6 ms·

This actually enables Apple to apply end-to-end encryption, while still complying with US CSAM laws. Users' content is scanned for CSAM, and is encrypted before

This actually enables Apple to apply end-to-end encryption, while still complying with US CSAM laws. Users' content is scanned for CSAM, and is encrypted before leaving their phone. Whether one considers E2E encryption worth it if the content is still scanned before being encrypted is an exercise left to the reader. This potentially means all of iCloud, not just photos, could start to use E2E encryption as well - which is fantastic.

strangeattractr 5y ago
So if we submit to having all our content scanned by them they'll even give us E2EE on iCloud? I guess they really do care about our privacy.
deleted 5y ago
[deleted]
pseudalopex 5y ago
Leaking information to Apple makes it not E2E. What law do you think banned real E2E encryption?
- dpkonofa 5y ago
  There's no leak of content. None of your content ever gets sent to Apple...ever.
  - pseudalopex 5y ago
    "safety vouchers, which contain a visual derivative of the image, such as a low-resolution version"[1] And I said information. The hash matching is information. [1] https://www.apple.com/child-safety/pdf/Security_Threat_Model_Review_of_Apple_Child_Safety_Features.pdf#page=13 https://www.apple.com/child-safety/pdf/Security_Threat_Model...
    - dpkonofa 5y ago
      You edited your response because I specifically used the word "content" because that's what you used...
      - pseudalopex 5y ago
        I did not. The person I replied to said content. Not me.
vimy 5y ago
I don’t care about the cloud. I don’t want anyone scanning my device.
- PpEY4fu85hkQpn 5y ago
  Only photos that get sent to icloud are "scanned"
  - vimy 5y ago
    For now.
monocasa 5y ago
Which law specifically says that user data has to be scanned, breaking encryption if necessary? Everything I've seen says that they have to report what they find, but are under no obligation to actively look for it.
yyyk 5y ago
>This potentially means all of iCloud, not just photos, could start to use E2E encryption as well - which is fantastic. They have to scan things that are not photos. What if the bad guys just zip their photos and upload that? There also needs to be a solution to CSAM uploaded before NCMEC had a chance to tag it, especially to cases where the bad guys uploaded their CSAM and deleted it from their iPhone. What happens then, the bad guys get E2E and nobody can find them? There has to be a technical solution in mind for this, and everything I can think of has implications (Let the iPhone store hashes of deleted images? Would it be enough to scan also during download?) IMHO, any serious attempt to find CSAM using Apple's client-side approach requires more scanning, and Apple not being forward on that makes me trust them less. Also, the moment they expand the scanning, we should think carefully if there actually are any privacy benefits.
PixyMisa 5y ago
What law?

strangeattractr 5y ago

So if we submit to having all our content scanned by them they'll even give us E2EE on iCloud? I guess they really do care about our privacy.

deleted 5y ago

[deleted]

pseudalopex 5y ago

Leaking information to Apple makes it not E2E. What law do you think banned real E2E encryption?

dpkonofa 5y ago
There's no leak of content. None of your content ever gets sent to Apple...ever.
- pseudalopex 5y ago
  "safety vouchers, which contain a visual derivative of the image, such as a low-resolution version"[1] And I said information. The hash matching is information. [1] https://www.apple.com/child-safety/pdf/Security_Threat_Model_Review_of_Apple_Child_Safety_Features.pdf#page=13 https://www.apple.com/child-safety/pdf/Security_Threat_Model...
  - dpkonofa 5y ago
    You edited your response because I specifically used the word "content" because that's what you used...
    - pseudalopex 5y ago
      I did not. The person I replied to said content. Not me.

vimy 5y ago

I don’t care about the cloud. I don’t want anyone scanning my device.

PpEY4fu85hkQpn 5y ago
Only photos that get sent to icloud are "scanned"
- vimy 5y ago
  For now.

monocasa 5y ago

Which law specifically says that user data has to be scanned, breaking encryption if necessary? Everything I've seen says that they have to report what they find, but are under no obligation to actively look for it.

yyyk 5y ago

>This potentially means all of iCloud, not just photos, could start to use E2E encryption as well - which is fantastic. They have to scan things that are not photos. What if the bad guys just zip their photos and upload that? There also needs to be a solution to CSAM uploaded before NCMEC had a chance to tag it, especially to cases where the bad guys uploaded their CSAM and deleted it from their iPhone. What happens then, the bad guys get E2E and nobody can find them? There has to be a technical solution in mind for this, and everything I can think of has implications (Let the iPhone store hashes of deleted images? Would it be enough to scan also during download?) IMHO, any serious attempt to find CSAM using Apple's client-side approach requires more scanning, and Apple not being forward on that makes me trust them less. Also, the moment they expand the scanning, we should think carefully if there actually are any privacy benefits.

PixyMisa 5y ago

What law?