How to Hack Time, With C2PA
Summary
The article demonstrates a proof-of-concept showing how C2PA's exclusion ranges can be misused to forge signatures over modified content without invalidating the timestamp proof. It discusses the role of Time Stamp Authorities (TSA), RFC 3161, and potential on-device trusted time solutions, highlighting risks to digital provenance and suggestions for stricter verification and format-specific exclusions.