Hacker News Reader

The way I read it, I thought they would just check if the file hash exists on their end. Is that not the case?

That’s incompatible with the file not leaving your browser, which you can trivially verify with the Network tab in chrome (or wireshack, etc).

This is just a C2PA metadata checker.

Why? The browser can see the file and contents so it can calculate and send the hash over without the actual file ever leaving the browser.

Strictly speaking, properly checking C2PA metadata requires network requests in the general case, because you need to check if the signing certificate has been revoked or not via OCSP.

But in anthropic's use case they can probably get away with just pinning their own certs in the verification webpage.

> I thought they would just check if the file hash exists on their end

That would invalidate the hash on minor changes. Too much effort and not enough return.

Reply on news.ycombinator.com