3 ms·

Is there a good argument for doing the scanning on the phone and not on the iCloud servers?

by lifty 5y ago

kemayo 5y ago
Well, theoretically this could be a step towards e2e encrypting the photos so that Apple can't see them on their servers. This entire "secure tickets that unlock a derivative of your photos so we can review them" system would, in this interpretation, be there as a way to neuter law enforcement objections[1] to no longer being able to serve warrants for the contents of your photo library. Now, will this actually happen? Hard to say. [1] There was a story last year claiming that Apple wanted to turn on e2e, but the FBI got them to drop it. https://www.popularmechanics.com/technology/security/a30631827/apple-fbi-encryption-whatsapp/ https://www.popularmechanics.com/technology/security/a306318...
himaraya 5y ago
No. Contrary to Craig's claims, Google & Microsoft et al. do similar hash matching on the cloud, instead of 'looking at images'.
- notJim 5y ago
  But people consider that bad! With this system, Apple can never look at your photos in the cloud. They are a pipe for the bits, but they don't examine the contents, except on your device. I'm not saying I necessarily agree that this is better, all-told (mixed feelings), but I think it's worth acknowledging why a rational actor might consider this superior to Google doing whatever the fuck they want with anything you upload.
  - himaraya 5y ago
    I mean, Apple can, as long as iCloud remains unsecured by e2e, the roadmap for which remains MIA.
    - notJim 5y ago
      They can, but they say they don't. Of course if you're uploading data to their servers (and to a lesser extent, using their OS), you are trusting them to some degree.
LexGray 5y ago
Photos are currently encrypted e2e already so Apple does not have the access server side to create the hash unlike their competition who chews their customers data for machine learning. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- kemayo 5y ago
  You've misread that page -- the table just refers to content being stored in an encrypted form, even if Apple still possesses a key. There's a list below it of fully end-to-end encrypted content, which doesn't include Photos.
  - LexGray 5y ago
    True enough. Apple does have the key. Well then instead the answer is that they are having you pay the CPU and energy cost instead of wasting twice the energy decrypting and hashing your photos server side.
    - dwaite 5y ago
      You were sort of both right. Apple has the keys in escrow across several HSMs separate from the cloud hosting environment. Nothing within iCloud can actually see the content, but there are processes to get access to a particular account for various reasons (such as government order). There is a separation of permissions as well as hardware-generated audit logs. Reportedly the HSM systems were specifically manipulated to not be extensible via software updates. So it is E2E with a separate key escrow system, which Apple (wisely) does not attempt to call E2E. Apple couldn't implement the PhotoDNA-based scanning other providers have done because Apple would need access to the escrowed keys for each user photo uploaded.

Is there a good argument for doing the scanning on the phone and not on the iCloud servers?

by lifty 5y ago

Is there a good argument for doing the scanning on the phone and not on the iCloud servers?

Well, theoretically this could be a step towards e2e encrypting the photos so that Apple can't see them on their servers. This entire "secure tickets that unlock a derivative of your photos so we can review them" system would, in this interpretation, be there as a way to neuter law enforcement objections[1] to no longer being able to serve warrants for the contents of your photo library. Now, will this actually happen? Hard to say. [1] There was a story last year claiming that Apple wanted to turn on e2e, but the FBI got them to drop it. https://www.popularmechanics.com/technology/security/a30631827/apple-fbi-encryption-whatsapp/ https://www.popularmechanics.com/technology/security/a306318...

himaraya 5y ago

No. Contrary to Craig's claims, Google & Microsoft et al. do similar hash matching on the cloud, instead of 'looking at images'.

notJim 5y ago
But people consider that bad! With this system, Apple can never look at your photos in the cloud. They are a pipe for the bits, but they don't examine the contents, except on your device. I'm not saying I necessarily agree that this is better, all-told (mixed feelings), but I think it's worth acknowledging why a rational actor might consider this superior to Google doing whatever the fuck they want with anything you upload.
- himaraya 5y ago
  I mean, Apple can, as long as iCloud remains unsecured by e2e, the roadmap for which remains MIA.
  - notJim 5y ago
    They can, but they say they don't. Of course if you're uploading data to their servers (and to a lesser extent, using their OS), you are trusting them to some degree.

LexGray 5y ago

Photos are currently encrypted e2e already so Apple does not have the access server side to create the hash unlike their competition who chews their customers data for machine learning. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303

kemayo 5y ago
You've misread that page -- the table just refers to content being stored in an encrypted form, even if Apple still possesses a key. There's a list below it of fully end-to-end encrypted content, which doesn't include Photos.
- LexGray 5y ago
  True enough. Apple does have the key. Well then instead the answer is that they are having you pay the CPU and energy cost instead of wasting twice the energy decrypting and hashing your photos server side.
  - dwaite 5y ago
    You were sort of both right. Apple has the keys in escrow across several HSMs separate from the cloud hosting environment. Nothing within iCloud can actually see the content, but there are processes to get access to a particular account for various reasons (such as government order). There is a separation of permissions as well as hardware-generated audit logs. Reportedly the HSM systems were specifically manipulated to not be extensible via software updates. So it is E2E with a separate key escrow system, which Apple (wisely) does not attempt to call E2E. Apple couldn't implement the PhotoDNA-based scanning other providers have done because Apple would need access to the escrowed keys for each user photo uploaded.