4 ms·

How long before people figure out the CSAM service endpoints and block them via a PI Hole device?

kemayo 5y ago
As I understand what has been said, the CSAM detection is part of the iCloud Photos upload process, via attaching some metadata to the photos that're being uploaded. So you could block this service, but it'd be functionally equivalent to just disabling iCloud Photos entirely.
- zionic 5y ago
  This makes sense, iCloud can just be blocked with the rest of the malware domains. For fun corporate and university IT types can start adding iCloud-related domains to their internal blacklists.
  - kemayo 5y ago
    For consistency, they'd need to block Google, Facebook, and everyone else who's scanning all your uploaded content. See: https://en.wikipedia.org/wiki/PhotoDNA https://en.wikipedia.org/wiki/PhotoDNA
    - Ajedi32 5y ago
      The distinction there is that it's the server doing the matching and reporting, not the client. People expect remote servers to be accessible to government searches, but not their own personal devices. This distinction is even codified in U.S. law. The government needs a warrant to search your phone, but only needs a subpoena to search a remote server that's storing your files[1]. But yes, I can see why that distinction might feel a little arbitrary at times, particularly in the modern age where cloud storage is so common. Perhaps the 4th amendment should cover third parties storing "papers, and effects" on a person's behalf. [1]: https://grandjurytarget.com/2020/10/28/by-search-warrant-or-subpoena-the-government-will-get-your-gmail-and-the-numbers-are-on-the-rise/ https://grandjurytarget.com/2020/10/28/by-search-warrant-or-...
      - kemayo 5y ago
        > The distinction there is that it's the server doing the matching and reporting, not the client. People expect remote servers to be accessible to government searches, but not their own personal devices. Speaking solely for myself, I don't see a meaningful difference between these cases. They're both "content you upload to a server is scanned", with the only difference being that the scan happens immediately before upload rather than sometime after upload. My opinion would be notably changed if Apple was scanning content you're not uploading, but the current system doesn't seem to allow for that.
        xur17 5y ago
        The reason the distinction is meaningful here is that Apple end to end encrypts iCloud uploads, meaning that Apple does not have access to the files. Scanning on the device is this weird middleground where they do sort of have access, and in some cases might very well end up with access (false positives).
        kemayo 5y ago
        Apple doesn't end to end encrypt iCloud Photo uploads -- they do transfer and store them encrypted, but they still have a key to view them if they want to.
        xur17 5y ago
        This [0] seems to indicate that they do: > iCloud secures your information by encrypting it when it's in transit, storing it in iCloud in an encrypted format, and using secure tokens for authentication. For certain sensitive information, Apple uses end-to-end encryption. This means that only you can access your information, and only on devices where you’re signed into iCloud. No one else, not even Apple, can access end-to-end encrypted information. [0] https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
        kemayo 5y ago

As I understand what has been said, the CSAM detection is part of the iCloud Photos upload process, via attaching some metadata to the photos that're being uploaded. So you could block this service, but it'd be functionally equivalent to just disabling iCloud Photos entirely.

zionic 5y ago
This makes sense, iCloud can just be blocked with the rest of the malware domains. For fun corporate and university IT types can start adding iCloud-related domains to their internal blacklists.
- kemayo 5y ago
  For consistency, they'd need to block Google, Facebook, and everyone else who's scanning all your uploaded content. See: https://en.wikipedia.org/wiki/PhotoDNA https://en.wikipedia.org/wiki/PhotoDNA
  - Ajedi32 5y ago
    The distinction there is that it's the server doing the matching and reporting, not the client. People expect remote servers to be accessible to government searches, but not their own personal devices. This distinction is even codified in U.S. law. The government needs a warrant to search your phone, but only needs a subpoena to search a remote server that's storing your files[1]. But yes, I can see why that distinction might feel a little arbitrary at times, particularly in the modern age where cloud storage is so common. Perhaps the 4th amendment should cover third parties storing "papers, and effects" on a person's behalf. [1]: https://grandjurytarget.com/2020/10/28/by-search-warrant-or-subpoena-the-government-will-get-your-gmail-and-the-numbers-are-on-the-rise/ https://grandjurytarget.com/2020/10/28/by-search-warrant-or-...
    - kemayo 5y ago
      > The distinction there is that it's the server doing the matching and reporting, not the client. People expect remote servers to be accessible to government searches, but not their own personal devices. Speaking solely for myself, I don't see a meaningful difference between these cases. They're both "content you upload to a server is scanned", with the only difference being that the scan happens immediately before upload rather than sometime after upload. My opinion would be notably changed if Apple was scanning content you're not uploading, but the current system doesn't seem to allow for that.
      - xur17 5y ago
        The reason the distinction is meaningful here is that Apple end to end encrypts iCloud uploads, meaning that Apple does not have access to the files. Scanning on the device is this weird middleground where they do sort of have access, and in some cases might very well end up with access (false positives).
        kemayo 5y ago
        Apple doesn't end to end encrypt iCloud Photo uploads -- they do transfer and store them encrypted, but they still have a key to view them if they want to.
        xur17 5y ago
        This [0] seems to indicate that they do: > iCloud secures your information by encrypting it when it's in transit, storing it in iCloud in an encrypted format, and using secure tokens for authentication. For certain sensitive information, Apple uses end-to-end encryption. This means that only you can access your information, and only on devices where you’re signed into iCloud. No one else, not even Apple, can access end-to-end encrypted information. [0] https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
        kemayo 5y ago