5 ms·

Any idea why Apple didn’t just implement server side scanning like everyone else?

by spoonjim 5y ago

barbazoo 5y ago
Potentialy to be able to introduce e2e encryption later on.
mortenjorck 5y ago
As covered in other articles, that is exactly what they were doing previously.
- rootusrootus 5y ago
  I'm not so sure. John Gruber's write-up said that Apple has only sent over a couple hundred reports in the last year to the gov't, compared to over 20 million from Facebook. This suggests to me that Apple's scanning wasn't nearly so widespread.
  - zionic 5y ago
    Because no one in their right mind uploads CP to a cloud service, and apparently pedos abuse Facebook’s easy sign up process to bulk upload CP. Not that it matters when those Facebook sign ups are probably proxied with throwaway emails
- tpush 5y ago
  No, they did not. That was erroneous reporting by the Telegraph that a lot of outlets copied [0]. The correction: > This story originally said Apple screens photos when they are uploaded to iCloud, Apple’s cloud storage service. Ms Horvath and Apple’s disclaimer did not mention iCloud, and the company has not specified how it screens material, saying this information could help criminals. And from the interview with TechCrunch: > This is an area we’ve been looking at for some time, including current state of the art techniques which mostly involves scanning through entire contents of users’ libraries on cloud services that — as you point out — isn’t something that we’ve ever done; to look through users’ iCloud Photos. [0] https://www.telegraph.co.uk/technology/2020/01/08/apple-scans-icloud-photos-check-child-abuse/ https://www.telegraph.co.uk/technology/2020/01/08/apple-scan...
pvarangot 5y ago
This article speculates that that's because Apple is not scanning on iCloud to respect their privacy policy: https://www.hackerfactor.com/blog/index.php?/archives/929-On https://www.hackerfactor.com/blog/index.php?/archives/929-On... Apple's report count to the NCMEC is really low so it's probably true that they are not scanning on iCloud unless they receive a warrant.
lawkwok 5y ago
In this TechCrunch interview, Apple believes it is less invasive since no one can be individually targeted. The hashes are hard coded into each iOS release which is the same for all iOS devices. The database is not vulnerable to server side changes. Additionally, FWIW, they do not want to start analyzing entire iCloud photo libraries so this system only analyzes new uploads. https://techcrunch.com/2021/08/10/interview-apples-head-of-privacy-details-child-abuse-detection-and-messages-safety-features/ https://techcrunch.com/2021/08/10/interview-apples-head-of-p...
- Dah00n 5y ago
  >The hashes are hard coded into each iOS release Do you have a source on that? Since it is illegal to share those hashes in any way or form. Even people working with photo forensic and big photo sharing sites cannot get access to them. I very much doubt Apple can incorporate them into the iOS release without breaking multiple laws. The hashes themselves can easily be reversed to (bad quality) pictures so having the hashes equals having child pornography. Edit: https://www.hackerfactor.com/blog/index.php?/archives/929-One-Bad-Apple.html https://www.hackerfactor.com/blog/index.php?/archives/929-On...
  - FabHK 5y ago
    > Since it is illegal to share those hashes in any way or form Source? (The link you provide does not claim that, as far as I could see.)
    - lixtra 5y ago
      The article claims that photoDNA is reversible to 26x26 images and claims that the hashes are therefore CP.
      - FabHK 5y ago
        Ah, right. But Apple is using NeuralHash, not photoDNA, right? Does that suffer the same problem?
wyager 5y ago
Pessimistically: to allow them to (eventually) scan other content that you don't upload. I think pessimism about Apple's behavior is somewhat warranted at this point.
fortenforge 5y ago
It's a good question. The only explanation that makes sense is that this now allows them to begin end-to-end encryption of iCloud photos. I see that many commentators are claiming that they could already have started e2e encryption without introducing this "backdoor." While this is true, Apple would then be creating a perfect environment for child abusers to house their CSAM content on Apple's own servers. You can understand why Apple might not want to do that. This allows Apple to get to what is in their mind the best of both worlds: a truly private cloud for their valued users while not creating a safe haven for child abusers.
- abecedarius 5y ago
  Lawyerly word games. The e in e2e is the user, or a device loyal to them; malware on the user's device has always been understood as a subversion of e2e.

Any idea why Apple didn’t just implement server side scanning like everyone else?

barbazoo 5y ago

Potentialy to be able to introduce e2e encryption later on.

mortenjorck 5y ago

As covered in other articles, that is exactly what they were doing previously.

rootusrootus 5y ago
I'm not so sure. John Gruber's write-up said that Apple has only sent over a couple hundred reports in the last year to the gov't, compared to over 20 million from Facebook. This suggests to me that Apple's scanning wasn't nearly so widespread.
- zionic 5y ago
  Because no one in their right mind uploads CP to a cloud service, and apparently pedos abuse Facebook’s easy sign up process to bulk upload CP. Not that it matters when those Facebook sign ups are probably proxied with throwaway emails
tpush 5y ago
No, they did not. That was erroneous reporting by the Telegraph that a lot of outlets copied [0]. The correction: > This story originally said Apple screens photos when they are uploaded to iCloud, Apple’s cloud storage service. Ms Horvath and Apple’s disclaimer did not mention iCloud, and the company has not specified how it screens material, saying this information could help criminals. And from the interview with TechCrunch: > This is an area we’ve been looking at for some time, including current state of the art techniques which mostly involves scanning through entire contents of users’ libraries on cloud services that — as you point out — isn’t something that we’ve ever done; to look through users’ iCloud Photos. [0] https://www.telegraph.co.uk/technology/2020/01/08/apple-scans-icloud-photos-check-child-abuse/ https://www.telegraph.co.uk/technology/2020/01/08/apple-scan...

pvarangot 5y ago

This article speculates that that's because Apple is not scanning on iCloud to respect their privacy policy: https://www.hackerfactor.com/blog/index.php?/archives/929-On https://www.hackerfactor.com/blog/index.php?/archives/929-On... Apple's report count to the NCMEC is really low so it's probably true that they are not scanning on iCloud unless they receive a warrant.

lawkwok 5y ago

In this TechCrunch interview, Apple believes it is less invasive since no one can be individually targeted. The hashes are hard coded into each iOS release which is the same for all iOS devices. The database is not vulnerable to server side changes. Additionally, FWIW, they do not want to start analyzing entire iCloud photo libraries so this system only analyzes new uploads. https://techcrunch.com/2021/08/10/interview-apples-head-of-privacy-details-child-abuse-detection-and-messages-safety-features/ https://techcrunch.com/2021/08/10/interview-apples-head-of-p...

Dah00n 5y ago
>The hashes are hard coded into each iOS release Do you have a source on that? Since it is illegal to share those hashes in any way or form. Even people working with photo forensic and big photo sharing sites cannot get access to them. I very much doubt Apple can incorporate them into the iOS release without breaking multiple laws. The hashes themselves can easily be reversed to (bad quality) pictures so having the hashes equals having child pornography. Edit: https://www.hackerfactor.com/blog/index.php?/archives/929-One-Bad-Apple.html https://www.hackerfactor.com/blog/index.php?/archives/929-On...
- FabHK 5y ago
  > Since it is illegal to share those hashes in any way or form Source? (The link you provide does not claim that, as far as I could see.)
  - lixtra 5y ago
    The article claims that photoDNA is reversible to 26x26 images and claims that the hashes are therefore CP.
    - FabHK 5y ago
      Ah, right. But Apple is using NeuralHash, not photoDNA, right? Does that suffer the same problem?

wyager 5y ago

Pessimistically: to allow them to (eventually) scan other content that you don't upload. I think pessimism about Apple's behavior is somewhat warranted at this point.

fortenforge 5y ago

It's a good question. The only explanation that makes sense is that this now allows them to begin end-to-end encryption of iCloud photos. I see that many commentators are claiming that they could already have started e2e encryption without introducing this "backdoor." While this is true, Apple would then be creating a perfect environment for child abusers to house their CSAM content on Apple's own servers. You can understand why Apple might not want to do that. This allows Apple to get to what is in their mind the best of both worlds: a truly private cloud for their valued users while not creating a safe haven for child abusers.

abecedarius 5y ago
Lawyerly word games. The e in e2e is the user, or a device loyal to them; malware on the user's device has always been understood as a subversion of e2e.