What's this about?
A security researcher examined C2PA implementations on Android and found the cryptographic provenance guarantees do not hold up in practice — the chain that is supposed to prove a photo came from a real camera can be subverted.
What exactly is C2PA?
C2PA is an industry standard for cryptographically signing media at the moment of capture, so a photo can later prove it came from a real camera rather than a generative model. It is the main technical answer the industry offers to AI-generated imagery. The catch is that the signature only proves the private key was used — if that key can be extracted from a phone, anyone can sign a fake as genuine.
What's the community saying?
The discussion focuses on whether provenance can ever work on general-purpose consumer hardware, given that the signing key has to live on a device the user physically controls. Several note this is the same fundamental problem as DRM, with the same historical outcome.