5 ms·

I’ve been thinking carefully about this situation. I just don’t see the intrusion. Firstly, you are syncing your photos to iCloud. It’s equivalent to developi

I’ve been thinking carefully about this situation. I just don’t see the intrusion. Firstly, you are syncing your photos to iCloud. It’s equivalent to developing your photos at an old timey film shop. iCloud happens to have lots of security guarantees, much like the film shop. But the moment you develop CP, all bets are off. I think most of us lead pampered, selfish lives. Perhaps this is a “think of the children” cry, and perhaps this has been used for many evils over time. If Apple were to get their lists of hashes from China (a situation they’ve opened themselves up to in the future), then sure, that’s awful. Or if they were doing these checks and alerting law enforcement without iCloud sync, then that’s awful too. But this doesn’t seem to be a slippery slope, yet. They are targeting a specific case: you uploading your photos, and your photos being of known child sexual abuse. Yes, there are false positive photos in the database. Maybe there’s even a flower in there. But if you got flagged as a false positive, the moment law enforcement looks at your photos (which, remember, you’ve surrendered to iCloud), you sexually abusing a flower won’t cause any problems. Or will it? Please, my mind is open. I’d love to change it.

wobblykiwi 5y ago
This is about Apple scanning the pictures on your phone, not the pictures that have been synced to iCloud.
- camillomiller 5y ago
  A good point to keep in mind, there is no "scanning". There is a hashing, then a check of the hashes - not the pictures - and if a hash matches the on-device NCMEC hashes list a "security voucher" is generated. Said voucher will be uploaded to iCloud photos along with the picture it refers to, without anyone in the chain being able to know that it happened.
- 0x000000001 5y ago
  they already scan all the images on your phone. that's how i can search for "dog" or "flowers" and find results in my photo library.
  - idle_zealot 5y ago
    Local scanning/indexing is fine. It’s reporting the results of the scan to Apple that people have a problem with.
    - danudey 5y ago
      I'm not sure that's true. A lot of people seem to have less of a problem with Apple scanning for CSAM and more of a problem that they're doing it on the phone (and looking for specific images, I guess?).
      - idle_zealot 5y ago
        It’s the fact that the phone is scanning your images and relaying the results to Apple that’s the issue. If this feature were just an extension of existing on-device scanning and stayed on the device, perhaps informing the owner “Hey, it appears a few of your images may be CSAM. Would you like to review them?” then I don’t think people would be very upset.
- sillysaurusx 5y ago
  Do they do device local scanning for this purpose? Apple’s original announcement said that it was to give law enforcement answers about photos synced to iCloud. If so, then I’ll immediately change my mind and join the protest. Device local scanning is equivalent to someone checking your personal possessions at your home.
  - wobblykiwi 5y ago
    Yes, you can find more information here: https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni... From the overview: > Apple’s method of detecting known CSAM is designed with user privacy in mind. Instead of scanning images in the cloud, the system performs on-device matching using a database of known CSAM image hashes provided by NCMEC and other child-safety organizations. Apple further transforms this database into an unreadable set of hashes, which is securely stored on users’ devices.
    - sillysaurusx 5y ago
      Yes, but my understanding was that they do this for iCloud-synced photos. If iCloud is off, do they still do this? Your quote actually doesn’t contradict that, which is my main hangup. If you turn on iCloud, you forfeit certain expectations. I’ll read through it carefully now. EDIT: It was the very first sentence of the intro: > CSAM Detection enables Apple to accurately identify and report iCloud users who store known Child Sexual Abuse Material (CSAM) in their iCloud Photos accounts. I don’t get it. It’s their platform. Other image platforms do this matching. Old film shops used to do this matching. Why is this evil?
      - dmitrygr 5y ago
        If you scan in the cloud, photos not synced to the cloud are 100% not going to be scanned - they are JUST NOT THERE. If you can on device, you are one "if(" condition away from "Accidentally "scanning other photos. See the issue now?
      - idle_zealot 5y ago
- danudey 5y ago
  Do you have any general objection to client software scanning content it uploads before it uploads it, rather than afterwards? Scanning it on your phone means that unencrypted versions of your data don't have to leave your phone, which IMHO gives more privacy than any other option. Do you have an objection even though it means that the content (in a form readable by anyone else) never leaves your device? Would it be preferable if Apple scanned files that were synced to iCloud, but no longer encrypted them in transit/at rest, or encrypted them in a way that they are able to decrypt?
camillomiller 5y ago
>But this doesn’t seem to be a slippery slope, either. Any photos you’re worried about can trivially circumvent the hashing system: adjust their brightness. Boom, done. I've been briefed about it. Apple says explicitly that this is not the case. They mention that cropping, transforming, or even desaturating an image won't result in a hash that's so different from the matching one. The similarity will be high enough to detect the photo anyway. They don't seem eager to explain in detail how that actually works, though.
- sillysaurusx 5y ago
  Sorry, I edited that part out one minute after commenting. I realized it was a weakness in the argument. Thank you for pointing that out though. I had no idea.
- danudey 5y ago
  The reason they don't explain how it works is that the CSAM hash matching is an algorithm from NCMEC, which was apparently originally designed by Microsoft. If you want to learn about the algorithm/hashes, you have to, among other things, sign an NDA about it, so it's likely that Apple, legally, cannot go into detail about how it actually works. Microsoft has a page on it here if you're interested: https://www.microsoft.com/en-us/photodna https://www.microsoft.com/en-us/photodna For obvious reasons, they don't go into a whole lot of detail. I've learned a lot about how the process works from this blog post: https://hackerfactor.com/blog/index.php?/archives/929-One-Bad-Apple.html https://hackerfactor.com/blog/index.php?/archives/929-One-Ba... He gets a few facts about Apple's approach wrong, but it's an incredibly interesting read.
  - migueldeicaza 5y ago
    Apple designed a new system, which is different than PhotoDNA - they call it neural hash, and the specifics are not disclosed.
    - hariboapfel 5y ago
      crosschecking hashes is only possible if they use the „same“ implemantation for the hashes. it would be safe to assume that the implementation/algorythm is the same regardless of being called photodna/neuralhash.
x2r 5y ago
Apple used to be able to say 'we don't have that capability' if, for example, a Turkish judge ordered them to scan phones for a certain picture of Erdogan. What are they going to say now?

wobblykiwi 5y ago

This is about Apple scanning the pictures on your phone, not the pictures that have been synced to iCloud.

camillomiller 5y ago
A good point to keep in mind, there is no "scanning". There is a hashing, then a check of the hashes - not the pictures - and if a hash matches the on-device NCMEC hashes list a "security voucher" is generated. Said voucher will be uploaded to iCloud photos along with the picture it refers to, without anyone in the chain being able to know that it happened.
0x000000001 5y ago
they already scan all the images on your phone. that's how i can search for "dog" or "flowers" and find results in my photo library.
- idle_zealot 5y ago
  Local scanning/indexing is fine. It’s reporting the results of the scan to Apple that people have a problem with.
  - danudey 5y ago
    I'm not sure that's true. A lot of people seem to have less of a problem with Apple scanning for CSAM and more of a problem that they're doing it on the phone (and looking for specific images, I guess?).
    - idle_zealot 5y ago
      It’s the fact that the phone is scanning your images and relaying the results to Apple that’s the issue. If this feature were just an extension of existing on-device scanning and stayed on the device, perhaps informing the owner “Hey, it appears a few of your images may be CSAM. Would you like to review them?” then I don’t think people would be very upset.
sillysaurusx 5y ago
Do they do device local scanning for this purpose? Apple’s original announcement said that it was to give law enforcement answers about photos synced to iCloud. If so, then I’ll immediately change my mind and join the protest. Device local scanning is equivalent to someone checking your personal possessions at your home.
- wobblykiwi 5y ago
  Yes, you can find more information here: https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni... From the overview: > Apple’s method of detecting known CSAM is designed with user privacy in mind. Instead of scanning images in the cloud, the system performs on-device matching using a database of known CSAM image hashes provided by NCMEC and other child-safety organizations. Apple further transforms this database into an unreadable set of hashes, which is securely stored on users’ devices.
  - sillysaurusx 5y ago
    Yes, but my understanding was that they do this for iCloud-synced photos. If iCloud is off, do they still do this? Your quote actually doesn’t contradict that, which is my main hangup. If you turn on iCloud, you forfeit certain expectations. I’ll read through it carefully now. EDIT: It was the very first sentence of the intro: > CSAM Detection enables Apple to accurately identify and report iCloud users who store known Child Sexual Abuse Material (CSAM) in their iCloud Photos accounts. I don’t get it. It’s their platform. Other image platforms do this matching. Old film shops used to do this matching. Why is this evil?
    - dmitrygr 5y ago
      If you scan in the cloud, photos not synced to the cloud are 100% not going to be scanned - they are JUST NOT THERE. If you can on device, you are one "if(" condition away from "Accidentally "scanning other photos. See the issue now?
    - idle_zealot 5y ago
danudey 5y ago
Do you have any general objection to client software scanning content it uploads before it uploads it, rather than afterwards? Scanning it on your phone means that unencrypted versions of your data don't have to leave your phone, which IMHO gives more privacy than any other option. Do you have an objection even though it means that the content (in a form readable by anyone else) never leaves your device? Would it be preferable if Apple scanned files that were synced to iCloud, but no longer encrypted them in transit/at rest, or encrypted them in a way that they are able to decrypt?

camillomiller 5y ago

>But this doesn’t seem to be a slippery slope, either. Any photos you’re worried about can trivially circumvent the hashing system: adjust their brightness. Boom, done. I've been briefed about it. Apple says explicitly that this is not the case. They mention that cropping, transforming, or even desaturating an image won't result in a hash that's so different from the matching one. The similarity will be high enough to detect the photo anyway. They don't seem eager to explain in detail how that actually works, though.

sillysaurusx 5y ago
Sorry, I edited that part out one minute after commenting. I realized it was a weakness in the argument. Thank you for pointing that out though. I had no idea.
danudey 5y ago
The reason they don't explain how it works is that the CSAM hash matching is an algorithm from NCMEC, which was apparently originally designed by Microsoft. If you want to learn about the algorithm/hashes, you have to, among other things, sign an NDA about it, so it's likely that Apple, legally, cannot go into detail about how it actually works. Microsoft has a page on it here if you're interested: https://www.microsoft.com/en-us/photodna https://www.microsoft.com/en-us/photodna For obvious reasons, they don't go into a whole lot of detail. I've learned a lot about how the process works from this blog post: https://hackerfactor.com/blog/index.php?/archives/929-One-Bad-Apple.html https://hackerfactor.com/blog/index.php?/archives/929-One-Ba... He gets a few facts about Apple's approach wrong, but it's an incredibly interesting read.
- migueldeicaza 5y ago
  Apple designed a new system, which is different than PhotoDNA - they call it neural hash, and the specifics are not disclosed.
  - hariboapfel 5y ago
    crosschecking hashes is only possible if they use the „same“ implemantation for the hashes. it would be safe to assume that the implementation/algorythm is the same regardless of being called photodna/neuralhash.

x2r 5y ago

Apple used to be able to say 'we don't have that capability' if, for example, a Turkish judge ordered them to scan phones for a certain picture of Erdogan. What are they going to say now?