4 ms·

This is a way worse of a spyware than I initially thought. - They have a database of file hashes. - They can’t validate its contents by design. - They can’t

by eknkc 5y ago

This is a way worse of a spyware than I initially thought. - They have a database of file hashes. - They can’t validate its contents by design. - They can’t explain who supplies it in detail. - The suppliers of these data work with / close to the US gov. - The match your own files on your own device against this database that contains who knows what. - When it matches a couple of times, they alert the authorities. - There is zero fucking visibility for both Apple and you by design and this is a very good thing for Apple. - I assume the source of this data can update / add new hashes in time and your device will happily comply. And their only concern is to say that the algorithm is so perfect, they can not see what’s happening and there won’t be false positives (hopefully). You know what, I trust your ability to do it properly. No need to explain more. Problem is that the very thing you are building is fucked up by design. And obviously Apple does not address it in any way. But think about the children…

somedude895 5y ago
So if I understand correctly, they'll have a db of hashes which are probably tagged with some info on what's in the picture? Who is supplying the hashes? It seems like a LOT of power will be concentrated there. They can basically decide who gets in trouble with seemingly no accountability whatsoever?
- rahkiin 5y ago
  This already happens server-side now so what you mention here does not actually change.
  - eknkc 5y ago
    Not on iCloud. They have all the content already encrypted on your phone. Can’t fingerprint after that. Them adding this as an on device process is due to that. And the fact that Apple has been talking about privacy all this time (and rightly so) means their past mitigations makes this more painful. Any other vendor could just do it on the server, add a line to their Privacy Policy and nobody would know.
    - rahkiin 5y ago
      This is false. Up until now, iCloud photos are encrypted in transit and in store but can be decrypted with Apples own key. There is no e2ee. Apple has been talking a lot about putting all ML and data handling on your own device so that the data does not need to leave your device without e2ee
      - nojito 5y ago
        Apple does not scan iCloud for csam because they feel that blanket scanning of iCloud violates end user privacy. That’s the whole reason for their research into differential privacy.
        snowwrestler 5y ago
        > Apple has confirmed that it’s automatically scanning images backed up to iCloud to ferret out child abuse images. https://nakedsecurity.sophos.com/2020/01/09/apples-scanning-icloud-photos-for-child-abuse-images/ https://nakedsecurity.sophos.com/2020/01/09/apples-scanning-...
        nojito 5y ago
        Read the original telegraph article cited. https://www.telegraph.co.uk/technology/2020/01/08/apple-scans-icloud-photos-check-child-abuse/ https://www.telegraph.co.uk/technology/2020/01/08/apple-scan... >Update January 9, 2020 >This story originally said Apple screens photos when they are uploaded to iCloud, Apple's cloud storage service. Ms Horvath and Apple's disclaimer did not mention iCloud, and the company has not specified how it screens material, saying this information could help criminals. This confirms the reporting from NYT https://www.nytimes.com/2021/08/05/technology/apple-iphones-privacy.html https://www.nytimes.com/2021/08/05/technology/apple-iphones-... >U.S. law requires tech companies to flag cases of child sexual abuse to the authorities. Apple has historically flagged fewer cases than other companies. Last year, for instance, Apple reported 265 cases to the National Center for Missing & Exploited Children, while Facebook reported 20.3 million, according to the center’s statistics. That enormous gap is due in part to Apple’s decision not to scan for such material, citing the privacy of its users
Asooka 5y ago
I am thinking of the children and what worries me is wouldn't scanning for existing porn sharply increase the value of new porn and stimulate abuse of children for money.
robertoandred 5y ago
Of course Apple knows where the hashes come from and they know whom they send flagged account info to. You’re drawing conclusions from false assumptions.
cannabis_sam 5y ago
> But think about the children… Actually, I am thinking of the children, most child sexual abuse happens inside the home by people who personally knows the child, and this crypto mumbojumbo does nothing to address this!!! What we actually need is for every parent to be required to install surveillance equipment, cameras, sensors and whatnot into their home. Then *something*something* AI/ML can filter out all the excess information, but send the child abuse to the authorities… (/s)

by eknkc 5y ago

somedude895 5y ago

So if I understand correctly, they'll have a db of hashes which are probably tagged with some info on what's in the picture? Who is supplying the hashes? It seems like a LOT of power will be concentrated there. They can basically decide who gets in trouble with seemingly no accountability whatsoever?

rahkiin 5y ago
This already happens server-side now so what you mention here does not actually change.
- eknkc 5y ago
  Not on iCloud. They have all the content already encrypted on your phone. Can’t fingerprint after that. Them adding this as an on device process is due to that. And the fact that Apple has been talking about privacy all this time (and rightly so) means their past mitigations makes this more painful. Any other vendor could just do it on the server, add a line to their Privacy Policy and nobody would know.
  - rahkiin 5y ago
    This is false. Up until now, iCloud photos are encrypted in transit and in store but can be decrypted with Apples own key. There is no e2ee. Apple has been talking a lot about putting all ML and data handling on your own device so that the data does not need to leave your device without e2ee
    - nojito 5y ago
      Apple does not scan iCloud for csam because they feel that blanket scanning of iCloud violates end user privacy. That’s the whole reason for their research into differential privacy.
      - snowwrestler 5y ago
        > Apple has confirmed that it’s automatically scanning images backed up to iCloud to ferret out child abuse images. https://nakedsecurity.sophos.com/2020/01/09/apples-scanning-icloud-photos-for-child-abuse-images/ https://nakedsecurity.sophos.com/2020/01/09/apples-scanning-...
        nojito 5y ago
        Read the original telegraph article cited. https://www.telegraph.co.uk/technology/2020/01/08/apple-scans-icloud-photos-check-child-abuse/ https://www.telegraph.co.uk/technology/2020/01/08/apple-scan... >Update January 9, 2020 >This story originally said Apple screens photos when they are uploaded to iCloud, Apple's cloud storage service. Ms Horvath and Apple's disclaimer did not mention iCloud, and the company has not specified how it screens material, saying this information could help criminals. This confirms the reporting from NYT https://www.nytimes.com/2021/08/05/technology/apple-iphones-privacy.html https://www.nytimes.com/2021/08/05/technology/apple-iphones-... >U.S. law requires tech companies to flag cases of child sexual abuse to the authorities. Apple has historically flagged fewer cases than other companies. Last year, for instance, Apple reported 265 cases to the National Center for Missing & Exploited Children, while Facebook reported 20.3 million, according to the center’s statistics. That enormous gap is due in part to Apple’s decision not to scan for such material, citing the privacy of its users

Asooka 5y ago

I am thinking of the children and what worries me is wouldn't scanning for existing porn sharply increase the value of new porn and stimulate abuse of children for money.

robertoandred 5y ago

Of course Apple knows where the hashes come from and they know whom they send flagged account info to. You’re drawing conclusions from false assumptions.

cannabis_sam 5y ago

> But think about the children… Actually, I am thinking of the children, most child sexual abuse happens inside the home by people who personally knows the child, and this crypto mumbojumbo does nothing to address this!!! What we actually need is for every parent to be required to install surveillance equipment, cameras, sensors and whatnot into their home. Then *something*something* AI/ML can filter out all the excess information, but send the child abuse to the authorities… (/s)