermarks anyway.
Yeah you can do that, and it's a crime
> On Copilot+ PCs, image generation is local but prompt moderation remains remote
Anyone disturbed about that ? It's your computer, running locally, but Microsoft can tell you 'no'.
It's like you want to open a folder and it asks permission to Microsoft.
I would be surprised that anyone is surprised by this. They've been making local accounts harder and harder now to the point of being impossible.
Anyone not deep in tech will accept the "think of the children" defense without much worry, and anyone who is deep in tech already knows that if you really want an OS that doesn't spy on you, you need to go to a *nix of some flavor.
I'm disturbed by everything.
Prompt moderation, GUID insertion, watermark insertion; track anything and everything, probably done in the name of "protect the children".
That's nothing new. Ever tried to develop a driver? Or replace a system file? Or install an app on iOS not from the store? That war was lost two decades ago with the iPhone
after a local Stable Diffusion image generation
The request is JSON and contains at least these fields:..."prompt": "..."
Local SD (especially the earlier versions) is already uncensored, so they're effectively crippling it with additional spyware that phones home to tell Microsoft what you're doing and asking whether they approve of it. IMHO the invisible watermark isn't the worst part, but rather the fact that MS is logging every interaction you have with the model, which doesn't ever need to leave your machine.
What happens if you try to use this feature without being connected to the internet? Will it refuse to run the local AI model?
As a linux fan I just love all these changes Microsoft have been introducing
As another Linux fan, I don't. What Microsoft does to their users changes the overton window of what's acceptable in tech. Before you know it there will be a politician demanding that all software systems that don't implement such tracking will be outlawed and there will be no one left to speak up to you because they are all already used to the tracking so why should you get a pass.
Exactly. North Star linux was doing this 20yr ago. And now Microsoft thinks it's ok to do it.
This is gonna sound a bit harsh, but from the outside it genuinely looks like Microsoft is actively looking for new ways to degrade and humiliate their users. (And having no trouble finding them!)
The visible watermark toggle giving users a false sense of control while the invisible GUID persists regardless is the worst part. People who turn off the watermark think they opted out.
It'll literally be like printers "cannot print this black/white document, low on cyan".
"Cannot run local AI model, no network connection".
The more you think about it, the more it really is the same: https://en.wikipedia.org/wiki/Printer_tracking_dots?useskin=...
Except once printed its at least hard to remove the dots. Image based watermarks are trivial to destroy if you know they are there.
tbh so is circumventing those dots.
It doesn't make it any better
How do you circumvent printer dots? I don't see how that could be trivial.
This reminds me that in the USSR they had typewriters that added an identifier somehow that could be traced back to that particular typewriter (and who it was sold to)
Not only USSR.
I wonder whether Arthur Conan Doyle had the idea before the police started using typewriter typeface wear and tear for forensics.
You have no idea how deep this rabbit hole goes. Search for EFF printers secret tracking.
Virtually all commercial printers embed an invisible identifier on every page printed.
It was about money anti-counterfeiting.
https://en.wikipedia.org/wiki/Printer_tracking_dots
There is always a legit reason. It’s just never the only reason.
Are they still doing the EURion constellation, too? You can embed that in anything.
Now I need to see if agentic reverse engineering of printer firmware can actually remove that "feature" for good.
Virtually all color laser printers and copiers.
Sure, try to scan, photocopy, edit in photoshop or print US money today.
Or EU money.
https://en.wikipedia.org/wiki/EURion_constellation
the GUID is the giveaway that it's not about protecting artists, it's about being able to prove provenance later. nobody embeds a unique id in a local file for the user's benefit.
It is quite likely that Snipping Tool is also doing this. Every camera also leaves device specific signature because of its inherent silicon sensor defects.
If you want to stay anonymous, don't share images you can't verify at the byte level. Apply filtering to decrease the low bit noise that could hide cryptographic signatures. Don't trust complex container formats.
See e.g. PPM format: https://www.cs.swarthmore.edu/~soni/cs35/f13/Labs/extras/01/...
These days entire scenes can be tweaked by AI to add unimportant but identifying marks, at a level far above signal processing tricks, like moving objects in the scene. Verify from multiple sources.
If Anthropic can manipulate text to add a watermark, what’s preventing providers from doing the same to generated images? Modifying the container format can’t protect you from a signature in the image’s visual representation, unless you apply noise to that (and know it’s enough noise/the right kind of noise to counteract whatever unknown technique they’ve applied).
Anthropic's watermarking technique is possible, and worryingly could effect low frequency choices (eg as I said, with object placement or style). However, this has to be a generation time decision, you can't really do that with a small edit. In fact small edits tend to be detectable spectrally.
Okay, there are watermarks on AI stuff, interesting, not good but everyone else already talked about.
My question..how does it work? Is it robust? I remember that young me hid data in pixels of png with simple stegonagraphy and it was a fun little project..but brittle. How exactly does the fingerprinting survive jpeg compression? Is it repeate over and over the images or is it just one area? If that one is pure black by chance the jpeg algorhitmen would erase it all no?
I'm pretty sure the robustness of watermarking has been a solved problem for at least 30 years, I remember visiting the mit media lab in the mid 90s and they were explaining how they could watermark digital audio by imperceptibly adjusting the acoustics as if the walls of the room the audio has been recorded in were changing distance relative to the microphone according to a wave function
There is no robust-without-qualifiers watermarking. There is only robustness against common operations but as soon as someone is actually trying to remove the watermark they can at the very least use exactly the same technique to embed random noise instead to overwrite your watermark.
Interesting find. Overall it makes sense from a deepfake-fighting perspective and EU requirements. But what's concerning is that users aren't really told about this, as far as I can tell. Would be cool if someone checked if it can be bypassed, like swapping the DLL or intercepting the API call. But yeah, it's another step toward every digital trace becoming personally identifiable...
People worried about other people tracking them while using local stable diffusion models built on fraudulently obtained training content, to produce images which cannot be owned. Thug on thug violence.
Kind of sad how all these technical blogs just reek of Claude text these days. Hard read when it’s obviously padded by an LLM…
Obviously it's bad and we can all say "fuck Microsoft" once more, but "we" probably don't use Windows anyway, right? I have no idea, really, but if you willingly use closed-source spyware that is notorious (for AT LEAST 15 years) for all kinds of invasive telemetry it forces upon you, you probably wouldn't find this new piece of information concerning anyway.
And ironically, I think that this one is kinda fair. I mean, you specifically asked your software to generate whatever pseudo-random bytes it wishes to loosely based on some text prompt. It did that. Now, apparently, these pseudo-random bytes turn out to be personally identifiable. So what? I suppose they didn't claim their PRNG to be cryptography-grade. They could even make it seem like an accident, should they be bothered to. Make it way less obvious.
Now if it would insert watermarks on save (like printers do), that would be really outrageous. But when you trust software to produce "whatever", you probably shouldn't be really mad about it doing anything more than you asked to.
Misleading title: the watermark applies to AI generated/edited images. That includes local models.
Whether it applies to non-AI generated images is a question for the reverse engineers (or ironically, a suitable AI). My bet is on "no".
Of course, the pre-AI versions of paint and notepad can still be installed with a bit of trickery, and it's worth it just for the UX.
Don’t care.
There is no reason to assign a GGUID except to identify the person, not that the photo is generated. This is nothing more than surveillance.
Don't care that you don't care. This distinction does matter to a lot of people, because to many people there's a huge difference.
Microsoft is in a pretty good position to do something that can be valuable to certain institutions.
Imaging every pdf file, every image, every office documents, and every video has a hidden record of the associated Microsoft accounts of all computers it has ever passed through. This should sell well, and realistically nobody can stop them. Why haven't Microsoft done this much earlier?
RedStar OS (North Korea linux) already did this 10 years ago. Nice to see the west catching up.
These days i cant recommend Windows to anybody. Even gamers should move to linux.
Some say "i do nothing illegal" "have nothing to hide". You dont do anything illegal in your point of view. AI tracking you might think otherwise.
A sudden knock on your door might happen because of an ambigious search/propmt.
There's a huge number of gamers moving to things like CachyOS. Some are stuck because of Valorant, LoL or Battlefield DRM, but it's a big move lately.
I'd never play one of those games but the excuse for the kernel modules spying on you is usually anti-cheat not DRM as they are online games.
There are droves of people petitioning Valve to add kernel anti–cheat to CS2.
It's both and the main reason why anti-cheat is needed is the central matchmaking model, which is itself a form of DRM. If people were still hosting smaller community-moderated servers there would not be a need for invasive anti-cheat but people could also pay on cracked servers without paying.
Others say
"I need it to work on a random Thursday, not wait for fsck after ever reboot"
https://github.com/IceWhaleTech/CasaOS/issues/1104
I have the same issue on Windows 11. It's been bugging me to press a button or "check my drive" on every startup for at least half a year, no matter how often I let it run the check...
Same thing happened to me recently
Why have you linked a bug report for a niche userland application that may be causing disk corruption as evidence against linux reliability? That seems like a pretty uninformed conclusion.
This isn't a one-off niche user. Just look for more of these. You will find them.
https://www.reddit.com/r/archlinux/comments/1cvwo93/arch_run...
This supports my initial reply. This was an f2fs bug in a bleeding edge kernel released only seven days earlier. The thread suggests perfectly reasonable mitigations, especially for an arch user: use the lts kernel or downgrade to 6.8.9.
If you're not familiar with linux and/or don't want to deal with trivial issues periodically, don't hang out at the bleeding edge. There are plenty of boring and/or beginner friendly choices out there.
I'm not saying linux is perfect, but your conclusions in this instance appear to be uninformed rather than supported by the facts.
Ok fair point, here's plenty more of the same on stable. My point is Linux is always fine right until it isn't. Then you're back to a day of debugging your update.
https://bugzilla.kernel.org/show_bug.cgi?id=218770
https://lore.kernel.org/linux-f2fs-devel/20240409203411.1885...
https://lkml.iu.edu/hypermail/linux/kernel/2511.2/07280.html
https://lkml.iu.edu/hypermail/linux/kernel/2511.2/07260.html
https://bugzilla.suse.com/show_bug.cgi?id=1226043
https://lists.opensuse.org/archives/list/bugs@lists.opensuse...
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/15478...
https://bugs.launchpad.net/bugs/63175
Most of these links weaken your claim rather than support it. The lkml links are patch submissions in a _development_ discussion, not ordinary users running a stable distro. The f2fs bugzilla links are the same issue we already discussed, a regression in the brand-new 6.9 kernel released only days earlier, with the fix landing in 6.9.3. The suse bug is an upstream e2fsprogs issue. This is precisely the kind of issue distro package maintainers can catch, patch, or avoid before it reaches ordinary users on a stable release. The launchpad link is another development discussion, not an example of ordinary users experiencing a bug in a stable release.
Linux does experience regressions, but your argument conflates upstream development, bleeding edge releases, and stable distro releases. Those distinctions are fundamental to how linux distributions work, and these links don't support the claim you're making.
>Most of these links weaken your claim rather than support it.
Yep. Good catch, I think you win the argument. These are all distros that are under development and their underlying issues should never be called-out as handing the user frustration as they willingly chose to become a victim of the kernel.
I don't know why you'd choose one of the smaller OSes, I'm required to use Ubuntu at work and it just works fine for me, every day.
It's also a bit rich especially to complain when Microsoft also suffers from forced autoupdates and the like.
Do those users use the OS that randomly takes hours to shut down because it desperately needs to install updates right now - and then it won't shut down at all and reboot instead. And even if it doesn't do that shutdown takes ages and you need to attend it and can't just walk away because the OS will drop you in a logged in desktop when some random application decides to interrupt the shutdown process.
Anyone got tips or guides to starting a linux OS that protects privacy without sacrificing utility?
Considering putting linux on a 2nd PC
omarchy.org
Essentially any Linux distro protects privacy. You'd kinda have to go out of your way to find one that doesn't, because there's no online account connected to your install for any of them.
If you're reasonably technical, you can make nearly any use-case work on nearly any distro, but if you have choice paralysis, my top recommendations would be CachyOS if you plan to play games, and Mint otherwise.
Personally I'm happy with EndeavourOS. I picked it to find a general purpose distro similar to the Steam Deck (KDE and arch based) but with a more user-friendly installer.
Pretty much all of them. None require online accounts or anything like that. Browser choice is probably more important.
For something that just works I recommend Fedora or Ubuntu. It's what I'd put on my mom or wife's PC.
Currently using Omarchy on my laptop though which is a tad more exotic, it's Arch + Hyprland and is pretty polished for that stack (at least the current version, 4.0) but still a tiny bit of jank.
Genuine question: does Linux have an AI image editor as easy to use as the win11 paint/photos?
> Some say "i do nothing illegal" "have nothing to hide".
I hate how pervasive this argument is. I'm so tired. Sometimes I wish they'd get the total panopticon they want so much. I'm sure the government will be able to find some crimes to hang them with.
The best response is always:
"That's not up to you."
When people claim they have nothing to hide, always point out that's not up to their determination. That freaks them out, it disarms their shrink-from-confrontation move.
And you can point it out super fast, in a plain six word statement. No need to launch into a deep discussion unless prompted.
Alternatively, simply respond with: yes you do. When they reply: "what?" - "every single thing you have ever done wrong across your entire life." Everybody has done something they would prefer to keep hidden, the cowards just lie about it.
Just because I have nothing to hide doesn't mean I have anything I want you to see.
People are entitled to privacy because they enjoy it. No further justification is needed.
I always say, "okay, unlock your phone and give it to me for 30 minutes". of course they refuse. "so you don't give your phone to a friend for half an hour, but it's fine if the government and intelligence agencies spy on you 24/7?"
many games work flawlessly on Linux now. enough to make the switch anyways. a lot more than on mac.
Scanning the comments, I see some curiosity and outrage but little recognition that this is legally required in places like California and Colorado and Texas and probably some more places.
And federally, the C2PA strongly encourages digital providence albeit without legal consequences... yet.
All AI content coming from companies that service the US market are watermarking things.
> In other words, “generated locally” does not mean that the complete operation is local.
That sounds like a privacy violation that the DPAs should look into.
Edit: Apparently it's disclosed somewhere. Still, that defeats the entire point of local generation...
It's for our safety, so when Kathy in the primary school steals Beatrice's picture in paint, miss Wallingford will tell who was the original author
Do we really need more examples of why local LLMs are an absolute necessity?
Commercial companies with closed-source software, cloud software will always betray you.
Use this instead!!!
https://jspaint.app/
"inivisibly"? for 9 hours this was invisible...
Actually Microsoft is doing this since the 90s with Word documents. Did they ever pause this practice?
Use free software. Proprietary software is used by its owners to control you. This is nothing new, just another example to add to the countless ones we already have.
This is not ok.
"Apparently, the recent Claude Code text-watermark announcement also played a role in prompting me to think about this possibility."
Extremely odd way to write. Are the writer's own thoughts invisible to him or her?
You might think you have control over what causes you to think this or that, but that's only an illusion.
awesome breakdown of the process you took. reverse-engineering is crazy now with AI. IP is dead
this also reminds me of what got me hooked on CS in the first place: a simple java steganography app in cmsc150
Thanks Microsoft, for adding my signature so I won't have to claim authorship when it ends up in a museum in 200 years, and the NSA archives are declassified for art historians filing a FOIA in 2226, who find out, "yep, it was from his PC."
Ms paint slop being hung in a museum? Now that's a dystopian future!
No, I wasn't suggesting that. I was saying that if there was digital art (human made) aesthetically significant that a curator would want to display it in a museum, Microsoft's GUID supplied to a data collection agency would make it possible to retrieve if ever/whenever that data were declassified (assuming it isn't purged)
It's possible a very bad curator with a terrible taste in art might select slop to display, but I was refering to "fine art" or at least finer art that is digital.
According to It's FOSS,
:It's FOSS
3h •
Microsoft quietly embeds a hidden tracking identifier in every AI-generated image you create using Paint or Photos on Windows.
A researcher discovered that these apps embed a server-issued GUID (a globally unique identifier) as an invisible watermark in locally generated AI images.
The watermark is tied to the prompts you type. And since those prompts are associated with your Microsoft account, Microsoft could "theoretically" trace any watermarked image back to the user who created it.
This is recycling an idea from the 80s. Back then, laser printer manufacturers added tiny yellow dot patterns to every printed page. With this, they could identify the printer.
Now Microsoft has brought the same idea to AI image generation, and added it to two of the most widely used default Windows apps.
Microsoft had disclosed its AI safety measures in official documentation, but the practical implication, that your output image file carries an invisible fingerprint linked to your identity, was never clearly mentioned, of course.
The researcher found this by reading Microsoft's own published documentation and analyzing the watermarking mechanics.
AI watermarking is a requirement by law in the EU. But "this image was generated by AI" is different than "this image was generated by AI by Mr. Winston Smith".
For anyone who values privacy, this is something to worry about. If you generate an image locally, on your own device, why should it carry a tag that can identify you to the company whose software you used?
But then, anyone who values their privacy won't be using Microsoft Windows anyway."
Since the cat is out of the bag, I wouldn't be surprised if Microsoft generates an invisible watermark for ALL files and not just AI generated ones. The real story is that since AI watermarks are possible, there is no technical barrier to them adding personal EXIF metadata to a file where it can't be seen, removed, or decrypted, whether it is media, a document or other file.
Interesting. I really didn't think watermarks would end up going anywhere, but maybe with enough adoption we can have easy ai generated content flagging after all?
Not every generative AI model will watermark. Especially not adversarial and disinformation models.
So as usual, exactly the things you want it to work on it won’t.
It actually might make the new horrible world even worse. Imagine the populace getting used to a AI image detector flagging things as fake using this fairly easily defeated GUID marker system. Most people are just making memes or cat videos and don't even try to remove this so eventually the populace starts to believe these things actually work.
Now some one slightly more sophisticated starts creating deepfakes of a woman and uploading them or fabricating video of an political event without this marker. The subject protests it's fake and AI generated but a loud majority of ignorants feed it into Microsoft AI detector and call you a liar and say it's confirmed real. Most people don't know any better and eat it up because a computer said so.
> the populace starts to believe
US Social Security Numbers are a useful analogy: The designers knew they weren't something anyone could securely depend on, and told people not to do it... but companies did it anyway, for their own convenience and cheap security-theater. Ultimately a lot of individual victims suffered for it.
It would have almost been better if one big incident blew the "knowing an SSN means something" myth apart early on.
Or puts the marker on real footage of, say, Elon doing a Hitler salute, then starts pointing how that actually didn't happen and was AI.
Fucking spyware.
Soon it'll literally be "you need a license to use this technology" if we're not there in some form or another already.
It literally already is? What happens if you pirate windows but don't do it properly?
This muddle of an article makes it totally unclear to me if this GUID is attached by the AI generation call or every image I edit in MS Paint. I'm going to assume the former unless they release a clarification.
Edit: Actually trivial to test, just save an image of all black and see if it suddenly has other values on save.
Assuming the watermark works like the upcoming AI watermark for text, then it uses the content's entropy to embed the information. An all-black image doesn't have much entropy, so it's unlikely you'd find anything.
I guess that makes sense. So import an image of the mandelbrot set you generated and save it, and see if any pixels change.
Don't use them if it does not fit your requirements. The last ten years I am more that happy with Lazpaint or Libreoffice Draw. The last year I have added Imglass to the mix.
Great detective work.
With regards to Microsoft being ... uhm ... "transparent":
> The same page says that generated images:
> “will contain C2PA manifest helping users identify that it is an AI generated image.”
> [...] That is a meaningful disclosure of remote filtering and C2PA metadata.
> C2PA manifest contains a GUID identifying the invisible pixel watermark
> Calling the feature “Content Credentials” is accurate, but it does not > make this prompt-associated identifier obvious to a Windows user.
I don't think this is accurate, because without that detective work, most people would have no idea that Microsoft tags and tracks the images here. This reminds me of printers printing identifiers to ID individuals. What this to me means is that I can no longer use any such Microsoft services, because there is no trust for me here. Microsoft sniffs on me, if I were to use these software products. AI is a big spy-op too.
Microsoft could easily admit "we watermark all your images, whether you like it or not", but corporate speak forbids this and they don't really admit to it. They do not use the word watermark officially, but their .dll names reveal it. That means they resort to deceit and propaganda.
It really is time to strengthen the whole open source ecosystem. I no longer want my taxpayer's money to go into traitorous US companies that abuse EU citizens here. (Note: the same would apply to EU companies, but the USA dominates the software sector, unfortunately. This also has to change permanently.)
With every new thing Microsoft goes trying so hard to come out as the good person, but they just cannot help themselves but to inject their evil. It had to be changed with Nadla coming, but their enshitification is just keeps getting worse and worse. What on Earth is this.
> The two apps send the prompt to a remote server for moderation
Why? What needs tobe moderated locally?
Misleading title IMO... here they are using "locally generated output" to specifically mean only AI-generated images, not your "500hrs in MS Paint" hand-made masterpiece.
Solved by not using closed source SW, period.
Until proven otherwise via open-source audits and reproducible binaries, you should assume that all commercial photo editing software is embedding watermarks in any way they can get away with. This includes the professional software that you pay quite expensive licenses for. You should also assume that even if they're not today, they will eventually be coerced into doing so, in the same way that printers embed tracking dots.
You should however not accept this state of affairs even if you exclusively use open source software because the next step is that it become illegal to have photo editing software that doesn't include the tracking information needed to protect the children, fight terrorists or whatever the boogeyman of the day is.
It's already illegal to not watermark an AI image.
Oh I didn't know I was going to break the law today just using automatic1111 stable diffusion. I'll call my lawyer.
You do that.
Could microslop be more evil?
They're pretty bad, but yes I think so.
Solution: Don't AI generate images! I think this is a good way to discourage people from making slop.
Gross. Unnecessary. Anti consumer.
I'm honestly surprised they don't upload the entire image to apply the watermark server-side, to the point that I'd like someone else to repeat this investigation and confirm it's not happening.
Shipping the watermark generator on user's machine would make it very easy for someone motivated to find how it works and write a "watermark remover".
Ya know, this would probably be pointless but if I were a programmer (I'm not -and refuse to be a vibe coder) I'd probably just grab appropriate libraries and make my own replacements for this shit. GLTK+ (?) is an obvious choice to use for recreating mspaint, and to replace notepad -I was told making a simple editor was an excercise they have you do when you learn programming to begin with?
I already replaced the 'solitaire' games suite with pysol running on WSL2 and it's a vast improvement!
tldr -if MS is going to screw us, why don't we mitigate it by using replacements?
I would've thought the obvious API to recreate mspaint was Win32
I think it would be nice if all cameras digitally signed pictures. You could prove the photo was real.
What would prevent someone from applying the same algorithm on a computer to sign arbitrary images?
Presumably the OP is proposing something like a TPM attached to the image sensor that signs the sensor output or something like that. You can’t sign it because you can’t get the key out. The key could be per-camera and be a published list.
I suppose a dedicated fraudster could still stage an appropriate scene. An appropriately lit matte image might even suffice.
Please note: A well-funded organization, like a government, can derive the keys from the TPM hardware using an electron microscope.
Also note that there are plenty of viable attack methods that don't even require key extraction, such as asking the TPM to sign arbitrary data.
That's assuming they don't just have a backdoor inserted expressly for this purpose. Now only the rich or powerful can produce an "authentic" recording of an event and the same system can be used to hunt down whistleblowers and political enemies by looking up who bought the camera.
At the very least there is always the analog hole where you point the camera at a sufficiently high quality screen. The sensor can't tell whether the light it receives was emitted by sunlight reflecting (and refracting) from someone's face or by a bunch of LEDs pointed at the sensor.
Keys could be stored in something like TPM on Camera, and could sign the image. The key could then be verified from the camera itself to prove the authenticity of the image.
If we as a society deemed it necessary, the camera manufacturer could also provide a list of keys for devices they have manufactured. And an image/key could be provided, and the manufacturer could verify the authenticity that way.
The TPM signing could be tied into the sensor hardware itself, making it difficult, but not impossible, to sign arbitrary images with the TPM.
If I steal your camera while you're on vacation, do I then gain proof of ownership of your photos?
If I need to reset TPM, how do I reclaim photos I took previously?
The point of the key (as the for some reason dead comment points out), is not to prove who took the photo, but what device took the photo. Just as if someone stole a hardware token with a PGP key on could impersonate the owner. The key itself doesn't prove a person, just a device.
If a key was reset, a revocation of the original key could be issued, showing that the key was associated with the device for this particular time span. And then the new key registered.
This is ripe for abuse though, so resetting a TPM might not be accepted for this use case. I'm not certain in which case you'd want to reset a TPM for this use case though. Unless you took enough photos with the device to risk a birthday attack if you were using something like ECDSA.
Some problems with this particular system:
If the TPM signs the original image taken by the camera, then even the slightest image processing on another device would invalidate the signature. Routine changes like cropping, scaling, converting between image formats / quality levels, or applying image filters would invalidate the signature.
An adversary can manipulate the date/time settings on the camera and forge evidence to frame someone. "This cryptographically signed photo, with timestamp, proves that you were here at this time!"
And camera sensors can get damaged and need replacement. But if replacement of the TPM-and-sensor chip is allowed, then you can just as well replace it with a sensor from another camera. In which case a signature from a specific TPM+sensor doesn't prove that a specific camera took the photo, at best it might be evidence that a specific camera model took the photo.
If the manufacturer will happily ship a replacement TPM+sensor for a specific camera, someone can fraudulently claim that their sensor is broken and be given a new TPM+sensor for the same camera. And there will now be multiple TPM+sensors in existence that have the same key. Since this module can be switched between cameras, there could be multiple cameras that signed a given picture.
To ship (identical) replacement TPMs, the manufacturer would also need to know the private keys of all the cameras, so the manufacturer could forge arbitrary signatures at will.
Finally maybe the manufacturer doesn't want to deal with the above problems and decides that repairing the camera's TPM is not allowed after all, or that only the manufacturer is allowed to repair a camera, but then they may be in violation of right-to-repair laws in several jurisdictions.
Or, you know, using the totally-real-picture camera to take a photo of an AI-generated scene?
If C2PA and similar signature systems ever become a meaningful authenticity signal, they will create huge incentives for someone (potentially a state actor) to hack at least one camera in order to sign images of arbitrary provenance with its private keys. This will in turn inevitably lead to the same game of cat-and-mouse we have seen play out with video DRM schemes, where keys are regularly extracted from exploitable devices and used to decrypt as much content as possible before the device gets blacklisted entirely (harming all legitimate owners in the process).
I've done this btw. I went for the Pixel Camera app since they were the ones bragging the hardest about their "security". Writeup + PoC should be dropping some time tomorrow. Despite 90+ days from initial report, it remains unpatched.
Some proof: https://verify.contentauthenticity.org/?source=https://retr0...
I could also paste a privkey + cert chain in here but el goog's lawyers might not like that.
Published: https://www.da.vidbuchanan.co.uk/blog/android-c2pa.html
I don't think that that's a good idea, because it implies trust when there actually isn't any.
Being signed with something just means that whoever has that key could've done that. That might be the owner of a specific camera, but it might also be the camera manufacturer, anyone else in the supply chain, or anyone who dumped the key.
Imagine fake evidence signed with the same key as your camera uses being used in court against you. And the court believes it because it has this signature attached and those computers are very secure and all.
Exactly that will happen. Not widespread, of course, but it will.
When I was in photography class in college, I created backplates in photoshop for still life portraits of small trinkets I was photographing. The photos were taken on black and white film and developed in the campus dark room. Led to some impressive photos. In our class's critiques, I explained how it was done. A lot of peers went from impressed to meh'd. The point: the black and white film laundered the new-age manipulation, and a digitally signed photo from a modern camera remains vulnerable to the same premise.
"I think it would be nice if all pens added a unique isotopic tracer signature to their ink. You could tell exactly who wrote everything."
"I think it would be nice if all typewriters had their unique fine-detail type artifacts registered with the government. You could tell exactly who authored a given document."
I think it would be nice if you took these ideas back to Stalinist Russia where they belong.
Stalinist Russia? Stalin would be absolutely dumbfounded by the level of tracking common in the west today.
He would love the image editing though.
> You could prove the photo was real.
No. You'd only ever be able to show that key material belonging to $specific_camera was used to sign/mark the image.
Was the camera manufacturer breached? Did somebody on the factory floor steal some keys during the provisioning step? Or did somebody build their own photo-sensor simulator and plug _that_ in to the camera's motherboard to feed it a "real" image? Before going _that_ far, just point the unmodified camera at a sufficiently high resolution display...
Well that was fast!
> build their own photo-sensor simulator and plug _that_ in to the camera's motherboard to feed it a "real" image?
Already been done!
https://hackerfactor.com/blog/index.php?/archives/1102-C2PA-...
TL;DR: Strong cryptography over untrusted data does not make the data more trustworthy.
do you believe this should be mandated by regulation, or voluntarily offered by manufacturers as a value-add feature? ("all" implies the former.)
How exactly would this work?
People take RAW photos. Load it up in a RAW editing tool. Manipulate it. Then load it in Gimp. Manipulate some more.
Will the final result have the signature?
And if it does, what use would it be?
In the imaginary dream world that Adobe, Google et al live in, the final file does indeed have a signature.
Each piece of software in the chain must use TPM-like technologies (yes, even GIMP) to make sure it's running a "legitimate" build of the software, on "legitimate" hardware, and re-sign the file at each step along the way (using keys provisioned during some flavour of remote attestation flow, or using a RA-authenticated remote-signing oracle).
The final file embeds every preceding manifest, so you can "verify" all the way back to the original.
If this all sounds patently unworkable, that's because it is.
OK, but given that GIMP is a general purpose tool, what use is the signature if all of them verify it, when I can drastically change the image to whatever I want it to be?
The manifests at each step can embed a thumbnail (although this is optional, iiuc!), so looking at the thumbnail history it should be obvious that the edit was significant.
Yeah - I totally would not support that!
I can't wait for poking memory of applications running on my computer to become a felony.
It already is.
No it isn't, cheatengine exists, Q.E.D.
If you use cheat engine to inject child porn into an image viewer is it legal?
And then some incriminating photo is made with your forged signature. "Not like that, not like that!"
Yet another reason to switch to Linux.
My honest reaction: https://files.catbox.moe/4ylzsq.png