5 ms·

EDIT: It appears they are using perceptual hashes, which are likely much more prone to collisions. The following math does NOT apply to the tech Apple is using

EDIT: It appears they are using perceptual hashes, which are likely much more prone to collisions. The following math does NOT apply to the tech Apple is using. >> I mean, who's to say that my hash is actually what they think it is... Let's do the math. assume they are using a UUID for the hash. "For example, the number of random version-4 UUIDs which need to be generated in order to have a 50% probability of at least one collision is 2.71 quintillion" [1] "The odds of This number is equivalent to generating 1 billion UUIDs per second for about 85 years." And that's for just 1 collision between two random photos. Considering that the pool of bad hashes is not going to be 2.7 quintillion but a fraction of that, this is more than adequate. And of course they could use a longer checksum if that's the concern. (Not to take a stance on the parent issue, just to explain that hash's are probably a higher standard of proof than DNA matches) 1. https://en.wikipedia.org/wiki/Universally_unique_identifier#Collisions https://en.wikipedia.org/wiki/Universally_unique_identifier#...

mod50ack 5y ago
They're doing perceptible hashes, not file hashes. This was covered earlier in a different article posted here.
sebzim4500 5y ago
What if an attacker has intentionally produced an image with the same hash as a well known blacklisted image? Then they could send you the new image and fuck up your life.
- Causality1 5y ago
  Hell, what if you were browsing a site like Facebook or Imgur or Reddit, saw an abuse image, reported it, but it still lives in your phone's browser cache?
  - voxic11 5y ago
    This is exactly why I use firefox and switch it to in-memory caching only.
  - Reason077 5y ago
    I would assume those sites are already using the same, or similar, algorithms/hashes to detect blacklisted images?
CapitalistCartr 5y ago
But compare practice to DMCA Takedown notices. Lots of false positives, because there's no penalty for mistakes.
Ancapistani 5y ago
> "The odds of This number is equivalent to generating 1 billion UUIDs per second for about 85 years." If we're talking about random files, sure. What if the files are intentionally created to match the desired hash? The malicious actor doing this could be a private party intending to disrupt your life, but it could also be law enforcement as a means of gaining access to your device when it would otherwise require a warrant.
- JKCalhoun 5y ago
  Couldn't someone that motivated come up with a dozen other ways to frame someone? This seems a little alarmist to me.
  - Macha 5y ago
    They could come up with a dozen other ways apart from swatting too, but swatting still happens and we generally agree that it's a problem where actions should be taken. Political debates over whether that means the police should act in a less militarised fashion, or harsher sentences for culprits are ongoing, but cutting down on avenues for life ruining abuse is generally supported. So why would we open up new ones?
    - judge2020 5y ago
      SWATing is actually the absolute cheapest option - if you want to ruin someone's week from across the nation (or across the ocean), your best bet is a burner phone calling the person's local 911 with a threat that warrants a SWAT team response (I am of course not advocating for anyone to do this, just explaining the process malicious actors currently use to trigger these). Outside of that, you'd need to pay a lot of money for something like a PI or obfuscated malware to steal PII or credentials from the victim.
  - taylorfinley 5y ago
    I hope you don't ever run afoul of an internet mob from somewhere like 4chan! They might SWAT you while DDOSing your IP and doxing you then emailing your iphone dozens of photos that collide with CSAM perceptual hashes.

mod50ack 5y ago

They're doing perceptible hashes, not file hashes. This was covered earlier in a different article posted here.

sebzim4500 5y ago

What if an attacker has intentionally produced an image with the same hash as a well known blacklisted image? Then they could send you the new image and fuck up your life.

Causality1 5y ago
Hell, what if you were browsing a site like Facebook or Imgur or Reddit, saw an abuse image, reported it, but it still lives in your phone's browser cache?
- voxic11 5y ago
  This is exactly why I use firefox and switch it to in-memory caching only.
- Reason077 5y ago
  I would assume those sites are already using the same, or similar, algorithms/hashes to detect blacklisted images?

CapitalistCartr 5y ago

But compare practice to DMCA Takedown notices. Lots of false positives, because there's no penalty for mistakes.

Ancapistani 5y ago

> "The odds of This number is equivalent to generating 1 billion UUIDs per second for about 85 years." If we're talking about random files, sure. What if the files are intentionally created to match the desired hash? The malicious actor doing this could be a private party intending to disrupt your life, but it could also be law enforcement as a means of gaining access to your device when it would otherwise require a warrant.

JKCalhoun 5y ago
Couldn't someone that motivated come up with a dozen other ways to frame someone? This seems a little alarmist to me.
- Macha 5y ago
  They could come up with a dozen other ways apart from swatting too, but swatting still happens and we generally agree that it's a problem where actions should be taken. Political debates over whether that means the police should act in a less militarised fashion, or harsher sentences for culprits are ongoing, but cutting down on avenues for life ruining abuse is generally supported. So why would we open up new ones?
  - judge2020 5y ago
    SWATing is actually the absolute cheapest option - if you want to ruin someone's week from across the nation (or across the ocean), your best bet is a burner phone calling the person's local 911 with a threat that warrants a SWAT team response (I am of course not advocating for anyone to do this, just explaining the process malicious actors currently use to trigger these). Outside of that, you'd need to pay a lot of money for something like a PI or obfuscated malware to steal PII or credentials from the victim.
- taylorfinley 5y ago
  I hope you don't ever run afoul of an internet mob from somewhere like 4chan! They might SWAT you while DDOSing your IP and doxing you then emailing your iphone dozens of photos that collide with CSAM perceptual hashes.