← Monday, October 5, 2026SecurityDeep dive

C2PA metadata can make a photoshopped image appear to predate an event

da.vidbuchanan.co.uk 4 min read Editor score 7/10

A photoshopped image uses C2PA metadata to appear to show lottery numbers before the draw, despite its verifiable signature and timestamp. The demonstration highlights why signed provenance alone may not establish when an image was actually created.

What: C2PA metadata can include signatures and a timestamp from a remote Time Stamp Authority (TSA).
How: C2PA permits byte-range exclusions; excluding the entire file lets a signer alter it without invalidating the signatures or TSA timestamp.
Why it matters: Engineers validating content provenance must account for what signatures exclude, not treat a valid timestamp as proof that file contents stayed unchanged.

A C2PA manifest gets a timestamp signature from a TSA through RFC 3161. Sketched from the article's own text.

Read on da.vidbuchanan.co.uk → Hacker News · 7 comments

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.