Hacker Factor (Neal Krawetz)

So when you run SIFT on an image, one gets dozens (maybe hundreds) of SIFT features back. The trouble with SIFT features is that each individual SIFT feature is a local image descriptor -- it describes a single point in the image. One can't just append the two lists of SIFT descriptors together and do a Hamming comparison on them, because it's not guaranteed that both images will have all of the same SIFT descriptors, nor that they would be in the same order.
When you want to do image comparison on image descriptors, one must compare every local feature with every local feature in every other image. This is great for comparing two images together, or for finding where one image is located in another image (homography matching), but this does not scale for large image sets.

In contrast, descriptors like perceptual hashes look at the entire image, and so are a _global_ image descriptor.

There are ways to convert local SIFT image descriptors into a single global image descriptor for doing more rapid lookup (Bag of Visual Words is one technique that comes to mind), but SIFT and pHash really are in two categories all their own.

More info on pHash:
https://hackerfactor.com/blog/index.php%3F/archives/432-Looks-Like-It.html

Example of SIFT for fine-grained image matching:
https://docs.opencv.org/3.4/d1/de0/tutorial_py_feature_homography.html

These are two articles I liked that are referenced in the Python ImageHash library on PyPi, second article is a follow-up to the first.

Here's paraphrased steps/result from first article for hashing an image:

1. Reduce size. The fastest way to remove high frequencies and detail is to shrink the image. In this case, shrink it to 8x8 so that there are 64 total pixels.

2. Reduce color. The tiny 8x8 picture is converted to a grayscale. This changes the hash from 64 pixels (64 red, 64 green, and 64 blue) to 64 total colors.

3. Average the colors. Compute the mean value of the 64 colors.

4. Compute the bits. Each bit is simply set based on whether the color value is above or below the mean.

5. Construct the hash. Set the 64 bits into a 64-bit integer. The order does not matter, just as long as you are consistent.

The resulting hash won't change if the image is scaled or the aspect ratio changes. Increasing or decreasing the brightness or contrast, or even altering the colors won't dramatically change the hash value.

https://www.hackerfactor.com/blog/index.php?/archives/432-Looks-Like-It.html

https://www.hackerfactor.com/blog/index.php?/archives/529-Kind-of-Like-That.html

Ultimately, you have to trust some photographer or organisation.

The camera sensor is not a trusted input. Nothing can prevent somebody pointing their camera at a high resolution screen displaying a manipulated image. Or a staged scene. No image signing mechanism can prevent this kind of attack.

There are manipulation detection techniques, but they are imperfect. And even if you verify the image is an unmodified camera original, you still have to analyse the context surrounding the image (what is portrayed in the image, does it line up with other reports, who is the photographer etc.) to determine if it is actually a true.

It is trivial to digitally sign text, but a signature on a string doesn't mean that string is telling the truth. It just means someone signed it.

Highly recommend http://www.hackerfactor.com/blog/ for in depth digital image forensics content.

Im not sure if this has changed since my source was published but according to this article[0], the Tor Blocks in russia are not nation wide and originate from individual ISPs:

>"According to OONI, it wasn't all of Russia blocking Tor; it was 15 out of 65 subnets. Moreover, each censorship instance used a different blocking method"

>"If the censorship was government-sponsored, as the Tor Project suggested, then I would expect it to be much more widespread and consistent. This looks like individual blocking efforts. As OONI noted, the blocks followed a "recent spike in the use of Tor bridges (used for circumventing Tor blocking) in Russia."

Though the situation might be totally different now considering the recent events.

[0] https://www.hackerfactor.com/blog/index.php?/archives/944-Tor-0day-Snowflake.html

From the actual complaint:

As early as 2007, Dr. Neal Krawetz of Hacker Factor Solutions published a white paper entitled "Point-of-Sale Vulnerabilities" (the "White Paper"). According to the White Paper, POS systems "provide virtually no security" and few POS systems "implement best practices for handling sensitive information, such as the Visa standards for credit card management."6

and

Thereafter, at least 17 copies of the White Paper were downloaded to a domain owned by Target, the most recent download occurring in May 2013. Target personnel used the search term "POS vulnerability" to locate and download the White Paper. As is now apparent, Target did not heed the White Paper or implement its suggestions.

[edit] link to the Dr. Krawetz paper: http://www.hackerfactor.com/papers/cc-pos-20.pdf

Considering [1], I’m going to challenge that their techniques are currently even mildly effective. Given the absolute academic malpractice these papers are pushing, I’m calling BS; while they want to watermark it, they clearly aren’t actually able to. For images. Which are drastically easier than text.

Their interest is irrelevant in the face of technical impossibility. And that’s before you get into other people who don’t care and will just build adversarial tools to bypass the attempted watermarks. It’s a losing useless battle. Google and OpenAI engage in it to try to catch competitors when there’s a lawsuit or to try to clean their datasets clean.

But it’s absolutely unusable for something like “did someone cheat”.

[1] https://hackerfactor.com/blog/index.php?/categories/1-Image-Analysis