New Whitepaper: Enhancing Visual Trust in Messaging Apps

Messaging apps have become the front line of visual evidence. When a crisis unfolds, the photos and videos that reach journalists, human rights defenders, and diaspora communities rarely arrive through newsrooms or verified archives. They arrive in a chat thread, forwarded by a relative or a trusted contact, stripped of context and of nearly every piece of data that could show where they came from.

Today we’re publishing Enhancing Visual Trust in Messaging Apps, a whitepaper developed jointly by Guardian Project (Proofmode), Okthanks, and Rights Action Lab (RAL). It describes how we integrated Proofmode and C2PA Content Credentials into RAL’s browser-based secure messaging app, and the design patterns we think any messenger can adopt.

Our thesis is simple: a secure messenger should use every available signal, from cryptographic Content Credentials down to basic file heuristics, to tell recipients what is known about a piece of media, how confidently it is known, and what cannot be verified at all. Instead of issuing opaque trust verdicts, the app should show the evidence and help people reach their own conclusions.

RAL has been instrumental in Proofmode’s development and in evaluating how it works in the real world, by providing partial funding, leading user testing to make sure Proofmode is easy to use, and testing this integration inside their communication tool.

The problem: trust breaks down in the thread

Public discussion of synthetic media tends to focus on sophisticated deepfakes. In practice, the misinformation that moves through messaging groups during a crisis is usually much simpler. It succeeds because the channels it travels through erase the clues that would expose it. We see three recurring patterns:

• Resurfaced historical media. Authentic footage from past events gets re-shared as breaking news. Video of South African firefighters from prior years, for example, keeps resurfacing framed as a present-day emergency response. Nothing about the pixels is fake; only the implied date and place are, so tools that look for manipulation won’t flag it.
• AI-generated synthetic content. Generative tools now produce realistic but entirely fabricated scenes, like the viral animal-rescue clips that circulate every wildfire season. This material has no real capture history, and its synthesis artifacts are rarely visible on a phone screen.
• Stripped metadata and screen captures. Mainstream messengers re-encode media and discard metadata in transit. People forward content as screenshots, which replace the original file with a new one that has no history at all.

By the time evidence reaches the person who needs to evaluate it, every signal of where it came from has usually been removed.

Design principles

Designing provenance features for people in hostile environments means balancing three goals: evidence must be trustworthy, the people who create it must stay safe, and the interface must work for non-experts under stress. Four principles guided the work:

• Harm reduction for at-risk groups. Raw metadata can endanger lives. GPS coordinates, device serial numbers, or even a phone model can help an adversary identify a source. Transparency has to establish the integrity of content without exposing its creator.
• Context-sensitive exposure. What is appropriate to reveal depends on where media is shared: the size of a room, who is in it, and the risk of it being seen by unintended third parties.
• Privacy-preserving defaults. Vulnerable users are protected without configuring anything. Privacy holds unless someone deliberately chooses otherwise, and that choice is always visible and reversible.
• Progressive assurance. Cues clearly separate cryptographically verified provenance from unverified metadata and from simple heuristics, without discrediting the weaker signals, which are often all a recipient has.

A layered signal model

RAL’s messenger is a secure chat platform co-designed with human rights advocates and digital security trainers, with rooms that are private and encrypted by default. We approached the integration from the point of view of the people receiving media: diaspora members getting evidence from their community, journalists seeking eyewitness accounts, and human rights advocates gathering records for their research. That led us to treat provenance as a stack of signals rather than a single yes-or-no check.

• Cryptographic layers. A C2PA manifest is a signed record embedded in the file that can describe how it was created (captured by a camera or generated by a model) and what edits were made. Proofmode adds signed hashes, device and sensor metadata, and a capture timestamp. Both can be checked for tampering.
• Descriptive layers. EXIF, XMP, and IPTC metadata often record the camera model, capture date, and editing software. It’s valuable context, but anyone can edit it, so it can’t be treated as proof without a signature.
• Heuristic layer. Even when metadata is gone, the file still says something: dimensions that match a phone screen, an aspect ratio, a format, or signs of earlier compression.

When a sender chooses Original quality, the app sends the unmodified file, so its Content Credentials and metadata travel with it. Compressed re-encodes the image and removes that data, which is the right default in some contexts. In end-to-end encrypted rooms the server can’t see the media, so all of this analysis happens on the device.

In-line interventions

Content Credentials only help if people see them. In a messenger, provenance needs to be visible at two moments: before media is sent, so the sender understands and controls what is shared, and after it arrives, so the recipient can weigh it in context.

We combined Content Credentials with the other signal layers to produce short, plain-language cues we call interventions. Each one answers a single question a recipient is likely to have. We chose five, based on the kinds of media diaspora communities are actually receiving today.

Because interventions draw on the whole signal stack, they work with or without Content Credentials. A screenshot with no metadata can still be labeled as a screenshot; a file with a valid manifest earns a stronger, verifiable label. The five map directly to the problems above: “Older than 3 months” addresses resurfaced media, “Generated with AI” addresses synthetic content, and “Screenshot” and “Modified” flag the lossy, recontextualized copies that dominate forwarded threads.

Context-aware privacy defaults

Metadata can expose people. We had to deliver media transparency without revealing anything about a sender that they hadn’t knowingly chosen to share. Our design research made the stakes concrete: communicators in the diaspora were uneasy even about showing the model of the phone that took a picture.

WITNESS’s research on C2PA Content Credentials and the Surveillance Risk describes a person who documents something that could put them in danger. They ask that the image not be published under their name, but the embedded credential still carries their name and device identifiers. Photos shared in messaging apps eventually travel through other systems, and what was meant to be verified privately may need to be stripped when used publicly.

We resolved this by making the defaults depend on the room:

1. Group rooms keep compressing images and withhold media details unless the sender explicitly chooses to share them.
2. Direct message rooms, where evidence is usually exchanged and trust is higher, default to sending the original file and its metadata whenever Content Credentials are present.

In both cases, interventions stay visible as a hint that more information exists, which raises awareness of provenance without forcing disclosure.

Progressive assurance

Because the app shows everything that can be known about a piece of media, it also has to be candid about how much of it can be trusted. Ordinary metadata may have been altered; Content Credentials let a recipient confirm that it hasn’t. The interface needs to make that distinction clear without implying that unverified information is false.

We explored several models and chose restraint: short, neutral messages that say whether the details shown can be verified, and point to where verification can happen. We deliberately avoided alarm-style warnings and numeric trust scores, which invite people to outsource their judgment instead of using it.

The end-to-end experience

Together, these pieces form a single flow that starts before the send button and continues after delivery. The sender sees exactly what will be shared and picks the right trade-off for the room. The recipient sees a cue in the thread, can open the details, and is told plainly whether those details can be independently verified.

Limitations and open questions

We want to be clear about what this approach does not do:

• No provenance is not evidence of fakery. Most authentic media today carries no Content Credentials. A missing manifest should never be treated as a negative signal, and our design doesn’t.
• Heuristics can be gamed. File dimensions and metadata can be forged, which is why those signals are always labeled as unverified.
• Credentials prove origin, not truth. A verified camera capture can still be framed misleadingly. Provenance narrows the question; it doesn’t answer it.
• Verification shouldn’t leak the evidence. Deeper verification currently means uploading media to a web-based Content Credentials verifier. For sensitive material, verification that happens entirely on the device is better.
• Adoption is uneven. Cryptographic layers become more valuable as more cameras, editors, and generators sign their output.
• Storage and bandwidth matter. Sending uncompressed originals can be hard for people on low-storage devices and slow connections.

A model for any messenger

Embedding Proofmode and C2PA Content Credentials directly into a secure messaging workflow shows that media provenance can be both accessible and privacy-preserving. These patterns aren’t specific to one app. We think they offer a practical model for any messaging platform that wants to support visual trust:

1. Preserve provenance end to end whenever a sender chooses to, and make it very clear how to opt out.
2. Combine every available signal, and label each with the assurance it can actually support.
3. Translate provenance into a small set of plain-language cues shown in the thread.
4. Let the context of the conversation, not a global setting, decide what is exposed by default.
5. Inform judgment rather than replacing it.

Guardian Project, Okthanks, and Rights Action Lab welcome collaboration with platform developers, standards bodies, and civil society partners who share these goals. Read the full whitepaper below, and get in touch if you’d like to work with us.