6 ms·

Is the database frozen or can they push out updates independently of iOS updates? If not, targeting individual users definitely doesn't seem possible unless you

Is the database frozen or can they push out updates independently of iOS updates? If not, targeting individual users definitely doesn't seem possible unless you control OS signing.

shuckles 5y ago
The database is shipped in the iOS image.
- pushrax 5y ago
  That's what you wrote originally - and to me it doesn't indicate whether it can also be updated from other sources or not. Lots of content is shipped in the iOS image but can update independently.
  - shuckles 5y ago
    The technical summary provides a lot of detail. I don’t think Apple would omit remote update functionality from it if such capability existed, especially since database poisoning is a real risk to this type of program. I’m comfortable with interpreting the lack of evidence as evidence of absence of such a mechanism. Explicit clarification would certainly help though, but my original point stands: there is positive evidence in the docs which the FUD tweets don’t engage with. In particular, I’m referencing the figure which says that the database of CSAM hashes is “Blinded and embedded” into the client device. That does not sound like an asset the system remotely updates.
    - marshf 5y ago
      Do you not see any scenerio where the CIA/OGA inserts a hash into the database to specially target one person or a group of people?
      - shuckles 5y ago
        I agree database poisoning is a legitimate threat! Including the database in an iOS release (so it can’t be targeted and updated out of band) mitigates it somewhat. At the end of the day, though, more should be done to make NCMEC’s database transparent and trustworthy. And other databases too, if Apple decides to ship country-specific blacklists.
        feanaro 5y ago
        I personally don't believe this process can be made to be trustworthy enough while still serving its stated purpose. It will always remain opaque enough that it could and will be used to violate civil rights.
        shuckles 5y ago
        I don’t see how this system is particularly less trustworthy than the existing system of iOS updates.

Is the database frozen or can they push out updates independently of iOS updates? If not, targeting individual users definitely doesn't seem possible unless you control OS signing.

shuckles 5y ago

The database is shipped in the iOS image.

pushrax 5y ago
That's what you wrote originally - and to me it doesn't indicate whether it can also be updated from other sources or not. Lots of content is shipped in the iOS image but can update independently.
- shuckles 5y ago
  The technical summary provides a lot of detail. I don’t think Apple would omit remote update functionality from it if such capability existed, especially since database poisoning is a real risk to this type of program. I’m comfortable with interpreting the lack of evidence as evidence of absence of such a mechanism. Explicit clarification would certainly help though, but my original point stands: there is positive evidence in the docs which the FUD tweets don’t engage with. In particular, I’m referencing the figure which says that the database of CSAM hashes is “Blinded and embedded” into the client device. That does not sound like an asset the system remotely updates.
  - marshf 5y ago
    Do you not see any scenerio where the CIA/OGA inserts a hash into the database to specially target one person or a group of people?
    - shuckles 5y ago
      I agree database poisoning is a legitimate threat! Including the database in an iOS release (so it can’t be targeted and updated out of band) mitigates it somewhat. At the end of the day, though, more should be done to make NCMEC’s database transparent and trustworthy. And other databases too, if Apple decides to ship country-specific blacklists.
      - feanaro 5y ago
        I personally don't believe this process can be made to be trustworthy enough while still serving its stated purpose. It will always remain opaque enough that it could and will be used to violate civil rights.
        shuckles 5y ago
        I don’t see how this system is particularly less trustworthy than the existing system of iOS updates.