4 ms·
> It'll start with protecting children. We all want to protect children, don't we? Why do you want children abused? Are you a child abuser, what do you have to
by dwaite 5y ago
> It'll start with protecting children. We all want to protect children, don't we? Why do you want children abused? Are you a child abuser, what do you have to hide?
To be clear, this is continued enforcement for years-old regulation. The feature is only enabled in the US where it is required.
The implementation is changing from cloud-based matching (which requires photos to be readable by their cloud infrastructure) to local based matching with threshold tokens (which would allow them potentially to be in compliance while making the system E2E encrypted w two additional key release mechanisms (key escrow via separate audited HSM systems, the given threshold disclosure of the image encryption key)
- antpol 5y ago> while making the system E2E encrypted w two additional key release mechanisms (key escrow via separate audited HSM systems, the given threshold disclosure of the image encryption key) such a long sentence to say "backdoor"
- dannyobrien 5y agoCould you point to the regulation that requires this?
- macintux 5y agoSee the “Federal CSAM Law” section here: https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-ban-end-end-encryption-without-actually-banning-it https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-b... > Section 2258A of the law imposes duties on online service providers, such as Facebook and Tumblr and Dropbox and Gmail. The law mandates that providers must report CSAM when they discover it on their services, and then preserve what they’ve reported (because it’s evidence of a crime).
- dannyw 5y agoThe law doesn't require them to actively go around scanning for it.
- jachee 5y agoThey’re scanning for it as it enters their system. It’s only scanned if it’s set to go to iCloud.
- noduerme 5y agoYes, but then there's a way to upload it in plaintext. That's the backdoor. That can, and will, eventually be used to exfiltrate any file, anytime, whether it would be going to the cloud or not.
- macintux 5y agoIt does set a terrible precedent, but it's possible this is a step towards E2E encryption on iCloud data; a way to comply with the law while preventing law enforcement from being able to subpoena other data. Apple is being its usual cryptic self about this, which is once again breeding uncertainty, but I still have hope in the end this will work out.
- noduerme 5y agoAgain though, what is the guarantee this is only going to be used to scan data uploaded to the cloud? If Apple has the ability to exfiltrate data from a phone at whim, they lose any deniability or leverage they still have with authoritarian regimes that want all the data on a phone. It's not just a terrible precedent, it's a dangerous piece of malware.
- tomjen3 5y ago>E2E encrypted w two additional key release mechanisms Aka not E2E and therefore something that Cook should face a fraud charge for saying it is. Apple needs to make it true e2e yesterday, and tell the FBI that they can either approve of it, or never use an iPhone again.
- dwaite 5y agoI’m the one saying it is, not Apple.
- roody15 5y ago“ which would allow them potentially to be in compliance while making the system E2E encrypted …” Apples system is not E2E encrypted if a local program scans files prior to upload.