3 ms·

This is so overblown. Scanning images for CSAM seems to be a requirement followed by Facebook, Google, Insta and Snap already [1]: > To put this in perspective

This is so overblown. Scanning images for CSAM seems to be a requirement followed by Facebook, Google, Insta and Snap already [1]: > To put this in perspective, in 2019 Facebook reported 65 million instances of CSAM on its platform, according to The New York Times. Google reported 3.5 million photos and videos, while Twitter and Snap reported “more than 100,000,” Apple, on the other hand, reported 3,000 photos. ALL of those services are already scanning all your photos server side implying complete access to the photo for other purposes. Apple went above and beyond what anyone else does and moved the scanning to be client side! I can't believe they are getting shit for this. They are doing MORE than anyone else to protect your privacy, while still complying with federal laws. If you object to this, you should object to all cloud based photo storage services, and with the federal laws. Apple not only made it more private, but also transparently announced what they do and they are getting shit for it. [1] https://www.engadget.com/apple-child-safety-csam-detection-explainer-183029927.html https://www.engadget.com/apple-child-safety-csam-detection-e...

WA 5y ago
Is it so hard to understand? Some people don’t use cloud storage for precisely the reason that the photos are not encrypted. Now they can’t even use their phone for storing photos. The thing with "only when iCloud is enabled" is only for now. It’s trivial to make Scanning all photos default in a future version.
- nyuszika7h 5y ago
  That would require a software update and would definitely not go unnoticed. Would you rather they implement scanning on server side and never be able to enable end-to-end encryption for iCloud Photos? I imagine that might be the end goal, otherwise I don't see why they wouldn't have just done it on server side. Sure, this system still has the potential to be abused, but if I had to choose between "end-to-end encrypted with local scanning before upload, which can maybe be abused but has a higher chance of being noticed if it is, and can be disabled with a jailbreak if you're really paranoid" and "not end-to-end encrypted, Apple can inspect my whole photo library whenever they desire, which can go completely unnoticed due to gag orders forcing them to hand data over to governments, not even requiring a software update, and you are completely powerless to do anything about it except for not using iCloud Photos at all", I would definitely choose the former.
  - WA 5y ago
    Strawman. I choose no cloud storage plus device that doesn’t scan my data. You argue for the former, which isn’t implemented, vs the latter, which I assume is reality anyways for all cloud storage providers. We can have this discussion if Apple implements the former. If this was the goal, they would’ve announced it like you suggested.
  - Hackbraten 5y ago
    > and can be disabled with a jailbreak if you're really paranoid Except that if I’m really paranoid, I’m not going to skip security updates. And those updates will probably render known jailbreak exploits useless.
  - sodality2 5y ago
    False dichotomy. You should UNEQUIVOCALLY not be FORCED to choose one of those. You shouldn't choose one of those at all. I do not need to be treated like a criminal. Facebook et al scans server side because they have liability. Tell me why apple thinks they need to scan locally? They dont have liability, which is even worse. It means they're doing it for other reasons. Plenty of people read that as "wow apple is so kindhearted they did this without the business incentive". And you know what? They didn't. They might even have good intentions. But, as the saying goes, the path to hell is paved with good intentions.
kmbfjr 5y ago
It is not overblown. I refuse to be a perpetual suspect in the possession and transfer of child pornography. Having these checks on my phone is just a short hop to checking everything the camera sees. I worked with a guy who was convicted of this very crime. Do you know what the FBI installs on his computer and phone? This kind of monitoring. I am not going to be treated like I am on parole.
- raxxorrax 5y ago
  To form a collision here you basically use a partial image of the original. What it can do is leave some conclusion about the workings of their blackbox algorithm as the collision image ripped those parts that probably have no influence on the resulting hash. There will likely be more though. As long as you don't have the original images, it will be hard to create "fake" ones.
CrimsonRain 5y ago
You're wrong. Scanning is NOT required by US law. The law says IF [1] you know about CSAM, then you MUST report. If you don't know, you don't have to report. And it is not your legal duty scan. Law even has privacy sections [2]. But if you DO scan, then you must report. So all these CSAM scan is bullshit. Companies can stop scanning if they want to. [1] 18 US Code 2258A [2] 18 US Code 2258A -> F.1, F.2, F.3

WA 5y ago

Is it so hard to understand? Some people don’t use cloud storage for precisely the reason that the photos are not encrypted. Now they can’t even use their phone for storing photos. The thing with "only when iCloud is enabled" is only for now. It’s trivial to make Scanning all photos default in a future version.

nyuszika7h 5y ago
That would require a software update and would definitely not go unnoticed. Would you rather they implement scanning on server side and never be able to enable end-to-end encryption for iCloud Photos? I imagine that might be the end goal, otherwise I don't see why they wouldn't have just done it on server side. Sure, this system still has the potential to be abused, but if I had to choose between "end-to-end encrypted with local scanning before upload, which can maybe be abused but has a higher chance of being noticed if it is, and can be disabled with a jailbreak if you're really paranoid" and "not end-to-end encrypted, Apple can inspect my whole photo library whenever they desire, which can go completely unnoticed due to gag orders forcing them to hand data over to governments, not even requiring a software update, and you are completely powerless to do anything about it except for not using iCloud Photos at all", I would definitely choose the former.
- WA 5y ago
  Strawman. I choose no cloud storage plus device that doesn’t scan my data. You argue for the former, which isn’t implemented, vs the latter, which I assume is reality anyways for all cloud storage providers. We can have this discussion if Apple implements the former. If this was the goal, they would’ve announced it like you suggested.
- Hackbraten 5y ago
  > and can be disabled with a jailbreak if you're really paranoid Except that if I’m really paranoid, I’m not going to skip security updates. And those updates will probably render known jailbreak exploits useless.
- sodality2 5y ago
  False dichotomy. You should UNEQUIVOCALLY not be FORCED to choose one of those. You shouldn't choose one of those at all. I do not need to be treated like a criminal. Facebook et al scans server side because they have liability. Tell me why apple thinks they need to scan locally? They dont have liability, which is even worse. It means they're doing it for other reasons. Plenty of people read that as "wow apple is so kindhearted they did this without the business incentive". And you know what? They didn't. They might even have good intentions. But, as the saying goes, the path to hell is paved with good intentions.

kmbfjr 5y ago

It is not overblown. I refuse to be a perpetual suspect in the possession and transfer of child pornography. Having these checks on my phone is just a short hop to checking everything the camera sees. I worked with a guy who was convicted of this very crime. Do you know what the FBI installs on his computer and phone? This kind of monitoring. I am not going to be treated like I am on parole.

raxxorrax 5y ago
To form a collision here you basically use a partial image of the original. What it can do is leave some conclusion about the workings of their blackbox algorithm as the collision image ripped those parts that probably have no influence on the resulting hash. There will likely be more though. As long as you don't have the original images, it will be hard to create "fake" ones.

CrimsonRain 5y ago

You're wrong. Scanning is NOT required by US law. The law says IF [1] you know about CSAM, then you MUST report. If you don't know, you don't have to report. And it is not your legal duty scan. Law even has privacy sections [2]. But if you DO scan, then you must report. So all these CSAM scan is bullshit. Companies can stop scanning if they want to. [1] 18 US Code 2258A [2] 18 US Code 2258A -> F.1, F.2, F.3