3 ms·

> "The odds of This number is equivalent to generating 1 billion UUIDs per second for about 85 years." If we're talking about random files, sure. What if the

> "The odds of This number is equivalent to generating 1 billion UUIDs per second for about 85 years." If we're talking about random files, sure. What if the files are intentionally created to match the desired hash? The malicious actor doing this could be a private party intending to disrupt your life, but it could also be law enforcement as a means of gaining access to your device when it would otherwise require a warrant.

JKCalhoun 5y ago
Couldn't someone that motivated come up with a dozen other ways to frame someone? This seems a little alarmist to me.
- Macha 5y ago
  They could come up with a dozen other ways apart from swatting too, but swatting still happens and we generally agree that it's a problem where actions should be taken. Political debates over whether that means the police should act in a less militarised fashion, or harsher sentences for culprits are ongoing, but cutting down on avenues for life ruining abuse is generally supported. So why would we open up new ones?
  - judge2020 5y ago
    SWATing is actually the absolute cheapest option - if you want to ruin someone's week from across the nation (or across the ocean), your best bet is a burner phone calling the person's local 911 with a threat that warrants a SWAT team response (I am of course not advocating for anyone to do this, just explaining the process malicious actors currently use to trigger these). Outside of that, you'd need to pay a lot of money for something like a PI or obfuscated malware to steal PII or credentials from the victim.
- taylorfinley 5y ago
  I hope you don't ever run afoul of an internet mob from somewhere like 4chan! They might SWAT you while DDOSing your IP and doxing you then emailing your iphone dozens of photos that collide with CSAM perceptual hashes.
- Ancapistani 5y ago
  LEO have never, ever planted a baggie of weed in someone's car. Likewise, LEO would never, ever ensure that a picture that matched a known phash gets on a target's phone.
- elzbardico 5y ago
  Once someone develops the tool for that, it WILL become available in the wild. Then, any script kid will be able to "swat" you in a even more insidious way.
threatofrain 5y ago
Or what if you're a researcher who has downloaded a collection of these assets? Wouldn't you be a very high signal hit, beyond even actual perpetrators of crime? Would you need the protection of an umbrella organization to do research? Or register with the government perhaps?
- skinkestek 5y ago
  I'm as against this as anyone,but to be blunt: This is digital biowarfare material of the worst kind and should be handled as such. Any researcher downloading this material to anything but lab machines should probably receive a visit from the relevant authorities to make sure they understand the seriousness of it.
- pseudalopex 5y ago
  The law doesn't have an exception for independent research.
Ajedi32 5y ago
> What if the files are intentionally created to match the desired hash? That's called a second-preimage attack and is similarly infeasible to achieve against a cryptographically secure hash function. There are good arguments to be made for why this is a bad idea, but hash collisions aren't one of them.
- skinkestek 5y ago
  But this isn't your average hash function. This is a function that is created to be robust against modifications to the image. A perfectly robust function would - in my opinion - be one that could detect even a recreation of the original setup. I don't know where on this scale the function law enforcement use is, but if it is any good I struggle to see how it cannot detect similar legal imagesm

JKCalhoun 5y ago

Couldn't someone that motivated come up with a dozen other ways to frame someone? This seems a little alarmist to me.

Macha 5y ago
They could come up with a dozen other ways apart from swatting too, but swatting still happens and we generally agree that it's a problem where actions should be taken. Political debates over whether that means the police should act in a less militarised fashion, or harsher sentences for culprits are ongoing, but cutting down on avenues for life ruining abuse is generally supported. So why would we open up new ones?
- judge2020 5y ago
  SWATing is actually the absolute cheapest option - if you want to ruin someone's week from across the nation (or across the ocean), your best bet is a burner phone calling the person's local 911 with a threat that warrants a SWAT team response (I am of course not advocating for anyone to do this, just explaining the process malicious actors currently use to trigger these). Outside of that, you'd need to pay a lot of money for something like a PI or obfuscated malware to steal PII or credentials from the victim.
taylorfinley 5y ago
I hope you don't ever run afoul of an internet mob from somewhere like 4chan! They might SWAT you while DDOSing your IP and doxing you then emailing your iphone dozens of photos that collide with CSAM perceptual hashes.
Ancapistani 5y ago
LEO have never, ever planted a baggie of weed in someone's car. Likewise, LEO would never, ever ensure that a picture that matched a known phash gets on a target's phone.
elzbardico 5y ago
Once someone develops the tool for that, it WILL become available in the wild. Then, any script kid will be able to "swat" you in a even more insidious way.

threatofrain 5y ago

Or what if you're a researcher who has downloaded a collection of these assets? Wouldn't you be a very high signal hit, beyond even actual perpetrators of crime? Would you need the protection of an umbrella organization to do research? Or register with the government perhaps?

skinkestek 5y ago
I'm as against this as anyone,but to be blunt: This is digital biowarfare material of the worst kind and should be handled as such. Any researcher downloading this material to anything but lab machines should probably receive a visit from the relevant authorities to make sure they understand the seriousness of it.
pseudalopex 5y ago
The law doesn't have an exception for independent research.

Ajedi32 5y ago

> What if the files are intentionally created to match the desired hash? That's called a second-preimage attack and is similarly infeasible to achieve against a cryptographically secure hash function. There are good arguments to be made for why this is a bad idea, but hash collisions aren't one of them.

skinkestek 5y ago
But this isn't your average hash function. This is a function that is created to be robust against modifications to the image. A perfectly robust function would - in my opinion - be one that could detect even a recreation of the original setup. I don't know where on this scale the function law enforcement use is, but if it is any good I struggle to see how it cannot detect similar legal imagesm