Meta's Un-Stable Signature
The article analyzes Meta's implementation of digital signatures for content provenance, arguing that their approach has critical flaws. It claims Meta's system fails to maintain cryptographic integrity of signatures when content is resized or re-encoded, rendering the signatures unstable and unreliable for verifying the authenticity of images and videos across platforms.
Background
- **Meta** (Facebook, Instagram, WhatsApp) uses **perceptual hashing** to detect near-duplicate images — a technique that creates a "fingerprint" based on visual similarity, not exact pixel match. This is critical for storage deduplication and content moderation.
- **Neal Krawetz** (HackerFactor) is a security researcher specializing in photo forensics. He regularly reverse-engineers large platforms' hashing systems.
- Krawetz found Meta's perceptual hash is **unstable**: trivial changes (resizing, re-encoding, cropping) produce wildly different hashes, causing many true duplicates to be missed. Simultaneously, it **collides** on completely different images (dog vs. landscape), falsely flagging them as identical.
- **Why it matters**: Meta stores exabytes of user content — a broken dedup wastes infrastructure money. If used for CSAM/harmful-content detection (common industry practice), high false-positive or false-negative rates have serious consequences.