6 ms·

I keep on reading that taking steps to prevent CASM is doing "huge damage" to their brand. Or that blocking minors from sending nudes if they are on a child acc

I keep on reading that taking steps to prevent CASM is doing "huge damage" to their brand. Or that blocking minors from sending nudes if they are on a child account under their parent is doing huge damage. Really? You know some late night comedian is going to do some jokes about pedo's having to switch to android. You think that is damaging to apples' brand? My guess is some android folks do a follow eventually (as usual). I'm a parent. Even for those of us who are into privacy etc (yes, I did the early PGP key signing parties, EFF / ACLU stuff etc) I'm having a hard time seeing how this damages Apple's brand. I don't want this crap being sent to my children - PERIOD. If they are on a child account PLEASE screen it. Folks - pay attention to the kind of laws that will get passed and do get passed. Most folks will throw away a lot of civil rights for these types of issues. I found the arguments against this surprisingly uncompelling. I saw an HN article about how apple is committing felonies etc - it just didn't seem well founded. And everything is over hyperbolic over the top its insane.

hendersoon 5y ago
Apple's brand won't be sullied until they give-in to a government order to flag other types of illegal images (gay porn in Saudi Arabia, say, or pictures of the Tank Man in China) and are caught doing it. Apple's rejoinder is that they will simply refuse to do that. And that's great, until you consider that all the iPhones are made in China and China is more than willing to apply immense pressure including but not limited to shutting down Foxconn if they feel strongly about it.
- whoknowswhat11 5y ago
  Most of the major tech co's have already adapted to China's requests. That in general means hosting data about chinese nationals in china, usually using state govt controlled datacenters, and making sure the keys to decrypt content are also local and accessible to those state controlled employees. You should have little to no privacy expectation in china as an example. For example AWS is careful to use this language about it's china regions: "Amazon Web Services China (Ningxia) Region operated by NWCD" They used to block KMS services in China as well. Apple has said it will (generally) follow the law in the countries it operates in. Until we say apple can make its own laws that is probably what it'll have to do.
  - hendersoon 5y ago
    Apple already acquiesced to China in that manner, yes. They store all iCloud data in China and they gave the Chinese government the encryption keys. This is a bit different in that they're scanning files on client devices, /not/ solely in the cloud.
friedman23 5y ago
>I found the arguments against this surprisingly uncompelling I think it just goes to show that people don't actually care about privacy and civil liberties. You can't argue against "think of the children" without being labeled heartless or a pedophile so no one with true influence will argue against it since nobody wants to die on the child porn hill. This is what happens when your thought leaders are all cynical and value money and power above all else. While I'm a privacy advocate I could see that the arguments were fruitless. The popular conception of the constitution today is that it is a joke. People mock liberties like freedom of speech so you just know privacy is something people do not care about.
- temp8964 5y ago
  People do care about privacy, but not in that absolute sense. You think privacy is 100% or 0%, but vast majority of the public don't think so.
  - friedman23 5y ago
    So you would be in favor of installing cameras in all homes that detects child abuse, murder, and rape in an automated fashion? It can use microphones to detect people in distress. This would prevent many more heinous crimes than what apple is proposing we do and it will only be used for detecting horrible acts. By your logic this would be acceptable and we could all still claim to value privacy.
    - temp8964 5y ago
      I don't think so. This is a case by case reasoning. There is no straight logic leads to jumping from scanning iCloud photos to installing cameras in homes.
      - friedman23 5y ago
        The principle is that it's fine to install surveillance if we are preventing horrible things from happening.
r00fus 5y ago
You may be conflating two features. 1 - Messages fix. 2 - scanning your entire Photos library and sending hashes to an unaccountable, no oversight nonprofit (NCMEC) to be compared with CSAM hashes - with no way to contest what you send. 1 is arguably a good feature (though it's very intrusive - it has a benefit). 2 is a monstrous invasion of privacy. It has no benefit to you, the user, only a massive potential threat. Finally, the NCMEC is founded by someone who admitted, if he was judged by the own law he helped pass, he'd be considered a sex offender when he was dating his then-girlfriend.
- bzbarsky 5y ago
  > scanning your entire Photos library The parts of it being uploaded to iCloud, not the whole thing, yes? > and sending hashes to an unaccountable, no oversight nonprofit (NCMEC) As I understand it, the whole point is that the hashes are computed on-device and compared to the NCMEC database on-device. Is my understanding incorrect?
  - whoknowswhat11 5y ago
    No - the amount of bad info in these discussions has gotten incredible. The more overblown the claims the more trashy the data it seems they are based on. It's funny, it is literally in the first paragraph of the system overview in terms of how the database of hashes is stored - "which is securely stored on users’ devices"
    - josephcsible 5y ago
      You misunderstand what that quote is referring to.
      - willseth 5y ago
        No, he's not. Read the documentation. The hash database your photos are compared to will live on your device, and scanning happens entirely on-device. "Apple further transforms this database into an unreadable set of hashes, which is securely stored on users’ devices."
tfehring 5y ago
I agree that the idea of the AG bringing felony charges against Apple employees because of their approach to dealing with CSAM is pretty far-fetched. But the article you're referring to [0] is correct to point out that Apple will be silently exfiltrating unencrypted data from its users' devices to be reviewed by its employees, meaning that they'll be viewing arbitrary content from Apple users' devices without their knowledge or consent. That's not speculation, it follows directly from Apple's explanation of how the system will work, with the only safeguard being Apple's purported one-in-a-trillion false positive rate for the on-device scanning that causes the data to be sent to Apple. [0] https://www.hackerfactor.com/blog/index.php?/archives/929-One-Bad-Apple.html https://www.hackerfactor.com/blog/index.php?/archives/929-On...
- whoknowswhat11 5y ago
  You are confusing encryption with access to encryption. Apple ALREADY has access to all you icloud photos. Period. How do you think they offer them to you via website and various sync services. So they can encrypt them at rest or in transit, but their KMS or whatever gives them access ALREADY to these very same photos. This illustrates I think how bad this convo has been from the HN side. A lot of bad info out there on this which makes the totally overblown responses even worse. Heads up - your phone ALEADY uploads photos to iCloud if you let it, and those photos are accessible by Apple ALREADY.
  - danielschonfeld 5y ago
    While logical to assume, that's not a given. I think some of us want to believe that the keys to those said images are uploaded encrypted to the cloud. And the ability to sync between devices just means adding more keys to your account. So unless you know something we don't, it's not 100% that they sit unencrypted on Apple's servers, or that they have the keys to decrypt them. It is sound judgement tho, to assume that they do.
    - whoknowswhat11 5y ago
      They are explicit about this. "iCloud content may include email, stored photos, documents, contacts, calendars, bookmarks, Safari Browsing History, Maps Search History, Messages and iOS device backups. iOS device backups may include photos and videos in the Camera Roll, device settings, app data, iMessage, Business Chat, SMS, and MMS messages and voicemail. All iCloud content data stored by Apple is encrypted at the location of the server. When third-party vendors are used to store data, Apple never gives them the encryption keys. Apple retains the encryption keys in its U.S. data centers. iCloud content, as it exists in the customer’s account, may be provided in response to a search warrant issued upon a showing of probable cause, or customer consent." So unless you doubt apples own guide - they maintain the keys and will provide this info in response to govt requests. They handled requests for 31,000 accounts in the last 6 months based on their reporting and provided data in 85% of those situations.
brandon272 5y ago
My expectations from Apple would be scaled way back if they weren't preaching fairly consistently that they treat privacy as a "fundamental human right". They've marketed this as not only a competitive difference but also a moral imperative. To claim that you treat privacy as a fundamental human right is an extraordinary claim that requires significant effort and action to back up. To me, "fundamental human rights" apply to everyone - all humans - including children. Their commitment to this was already called into question for several reasons, including their partial commitment to E2E as well as their actions in other countries (i.e. China). When you give your users privacy with numerous conditions attached indicating all the times they don't have it, you aren't giving them privacy. Full stop. It's like going to someone's home, having them tell you that they are champions for privacy and then going to the bathroom and seeing a damn camera attached to the wall. "Oh, that, don't worry. I only look at the footage if something gets stolen."
klelatti 5y ago
> You know some late night comedian is going to do some jokes about pedo's having to switch to android. You think that is damaging to apples' brand? No just the start of a whole stream of attacks from WhatsApp / Facebook: https://www.theverge.com/2021/8/6/22613365/apple-icloud-csam-scanning-whatsapp-surveillance-reactions https://www.theverge.com/2021/8/6/22613365/apple-icloud-csam... Also just read the full range of comments. The fact that you're saying elsewhere that everyone is misunderstanding and it's all overblown is sort of making my point that it's affecting the brand. Plus you're saying other firms capture images so that's fine - no! Those other firms haven't made privacy a central feature of their brand.
zionic 5y ago
Also a parent, and I couldn’t more strongly disagree with you. We cannot protect our children by building a dystopia for them to grow up in, and normalizing this kind of invasive spyware on every device is pretty much guaranteeing that.
switch007 5y ago
> I don't want this crap being sent to my children You can always not buy your child a device. Parents will recoil in horror at the suggestion, being told what to do and limiting their child’s freedom ! Indeed, welcome to our world, where we suffer huge affronts on our freedom and privacy in the name of “the children”.

hendersoon 5y ago

Apple's brand won't be sullied until they give-in to a government order to flag other types of illegal images (gay porn in Saudi Arabia, say, or pictures of the Tank Man in China) and are caught doing it. Apple's rejoinder is that they will simply refuse to do that. And that's great, until you consider that all the iPhones are made in China and China is more than willing to apply immense pressure including but not limited to shutting down Foxconn if they feel strongly about it.

whoknowswhat11 5y ago
Most of the major tech co's have already adapted to China's requests. That in general means hosting data about chinese nationals in china, usually using state govt controlled datacenters, and making sure the keys to decrypt content are also local and accessible to those state controlled employees. You should have little to no privacy expectation in china as an example. For example AWS is careful to use this language about it's china regions: "Amazon Web Services China (Ningxia) Region operated by NWCD" They used to block KMS services in China as well. Apple has said it will (generally) follow the law in the countries it operates in. Until we say apple can make its own laws that is probably what it'll have to do.
- hendersoon 5y ago
  Apple already acquiesced to China in that manner, yes. They store all iCloud data in China and they gave the Chinese government the encryption keys. This is a bit different in that they're scanning files on client devices, /not/ solely in the cloud.

friedman23 5y ago

>I found the arguments against this surprisingly uncompelling I think it just goes to show that people don't actually care about privacy and civil liberties. You can't argue against "think of the children" without being labeled heartless or a pedophile so no one with true influence will argue against it since nobody wants to die on the child porn hill. This is what happens when your thought leaders are all cynical and value money and power above all else. While I'm a privacy advocate I could see that the arguments were fruitless. The popular conception of the constitution today is that it is a joke. People mock liberties like freedom of speech so you just know privacy is something people do not care about.

temp8964 5y ago
People do care about privacy, but not in that absolute sense. You think privacy is 100% or 0%, but vast majority of the public don't think so.
- friedman23 5y ago
  So you would be in favor of installing cameras in all homes that detects child abuse, murder, and rape in an automated fashion? It can use microphones to detect people in distress. This would prevent many more heinous crimes than what apple is proposing we do and it will only be used for detecting horrible acts. By your logic this would be acceptable and we could all still claim to value privacy.
  - temp8964 5y ago
    I don't think so. This is a case by case reasoning. There is no straight logic leads to jumping from scanning iCloud photos to installing cameras in homes.
    - friedman23 5y ago
      The principle is that it's fine to install surveillance if we are preventing horrible things from happening.

r00fus 5y ago

You may be conflating two features. 1 - Messages fix. 2 - scanning your entire Photos library and sending hashes to an unaccountable, no oversight nonprofit (NCMEC) to be compared with CSAM hashes - with no way to contest what you send. 1 is arguably a good feature (though it's very intrusive - it has a benefit). 2 is a monstrous invasion of privacy. It has no benefit to you, the user, only a massive potential threat. Finally, the NCMEC is founded by someone who admitted, if he was judged by the own law he helped pass, he'd be considered a sex offender when he was dating his then-girlfriend.

bzbarsky 5y ago
> scanning your entire Photos library The parts of it being uploaded to iCloud, not the whole thing, yes? > and sending hashes to an unaccountable, no oversight nonprofit (NCMEC) As I understand it, the whole point is that the hashes are computed on-device and compared to the NCMEC database on-device. Is my understanding incorrect?
- whoknowswhat11 5y ago
  No - the amount of bad info in these discussions has gotten incredible. The more overblown the claims the more trashy the data it seems they are based on. It's funny, it is literally in the first paragraph of the system overview in terms of how the database of hashes is stored - "which is securely stored on users’ devices"
  - josephcsible 5y ago
    You misunderstand what that quote is referring to.
    - willseth 5y ago
      No, he's not. Read the documentation. The hash database your photos are compared to will live on your device, and scanning happens entirely on-device. "Apple further transforms this database into an unreadable set of hashes, which is securely stored on users’ devices."

tfehring 5y ago

I agree that the idea of the AG bringing felony charges against Apple employees because of their approach to dealing with CSAM is pretty far-fetched. But the article you're referring to [0] is correct to point out that Apple will be silently exfiltrating unencrypted data from its users' devices to be reviewed by its employees, meaning that they'll be viewing arbitrary content from Apple users' devices without their knowledge or consent. That's not speculation, it follows directly from Apple's explanation of how the system will work, with the only safeguard being Apple's purported one-in-a-trillion false positive rate for the on-device scanning that causes the data to be sent to Apple. [0] https://www.hackerfactor.com/blog/index.php?/archives/929-One-Bad-Apple.html https://www.hackerfactor.com/blog/index.php?/archives/929-On...

whoknowswhat11 5y ago
You are confusing encryption with access to encryption. Apple ALREADY has access to all you icloud photos. Period. How do you think they offer them to you via website and various sync services. So they can encrypt them at rest or in transit, but their KMS or whatever gives them access ALREADY to these very same photos. This illustrates I think how bad this convo has been from the HN side. A lot of bad info out there on this which makes the totally overblown responses even worse. Heads up - your phone ALEADY uploads photos to iCloud if you let it, and those photos are accessible by Apple ALREADY.
- danielschonfeld 5y ago
  While logical to assume, that's not a given. I think some of us want to believe that the keys to those said images are uploaded encrypted to the cloud. And the ability to sync between devices just means adding more keys to your account. So unless you know something we don't, it's not 100% that they sit unencrypted on Apple's servers, or that they have the keys to decrypt them. It is sound judgement tho, to assume that they do.
  - whoknowswhat11 5y ago
    They are explicit about this. "iCloud content may include email, stored photos, documents, contacts, calendars, bookmarks, Safari Browsing History, Maps Search History, Messages and iOS device backups. iOS device backups may include photos and videos in the Camera Roll, device settings, app data, iMessage, Business Chat, SMS, and MMS messages and voicemail. All iCloud content data stored by Apple is encrypted at the location of the server. When third-party vendors are used to store data, Apple never gives them the encryption keys. Apple retains the encryption keys in its U.S. data centers. iCloud content, as it exists in the customer’s account, may be provided in response to a search warrant issued upon a showing of probable cause, or customer consent." So unless you doubt apples own guide - they maintain the keys and will provide this info in response to govt requests. They handled requests for 31,000 accounts in the last 6 months based on their reporting and provided data in 85% of those situations.

brandon272 5y ago

My expectations from Apple would be scaled way back if they weren't preaching fairly consistently that they treat privacy as a "fundamental human right". They've marketed this as not only a competitive difference but also a moral imperative. To claim that you treat privacy as a fundamental human right is an extraordinary claim that requires significant effort and action to back up. To me, "fundamental human rights" apply to everyone - all humans - including children. Their commitment to this was already called into question for several reasons, including their partial commitment to E2E as well as their actions in other countries (i.e. China). When you give your users privacy with numerous conditions attached indicating all the times they don't have it, you aren't giving them privacy. Full stop. It's like going to someone's home, having them tell you that they are champions for privacy and then going to the bathroom and seeing a damn camera attached to the wall. "Oh, that, don't worry. I only look at the footage if something gets stolen."

klelatti 5y ago

> You know some late night comedian is going to do some jokes about pedo's having to switch to android. You think that is damaging to apples' brand? No just the start of a whole stream of attacks from WhatsApp / Facebook: https://www.theverge.com/2021/8/6/22613365/apple-icloud-csam-scanning-whatsapp-surveillance-reactions https://www.theverge.com/2021/8/6/22613365/apple-icloud-csam... Also just read the full range of comments. The fact that you're saying elsewhere that everyone is misunderstanding and it's all overblown is sort of making my point that it's affecting the brand. Plus you're saying other firms capture images so that's fine - no! Those other firms haven't made privacy a central feature of their brand.

zionic 5y ago

Also a parent, and I couldn’t more strongly disagree with you. We cannot protect our children by building a dystopia for them to grow up in, and normalizing this kind of invasive spyware on every device is pretty much guaranteeing that.

switch007 5y ago

> I don't want this crap being sent to my children You can always not buy your child a device. Parents will recoil in horror at the suggestion, being told what to do and limiting their child’s freedom ! Indeed, welcome to our world, where we suffer huge affronts on our freedom and privacy in the name of “the children”.