4 ms·

> scanning your entire Photos library The parts of it being uploaded to iCloud, not the whole thing, yes? > and sending hashes to an unaccountable, no oversig

> scanning your entire Photos library The parts of it being uploaded to iCloud, not the whole thing, yes? > and sending hashes to an unaccountable, no oversight nonprofit (NCMEC) As I understand it, the whole point is that the hashes are computed on-device and compared to the NCMEC database on-device. Is my understanding incorrect?

whoknowswhat11 5y ago
No - the amount of bad info in these discussions has gotten incredible. The more overblown the claims the more trashy the data it seems they are based on. It's funny, it is literally in the first paragraph of the system overview in terms of how the database of hashes is stored - "which is securely stored on users’ devices"
- josephcsible 5y ago
  You misunderstand what that quote is referring to.
  - willseth 5y ago
    No, he's not. Read the documentation. The hash database your photos are compared to will live on your device, and scanning happens entirely on-device. "Apple further transforms this database into an unreadable set of hashes, which is securely stored on users’ devices."
    - josephcsible 5y ago
      Read further down: > the blinding step using the server-side secret is not possible on device because it is unknown to the device. The goal is to run the final step on the server and finish the process on server. This ensures the device doesn’t know the result of the match, but it can encode the result of the on-device match process before uploading to the server.
      - willseth 5y ago
        This is a confusing paragraph, but the "final step" is not matching per se. The final step reveals whether a match occurred - but it's clear that the database exists on-device and the database lookup occurs on-device. Note the last part: "... but it can encode the result of the on-device match process before uploading to the server." The result of the match already exists before it is uploaded to the server. This is also made clear in the diagram. Depending on how you define "matching," it either occurs on-device or no explicit matching actually occurs. The server gets a payload for each uploaded image and attempts to use its server-side secret to derive its decryption key from the header. If (and only if) the image was a match - as determined by the blinded on-device comparison - it will now have a key to decrypt the rest of the payload (for review). Note that neither client nor server explicitly compare the real database hash to the image hash. The comparison is absorbed into crypto "properties."
        josephcsible 5y ago
        Do you agree with these two statements? 1. For every image that's scanned, whether matching or non-matching, some data will be sent to the server. 2. Your phone never learns and has no way to tell which images match and which ones don't.
        willseth 5y ago
        Ugh. Feel free to expound any of your vague replies in this thread with actual explanations that make sense under any reasonable interpretation of "on device."
josephcsible 5y ago
Your understanding is incorrect. The NCMEC database is unavailable to your device. The hashes are checked by communicating with a server. In particular, only the server ever learns if there was a match, not your device.
- willseth 5y ago
  Wrong.
krinchan 5y ago
> The parts of it being uploaded to iCloud, not the whole thing, yes? This is policy, not capability. The capability is each and every image can be scanned. > As I understand it, the whole point is that the hashes are computed on-device and compared to the NCMEC database on-device. Is my understanding incorrect? You are incorrect but also the concern is NCMEC’s database’s accuracy. Also, going by other NPO’s the government has taken an interest in, NCMEC is very exposed to government control. They can easily decide to allow the government to slip a few extra hashes in their database and tell no one. They can do this in exchange for protecting their NPO status, a national security letter, anything. We will never know and if we find out, we will have no way to hold them accountable. Ever. Anyway, the NMEC database is NDA’ed and a secret. It’s not open to review or auditing. It’s also grossly inaccurate and nearly useless. You are taking these points entirely out of context and in a vacuum. It reads a bit bad faith and win an Internet argument at any cost.
- bzbarsky 5y ago
  > This is policy, not capability. The capability is each and every image can be scanned. Are you familiar with the implementation? If it's in the uploader, then the capability for each image to be scanned sounds like it would involve a bunch of code changes. But let's posit that the implementation just checks the "uploaded to iCloud" flag and hence this is "just policy". I agree that this is concerning, but I think it's important to distinguish between "could do X" and "is doing X" when describing a situation. > You are incorrect I would love to be enlightened here. Can you please point me to an explanation of how my understanding is incorrect? > but also the concern is NCMEC’s database’s accuracy I absolutely share this concern. > You are taking these points entirely out of context and in a vacuum. No, I don't think I am. I think there is enough heated rhetoric going on here, with people mis-stating what is actually going on to justify how they feel about it, that it's worth being very clear about what the problems here really are. Otherwise it feels like people are arguing against strawmen and makes it too easy to dismiss concerns that are very pertinent. The original article for this thread, by the way, does a good job here.
  - krinchan 5y ago
ique 5y ago
> The parts of it being uploaded to iCloud, not the whole thing, yes? If you leave your phone on default settings, that’s all of them. In fact you need to turn off a lot of things. Turn off backups, Photo Stream, Files, Mail Drop, album sharing (make sure you don’t accept any invites to shared albums or you will get flagged) and I’m sure there are more iCloud integrations I’m not aware of. It’s actually quite hard to not use iCloud, by design.
- bzbarsky 5y ago
  Thank you, that is useful context!

whoknowswhat11 5y ago

No - the amount of bad info in these discussions has gotten incredible. The more overblown the claims the more trashy the data it seems they are based on. It's funny, it is literally in the first paragraph of the system overview in terms of how the database of hashes is stored - "which is securely stored on users’ devices"

josephcsible 5y ago
You misunderstand what that quote is referring to.
- willseth 5y ago
  No, he's not. Read the documentation. The hash database your photos are compared to will live on your device, and scanning happens entirely on-device. "Apple further transforms this database into an unreadable set of hashes, which is securely stored on users’ devices."
  - josephcsible 5y ago
    Read further down: > the blinding step using the server-side secret is not possible on device because it is unknown to the device. The goal is to run the final step on the server and finish the process on server. This ensures the device doesn’t know the result of the match, but it can encode the result of the on-device match process before uploading to the server.
    - willseth 5y ago
      This is a confusing paragraph, but the "final step" is not matching per se. The final step reveals whether a match occurred - but it's clear that the database exists on-device and the database lookup occurs on-device. Note the last part: "... but it can encode the result of the on-device match process before uploading to the server." The result of the match already exists before it is uploaded to the server. This is also made clear in the diagram. Depending on how you define "matching," it either occurs on-device or no explicit matching actually occurs. The server gets a payload for each uploaded image and attempts to use its server-side secret to derive its decryption key from the header. If (and only if) the image was a match - as determined by the blinded on-device comparison - it will now have a key to decrypt the rest of the payload (for review). Note that neither client nor server explicitly compare the real database hash to the image hash. The comparison is absorbed into crypto "properties."
      - josephcsible 5y ago
        Do you agree with these two statements? 1. For every image that's scanned, whether matching or non-matching, some data will be sent to the server. 2. Your phone never learns and has no way to tell which images match and which ones don't.
        willseth 5y ago
        Ugh. Feel free to expound any of your vague replies in this thread with actual explanations that make sense under any reasonable interpretation of "on device."

josephcsible 5y ago

Your understanding is incorrect. The NCMEC database is unavailable to your device. The hashes are checked by communicating with a server. In particular, only the server ever learns if there was a match, not your device.

willseth 5y ago
Wrong.

krinchan 5y ago

> The parts of it being uploaded to iCloud, not the whole thing, yes? This is policy, not capability. The capability is each and every image can be scanned. > As I understand it, the whole point is that the hashes are computed on-device and compared to the NCMEC database on-device. Is my understanding incorrect? You are incorrect but also the concern is NCMEC’s database’s accuracy. Also, going by other NPO’s the government has taken an interest in, NCMEC is very exposed to government control. They can easily decide to allow the government to slip a few extra hashes in their database and tell no one. They can do this in exchange for protecting their NPO status, a national security letter, anything. We will never know and if we find out, we will have no way to hold them accountable. Ever. Anyway, the NMEC database is NDA’ed and a secret. It’s not open to review or auditing. It’s also grossly inaccurate and nearly useless. You are taking these points entirely out of context and in a vacuum. It reads a bit bad faith and win an Internet argument at any cost.

bzbarsky 5y ago
> This is policy, not capability. The capability is each and every image can be scanned. Are you familiar with the implementation? If it's in the uploader, then the capability for each image to be scanned sounds like it would involve a bunch of code changes. But let's posit that the implementation just checks the "uploaded to iCloud" flag and hence this is "just policy". I agree that this is concerning, but I think it's important to distinguish between "could do X" and "is doing X" when describing a situation. > You are incorrect I would love to be enlightened here. Can you please point me to an explanation of how my understanding is incorrect? > but also the concern is NCMEC’s database’s accuracy I absolutely share this concern. > You are taking these points entirely out of context and in a vacuum. No, I don't think I am. I think there is enough heated rhetoric going on here, with people mis-stating what is actually going on to justify how they feel about it, that it's worth being very clear about what the problems here really are. Otherwise it feels like people are arguing against strawmen and makes it too easy to dismiss concerns that are very pertinent. The original article for this thread, by the way, does a good job here.
- krinchan 5y ago

ique 5y ago

> The parts of it being uploaded to iCloud, not the whole thing, yes? If you leave your phone on default settings, that’s all of them. In fact you need to turn off a lot of things. Turn off backups, Photo Stream, Files, Mail Drop, album sharing (make sure you don’t accept any invites to shared albums or you will get flagged) and I’m sure there are more iCloud integrations I’m not aware of. It’s actually quite hard to not use iCloud, by design.

bzbarsky 5y ago
Thank you, that is useful context!