4 ms·

Ok. Hashed-based image rec. Where are the hashes? Is the comparison done in my phone against a downloaded database, or is a hash of every image on my phone u

Ok. Hashed-based image rec. Where are the hashes? Is the comparison done in my phone against a downloaded database, or is a hash of every image on my phone uploaded for comparison on a server? Could this program then be expanded to other classes of images? Animal abuse imagery? Terrorism? Hashes of known bomb-making instructions? How about people sharing illegal pdfs and text files? Will the MPAA be allowed to submit hashes of their copyrighted material? In short: What other warrantless government inspections of my files will Apple allow?

Retric 5y ago
It’s done on Apple’s servers using your iCloud backups. For good or ill this lets people opt out by disabling iCloud. I would hope most privacy conscious people disable iCloud, but that’s another story.
- sandworm101 5y ago
  If apple really cares about security then those images in iCloud should be stored in an encrypted form that makes hash comparisons impossible. If they are hashing them then they have access to them in plaintext. If I used iCloud I would be more worried about the wider implications that creates.
  - Retric 5y ago
    iCloud needs to allow people to restore backups on a new iPhone after losing their old one. You can setup secure encrypted backups, but the customer losing the key means losing the back so that’s not what consumer focused companies are going to do. In other words any backup service that doesn’t have big warnings that losing your key loses your backup means they can read your data.
    - sandworm101 5y ago
      https://blog.cryptographyengineering.com/2012/04/05/icloud-who-holds-key/ https://blog.cryptographyengineering.com/2012/04/05/icloud-w... "The mud puddle test: You don’t have to dig through Apple’s ToS to determine how they store their encryption keys. There’s a much simpler approach that I call the ‘mud puddle test’"
- pseudalopex 5y ago
  Most of the process is done on customer's devices.[1] [1] https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...
  - Retric 5y ago
    I was answering this: “Is the comparison done in my phone against a downloaded database, or is a hash of every image on my phone uploaded for comparison on a server?” To be clear each image, the image’s NeuralHash, and a visual derivative are uploaded to iPhoto. This allows for the inspection of the NeuralHash algorithm used which I actually prefer. The phone isn’t downloading the hash database.
    - thw0rted 5y ago
      From that same page: "Apple further transforms this database into an unreadable set of hashes that is securely stored on users’ devices". The phone is downloading the hash database.
- deleted 5y ago
  [deleted]

Retric 5y ago

It’s done on Apple’s servers using your iCloud backups. For good or ill this lets people opt out by disabling iCloud. I would hope most privacy conscious people disable iCloud, but that’s another story.

sandworm101 5y ago
If apple really cares about security then those images in iCloud should be stored in an encrypted form that makes hash comparisons impossible. If they are hashing them then they have access to them in plaintext. If I used iCloud I would be more worried about the wider implications that creates.
- Retric 5y ago
  iCloud needs to allow people to restore backups on a new iPhone after losing their old one. You can setup secure encrypted backups, but the customer losing the key means losing the back so that’s not what consumer focused companies are going to do. In other words any backup service that doesn’t have big warnings that losing your key loses your backup means they can read your data.
  - sandworm101 5y ago
    https://blog.cryptographyengineering.com/2012/04/05/icloud-who-holds-key/ https://blog.cryptographyengineering.com/2012/04/05/icloud-w... "The mud puddle test: You don’t have to dig through Apple’s ToS to determine how they store their encryption keys. There’s a much simpler approach that I call the ‘mud puddle test’"
pseudalopex 5y ago
Most of the process is done on customer's devices.[1] [1] https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...
- Retric 5y ago
  I was answering this: “Is the comparison done in my phone against a downloaded database, or is a hash of every image on my phone uploaded for comparison on a server?” To be clear each image, the image’s NeuralHash, and a visual derivative are uploaded to iPhoto. This allows for the inspection of the NeuralHash algorithm used which I actually prefer. The phone isn’t downloading the hash database.
  - thw0rted 5y ago
    From that same page: "Apple further transforms this database into an unreadable set of hashes that is securely stored on users’ devices". The phone is downloading the hash database.
deleted 5y ago
[deleted]