8 ms·
It’s pretty trivial to iteratively construct an image that has the same hash as another, completely different image if you know what the hash should be. All on
by iamleppert 5y ago
It’s pretty trivial to iteratively construct an image that has the same hash as another, completely different image if you know what the hash should be.
All one needs to do, in order to flag someone or get them caught up in this system, is to gain access to this list of hashes and construct an image. This data is likely to be sought after as soon as this system is implemented, and it will only be a matter of time before a data breach exposes it.
Once that is done, the original premise and security model of the system will be completely eroded.
That said, if this does get implemented I will be getting rid of all my Apple devices. I’ve already switched to Linux on my development laptops. The older I get, the less value Apple products have to me. So it won’t be a big deal for me to cut them out completely.
- jjtheblunt 5y agoCryptographic hashes are exactly not trivial to "dupe". https://en.wikipedia.org/wiki/Cryptographic_hash_function https://en.wikipedia.org/wiki/Cryptographic_hash_function that said, it's not clear to me from https://www.apple.com/child-safety/pdf/Apple_PSI_System_Security_Protocol_and_Analysis.pdf https://www.apple.com/child-safety/pdf/Apple_PSI_System_Secu... how collision resistant what's to be used will be.
- pseudalopex 5y agoPerceptual hashes aren't cryptographic.
- handoflixue 5y agoIs there anything stopping them from using an actual cryptographic hash, though?
- pseudalopex 5y agoEven the smallest change to an image changes a cryptographic hash.
- layoutIfNeeded 5y agoUmmm… the fact that changing a single pixel will let the baddies evade detection?
- heavyset_go 5y agoYes, using cryptographic hashes prevents them from fuzzy matching and the algorithms that allow for efficient matching and fuzzy matching require comparing the bare hashes.
- kickopotomus 5y agoThey are not using cryptographic hashes. They are using perceptual hashes[1] which are fairly trivial to replicate. [1]: https://en.wikipedia.org/wiki/Perceptual_hashing https://en.wikipedia.org/wiki/Perceptual_hashing
- tcoff91 5y agoThis seems dumb. I'm sure that sophisticated bad people will just alter colors and things to defeat the hashes and meanwhile trolls will generate collisions to cause people to falsely be flagged.
- judge2020 5y agoThe perceptual hashes are specifically designed to correlate images that are visually similar while not being exactly alike, even when the colors are altered. See: https://blog.cloudflare.com/the-csam-scanning-tool/ https://blog.cloudflare.com/the-csam-scanning-tool/
- deleted 5y ago[deleted]
- tcoff91 5y agowhat is the hashing scheme? I assume it must not be a cryptographically secure hashing scheme if it's possible to find a collision. It's not something like sha256?
- cyral 5y agoThey call it NeuralHash, there is a lengthy technical spec and security analysis in their announcement