6 ms·

> Secondly, it seems rife for abuse: dont like someone who uses an ios device, msg them some cp and destroy their entire life. I see this a lot. First of all,

> Secondly, it seems rife for abuse: dont like someone who uses an ios device, msg them some cp and destroy their entire life. I see this a lot. First of all, if you even have CP in the first place that seems quite bad and that you've made yourself vulnerable. Messaging someone will also reveal yourself as the sender. But my bigger question of this hypothetical issue is that Facebook, Google, Dropbox, Microsoft, etc etc have been scanning for CP all of this time on their servers. So it's not like this is somehow a new proposition. Thus wouldn't this already be a big issue through the many, many more people that use all of these other company's cloud products?

DarkmSparks 5y ago
>Messaging someone will also reveal yourself as the sender Sending a link to 4chan /b would probably be enough. Or a hidden iFrame in a forum post. Its very very easy to get images onto someones device without their consent, getting them to upload them to a 3rd party is completely different.
- azinman2 5y ago
  So again, how is this different from Google Photos, Facebook messenger, etc etc? If this really was such an issue we would have hit it long ago. CSAM scanning is going occurring for photos that would be uploaded to iCloud.
  - DarkmSparks 5y ago
    because its scanning the content of the device, not what you did on the device. An iFrame full of CP downloaded from 4chan that fills the browser cache with CP just by visiting a harmless site would not go anywhere near Google Photos, Facebook messenger, etc etc It would trigger a scanner checking the browser cache for CP images. Those are just the obvious ways, by "rife" I mean there is any number of ways to get CP onto someones device without them knowing, unless the device itself is being scanned nothing would achieved by this. And if you dont think people are that messed up, check: https://en.wikipedia.org/wiki/Swatting https://en.wikipedia.org/wiki/Swatting
    - resfirestar 5y ago
      Good thing this system doesn’t scan browser cache, then. Unless you’re programmatically extracting photos from your browser cache and uploading them to iCloud, which would be a pretty impressive way to make sure you’re using up all your storage.
      - skinkestek 5y ago
        Ok, here is something that happened that could have triggerd this: Back when I used WhatsApp I got a lot of nice photos from friends and family there. WhatsApp doesn't (at least didn't) have a way to export them but I could find them on disk and I had an app that copied that folder to a cloud service. Problem is this folder contained all images from all chats. Now I'm not very edgy so most of my pictures are completely non-problematic (in fact I don't know of any problematic ones), but once in a while someone will join one of your groups and post shock pr0n. I've long since stopped backing up everything since I use Telegram now and it allows me to selectively backup the chats I want. But I wanted to mention just one very simple way were doing something completely reasonable could result in an investigation of an innocent person.
    - azinman2 5y ago
      But that’s not the proposed design. Browser cache isn’t getting advanced. It’s photos for iCloud. I’m not asking if people do bad things, I’m saying over and over again this is getting coverage on Hn and people are pointing to this hypothetical issue — yet this hypothetical issue has been possible for years on many more devices.
      - DarkmSparks 5y ago
        As far as I have read its scanning any images and messages on the device, as well as text entered into Siri. So accidentally stick a w in your siri teen porn search and you'll be seeing https://www.apple.com/v/child-safety/a/images/guidance-img__eu6rk2abgp6q_large.jpg https://www.apple.com/v/child-safety/a/images/guidance-img__... If it was photos taken on the device there would be no existing hash for the image to match.
- stjohnswarts 5y ago
  Currently it would not catch that 4chan thing as they only scan things that are uploaded to icloud photos. So you'd have to click on it and save to photos. This is the current implementation. I would guess that once they have their hooks in though all files with an image extension/header will be scanned and reported.
  - corobo 5y ago
    Send it via WhatsApp where it gets added to photos and later iCloud by default if I recall correctly
    - ninkendo 5y ago
      Citation desperately needed.
      - Karunamon 5y ago
        In general, any time you save a photo on iOS, it goes into the camera roll, which is automatically backed up into iCloud.
        ninkendo 5y ago
        That wasn’t the claim though, the claim was that if I text someone a photo via WhatsApp it will do all of this automatically without them choosing to save it. If WhatsApp does this by default then, ho boy is that a terrible implementation.
      - corobo 5y ago
        Try it? I'm not Wikipedia, first party research is allowed. Go for it
    - stjohnswarts 5y ago
      yeah I'm not sure I do know it's a separate step to move photo from whatsapp to "general" photo access. I would guess it is roped off or they wouldn't need that step.
- spicybright 5y ago
  Idk, most phones you just save an image and a cloud service auto syncs.
skinkestek 5y ago
I think a lot of people overestimate how hard it is to stay hidden for small jobs. Furthermore there is a lack of imagination here: - work from a hacked account (I've seen gmail accounts that have been "shared" with an attacker for long enough to let the attacker having conversations with their bank, i.e. attacker used the account but stayed hidden until the bank called to verify details.) - VPNs exist. - Russia exist. - nasty images can be embedded into details of innocent high resolution photos. - very soon they'll have to scan pdfs, pdf attachments and zip files otherwise this is just a joke. - at this time it becomes even easier to frame someone - etc Remember, the goal is probably not to get someone convicted, just to mess up their lives by getting business contacts, family and neighbors to wonder if they were really innocent or if they just got off the hook. That said, the bigger problem with having a secret database of objects to scan for is that it is secret: anything can go into it, allowing all kinds of fishing expeditions. I mean: if you have such a wonderful system it would be a shame not to use it to stop copyright infringement in the west, blasphemy (Christian or Atheist literature) in Muslim countries or lack of respect for the dear leader (Winnie Pooh memes) in China.

DarkmSparks 5y ago

>Messaging someone will also reveal yourself as the sender Sending a link to 4chan /b would probably be enough. Or a hidden iFrame in a forum post. Its very very easy to get images onto someones device without their consent, getting them to upload them to a 3rd party is completely different.

azinman2 5y ago
So again, how is this different from Google Photos, Facebook messenger, etc etc? If this really was such an issue we would have hit it long ago. CSAM scanning is going occurring for photos that would be uploaded to iCloud.
- DarkmSparks 5y ago
  because its scanning the content of the device, not what you did on the device. An iFrame full of CP downloaded from 4chan that fills the browser cache with CP just by visiting a harmless site would not go anywhere near Google Photos, Facebook messenger, etc etc It would trigger a scanner checking the browser cache for CP images. Those are just the obvious ways, by "rife" I mean there is any number of ways to get CP onto someones device without them knowing, unless the device itself is being scanned nothing would achieved by this. And if you dont think people are that messed up, check: https://en.wikipedia.org/wiki/Swatting https://en.wikipedia.org/wiki/Swatting
  - resfirestar 5y ago
    Good thing this system doesn’t scan browser cache, then. Unless you’re programmatically extracting photos from your browser cache and uploading them to iCloud, which would be a pretty impressive way to make sure you’re using up all your storage.
    - skinkestek 5y ago
      Ok, here is something that happened that could have triggerd this: Back when I used WhatsApp I got a lot of nice photos from friends and family there. WhatsApp doesn't (at least didn't) have a way to export them but I could find them on disk and I had an app that copied that folder to a cloud service. Problem is this folder contained all images from all chats. Now I'm not very edgy so most of my pictures are completely non-problematic (in fact I don't know of any problematic ones), but once in a while someone will join one of your groups and post shock pr0n. I've long since stopped backing up everything since I use Telegram now and it allows me to selectively backup the chats I want. But I wanted to mention just one very simple way were doing something completely reasonable could result in an investigation of an innocent person.
  - azinman2 5y ago
    But that’s not the proposed design. Browser cache isn’t getting advanced. It’s photos for iCloud. I’m not asking if people do bad things, I’m saying over and over again this is getting coverage on Hn and people are pointing to this hypothetical issue — yet this hypothetical issue has been possible for years on many more devices.
    - DarkmSparks 5y ago
      As far as I have read its scanning any images and messages on the device, as well as text entered into Siri. So accidentally stick a w in your siri teen porn search and you'll be seeing https://www.apple.com/v/child-safety/a/images/guidance-img__eu6rk2abgp6q_large.jpg https://www.apple.com/v/child-safety/a/images/guidance-img__... If it was photos taken on the device there would be no existing hash for the image to match.
stjohnswarts 5y ago
Currently it would not catch that 4chan thing as they only scan things that are uploaded to icloud photos. So you'd have to click on it and save to photos. This is the current implementation. I would guess that once they have their hooks in though all files with an image extension/header will be scanned and reported.
- corobo 5y ago
  Send it via WhatsApp where it gets added to photos and later iCloud by default if I recall correctly
  - ninkendo 5y ago
    Citation desperately needed.
    - Karunamon 5y ago
      In general, any time you save a photo on iOS, it goes into the camera roll, which is automatically backed up into iCloud.
      - ninkendo 5y ago
        That wasn’t the claim though, the claim was that if I text someone a photo via WhatsApp it will do all of this automatically without them choosing to save it. If WhatsApp does this by default then, ho boy is that a terrible implementation.
    - corobo 5y ago
      Try it? I'm not Wikipedia, first party research is allowed. Go for it
  - stjohnswarts 5y ago
    yeah I'm not sure I do know it's a separate step to move photo from whatsapp to "general" photo access. I would guess it is roped off or they wouldn't need that step.
spicybright 5y ago
Idk, most phones you just save an image and a cloud service auto syncs.

skinkestek 5y ago

I think a lot of people overestimate how hard it is to stay hidden for small jobs. Furthermore there is a lack of imagination here: - work from a hacked account (I've seen gmail accounts that have been "shared" with an attacker for long enough to let the attacker having conversations with their bank, i.e. attacker used the account but stayed hidden until the bank called to verify details.) - VPNs exist. - Russia exist. - nasty images can be embedded into details of innocent high resolution photos. - very soon they'll have to scan pdfs, pdf attachments and zip files otherwise this is just a joke. - at this time it becomes even easier to frame someone - etc Remember, the goal is probably not to get someone convicted, just to mess up their lives by getting business contacts, family and neighbors to wonder if they were really innocent or if they just got off the hook. That said, the bigger problem with having a secret database of objects to scan for is that it is secret: anything can go into it, allowing all kinds of fishing expeditions. I mean: if you have such a wonderful system it would be a shame not to use it to stop copyright infringement in the west, blasphemy (Christian or Atheist literature) in Muslim countries or lack of respect for the dear leader (Winnie Pooh memes) in China.