8 ms·

It's hard to argue they did this for a vision of privacy. They did this because they want YOUR phone to be a liability not THEIR servers.

aNoob7000 5y ago
To make it even worse they extended the functionality to Mac OSX. WTF???
- cassianoleal 5y ago
  Do you have references for this? I must have missed this part.
  - Xylakant 5y ago
    https://www.apple.com/child-safety/ https://www.apple.com/child-safety/, at the bottom lists macOS as target platform.
    - cassianoleal 5y ago
      It's unclear exactly what this means to be honest. Which is not less scary but more. This sentence: > Next, iOS and iPadOS will use new applications of cryptography to help limit the spread of CSAM online seems to suggest that the hash-matching happens only on iOS and iPadOS. The rest of the text OTOH suggests many things happen across all types of devices and OSs. Regardless, this seems very bad.
      - YokoSix 5y ago
        My guess is that they're going to put it into the macOS Photos app. Those images are already scanned for people, animals and objects so it should be easy for them to implement the child protection database there.
    - aethertron 5y ago
      Won't implementing this on macOS make it too easy to reverse engineer? Think the hashes are supposed to be secret. ETA: Apple quote: "unreadable set of hashes that is securely stored on users’ devices". Unreadable, unleakable, no doubt uninterpretable... unless someone reverses them to get a blurry 'visual proxy' collection.
- freeopinion 5y ago
  How is this worse? Any Apple device you thought you owned and controlled was never under your control. You were wrong. Perhaps your understanding of the situation has changed so that you better understand how bad it is. But the situation isn't worse.
syops 5y ago
That’s an interesting point. Do you know I’d this is the case? That is, by putting this in the phone then Apple’s liability is lessened.
015a 5y ago
Not to mention, this neural hashing can't be a cheap operation. Better to use the processors paid for by your customers than ones you have to pay for in the cloud!
- eropple 5y ago
  I would like to see tests wrt this before I assume it--Apple puts a pretty hefty premium on battery life for customer devices, and while that would probably not win out when placed against this kind of liability minimization, they've got a lot of sharp folks there who crunch this stuff in their sleep.
  - pdimitar 5y ago
    I have been noticing increased background activity on my phone after it reached 100% during charging, for years now. Pretty sure they can infer your normal sleep schedule and, after your phone has fully charged (1h to 3h after you fall asleep) they can freely use it as a P2P computing device. Nothing new really. And they can still keep their promise of a good battery life -- which is quite justified by the way, I am using iPhones for 4 years now and they've consistently won over any of the 13 Android devices that I've used in the years before (and sometimes during). There are ways to achieve both -- good observable battery life plus ability to use your phone for P2P computation -- and it's IMO obvious that Apple has succeeded in that for several years now.
    - Xylakant 5y ago
      Pretty sure they can infer your normal sleep schedule and, after your phone has fully charged (1h to 3h after you fall asleep) they can freely use it as a P2P computing device. They already do, the feature is called “Optimized Batter Charging”. It charges the battery to 80% and only does the full charge a bit before you usually start using the phone. You’ll find the setting in the battery health section.
      - edgyquant 5y ago
        Optimized Battery Charging isn’t the same as being a node in a bot net.
ursugardaddy 5y ago
Apple's just really weird when it comes to the control they exert over devices. they do it with 'privacy' in mind and what they come up with is usually better than the worst case but it can still be pretty iffy eg. a few months back when their notarization/entitlement verification system was being discussed it's all just their vision of computing (which has some merits), hyper-controlled, locked down and "safe" it's not going to change if you're not comfortable with it you really shouldn't be using their products
- MomoXenosaga 5y ago
  Hate Apple's philosophy personally but I recommend my mom a Mac every single time. Not everyone needs freedom, she's not downloading fitgirl repacks.
  - edgyquant 5y ago
    This is a weird mindset. Either you care about privacy or you don’t: what a person does on their device shouldn’t matter. If you only care about privacy when doing illegal things you don’t actually care about privacy you’re just a criminal not wanting to be caught.
    - deleted 5y ago
      [deleted]
hoppyhoppy2 5y ago
I've heard it argued that this allows Apple to move iCloud toward end-to-end encryption (which would be a good thing for privacy, right?). It seems like the current US government position is "we'll let tech giants use end-to-end encryption for user data as long as they put measures in place to catch CSAM." by "US government position" I'm including negotiations and proposed/threatened legislation, not just the current laws on the books.
- feanaro 5y ago
  It moves iCloud to end-to-end encryption by compromising the ends. Not really a reasonable outcome.
- babesh 5y ago
  If you really believe that, then I have a bridge to sell you. The exact same safety argument can and will be applied to ALL data whether on your device or Apple's servers. Why limit to iMessage and photos? Why not Signal on your device? Why not your backups on Apple servers? Oh wait, already happens.
  - hoppyhoppy2 5y ago
    I think Apple would rather put this CSAM-scanning system in place (which allows them to implement end-to-end encryption for iCloud in the future) than deal with the EARN-IT Act or similar becoming law, which could effectively make all e2e-encrypted services illegal (require a government backdoor). >The bill also crafts two addition changes to Section 230(c)(2)'s liability, allows any state to bring a lawsuit to service providers if they fail to deal with child sexual abuse material on their service, or if they allow end-to-end encryption on their service and do not provide means to enforcement officials to decrypt the material. https://en.wikipedia.org/wiki/EARN_IT_Act_of_2020 https://en.wikipedia.org/wiki/EARN_IT_Act_of_2020
    - babesh 5y ago
      If that were the case, wouldn't this CSAM scanning system be insufficient to meet those EARN-IT requirements? You have other Apple services and third-party apps that host material on Apple's servers. For example, if a user turns on iCloud backups, then every third-party app's Documents directory is backed up to iCloud. Would it be a violation to not CSAM scan that content? What if the contents are encrypted? Would they be required to be decrypted so that they are CSAM-scanned? iCloud drive is another Apple service that backs up to Apple's servers. Wouldn't its absence from the list be a violation? What if a user hosts encrypted files on iCloud drive? Would the user be required to decrypt them so that Apple can scan them? It seems that the real intention is to eliminate end-to-end encryption.

aNoob7000 5y ago

To make it even worse they extended the functionality to Mac OSX. WTF???

cassianoleal 5y ago
Do you have references for this? I must have missed this part.
- Xylakant 5y ago
  https://www.apple.com/child-safety/ https://www.apple.com/child-safety/, at the bottom lists macOS as target platform.
  - cassianoleal 5y ago
    It's unclear exactly what this means to be honest. Which is not less scary but more. This sentence: > Next, iOS and iPadOS will use new applications of cryptography to help limit the spread of CSAM online seems to suggest that the hash-matching happens only on iOS and iPadOS. The rest of the text OTOH suggests many things happen across all types of devices and OSs. Regardless, this seems very bad.
    - YokoSix 5y ago
      My guess is that they're going to put it into the macOS Photos app. Those images are already scanned for people, animals and objects so it should be easy for them to implement the child protection database there.
  - aethertron 5y ago
    Won't implementing this on macOS make it too easy to reverse engineer? Think the hashes are supposed to be secret. ETA: Apple quote: "unreadable set of hashes that is securely stored on users’ devices". Unreadable, unleakable, no doubt uninterpretable... unless someone reverses them to get a blurry 'visual proxy' collection.
freeopinion 5y ago
How is this worse? Any Apple device you thought you owned and controlled was never under your control. You were wrong. Perhaps your understanding of the situation has changed so that you better understand how bad it is. But the situation isn't worse.

syops 5y ago

That’s an interesting point. Do you know I’d this is the case? That is, by putting this in the phone then Apple’s liability is lessened.

015a 5y ago

Not to mention, this neural hashing can't be a cheap operation. Better to use the processors paid for by your customers than ones you have to pay for in the cloud!

eropple 5y ago
I would like to see tests wrt this before I assume it--Apple puts a pretty hefty premium on battery life for customer devices, and while that would probably not win out when placed against this kind of liability minimization, they've got a lot of sharp folks there who crunch this stuff in their sleep.
- pdimitar 5y ago
  I have been noticing increased background activity on my phone after it reached 100% during charging, for years now. Pretty sure they can infer your normal sleep schedule and, after your phone has fully charged (1h to 3h after you fall asleep) they can freely use it as a P2P computing device. Nothing new really. And they can still keep their promise of a good battery life -- which is quite justified by the way, I am using iPhones for 4 years now and they've consistently won over any of the 13 Android devices that I've used in the years before (and sometimes during). There are ways to achieve both -- good observable battery life plus ability to use your phone for P2P computation -- and it's IMO obvious that Apple has succeeded in that for several years now.
  - Xylakant 5y ago
    Pretty sure they can infer your normal sleep schedule and, after your phone has fully charged (1h to 3h after you fall asleep) they can freely use it as a P2P computing device. They already do, the feature is called “Optimized Batter Charging”. It charges the battery to 80% and only does the full charge a bit before you usually start using the phone. You’ll find the setting in the battery health section.
    - edgyquant 5y ago
      Optimized Battery Charging isn’t the same as being a node in a bot net.

ursugardaddy 5y ago

Apple's just really weird when it comes to the control they exert over devices. they do it with 'privacy' in mind and what they come up with is usually better than the worst case but it can still be pretty iffy eg. a few months back when their notarization/entitlement verification system was being discussed it's all just their vision of computing (which has some merits), hyper-controlled, locked down and "safe" it's not going to change if you're not comfortable with it you really shouldn't be using their products

MomoXenosaga 5y ago
Hate Apple's philosophy personally but I recommend my mom a Mac every single time. Not everyone needs freedom, she's not downloading fitgirl repacks.
- edgyquant 5y ago
  This is a weird mindset. Either you care about privacy or you don’t: what a person does on their device shouldn’t matter. If you only care about privacy when doing illegal things you don’t actually care about privacy you’re just a criminal not wanting to be caught.
  - deleted 5y ago
    [deleted]

hoppyhoppy2 5y ago

I've heard it argued that this allows Apple to move iCloud toward end-to-end encryption (which would be a good thing for privacy, right?). It seems like the current US government position is "we'll let tech giants use end-to-end encryption for user data as long as they put measures in place to catch CSAM." by "US government position" I'm including negotiations and proposed/threatened legislation, not just the current laws on the books.

feanaro 5y ago
It moves iCloud to end-to-end encryption by compromising the ends. Not really a reasonable outcome.
babesh 5y ago
If you really believe that, then I have a bridge to sell you. The exact same safety argument can and will be applied to ALL data whether on your device or Apple's servers. Why limit to iMessage and photos? Why not Signal on your device? Why not your backups on Apple servers? Oh wait, already happens.
- hoppyhoppy2 5y ago
  I think Apple would rather put this CSAM-scanning system in place (which allows them to implement end-to-end encryption for iCloud in the future) than deal with the EARN-IT Act or similar becoming law, which could effectively make all e2e-encrypted services illegal (require a government backdoor). >The bill also crafts two addition changes to Section 230(c)(2)'s liability, allows any state to bring a lawsuit to service providers if they fail to deal with child sexual abuse material on their service, or if they allow end-to-end encryption on their service and do not provide means to enforcement officials to decrypt the material. https://en.wikipedia.org/wiki/EARN_IT_Act_of_2020 https://en.wikipedia.org/wiki/EARN_IT_Act_of_2020
  - babesh 5y ago
    If that were the case, wouldn't this CSAM scanning system be insufficient to meet those EARN-IT requirements? You have other Apple services and third-party apps that host material on Apple's servers. For example, if a user turns on iCloud backups, then every third-party app's Documents directory is backed up to iCloud. Would it be a violation to not CSAM scan that content? What if the contents are encrypted? Would they be required to be decrypted so that they are CSAM-scanned? iCloud drive is another Apple service that backs up to Apple's servers. Wouldn't its absence from the list be a violation? What if a user hosts encrypted files on iCloud drive? Would the user be required to decrypt them so that Apple can scan them? It seems that the real intention is to eliminate end-to-end encryption.