3 ms·
Why would they bother? That's a terrible way to approach it. Just pass legislation requiring in-country datacenters that can be decrypted by thoughtcrime enfor
by floatingatoll 5y ago
Why would they bother? That's a terrible way to approach it.
Just pass legislation requiring in-country datacenters that can be decrypted by thoughtcrime enforcers, like Russia and China are doing. Trying to get this done via a CSAM list that's absurdly closely audited would be a huge waste of time and not provide any significant benefit, and if such a request were ever made public, would likely result in severe political and economic sanctions.
That's what everyone's missing in this argument. There's no need to be all underhanded and secretive when you can just pass laws and conduct military-backed demands upon companies using those laws. Trying to exploit the CSAM process would be a horrifically bad idea, and would result in public exposure and humiliation, rather than the much more useful outcome that simply passing a law would provide.
- neolog 5y agoWithout the technology deployed, Apple can (and did) say they don't have the ability to break into users' phones. If Apple deploys on-phone scanning, governments can just tell Apple to support a new list. It won't be the NCMEC CSAM list. It will be a "public safety and security" list. I wouldn't rule out underhandedness either. [1] [1] https://www.nytimes.com/2020/07/01/technology/china-uighurs-hackers-malware-hackers-smartphones.html https://www.nytimes.com/2020/07/01/technology/china-uighurs-...
- floatingatoll 5y agoApple already has technology deployed to perform binary file scans of every file on macOS and iOS, and the ability to at any time release signatures for those scans, that are very difficult for normal users to prevent updates for. They've had that for years, maybe even a decade by now, and so far to date we have seen no abuse of that list. How is Apple's new CSAM list somehow increasing the chances of Apple going rogue, given that we've all been living with that risk for the past X years?
- neolog 5y agoWhat technology are you referring to as already deployed?
- floatingatoll 5y agoFor macOS, I'm talking about XProtect and MRT. I don't know the exact subsystem names on iOS, apologies. https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web https://support.apple.com/guide/security/protecting-against-... Each system is closed source, provides a mechanism for checking content signatures against files on disk, and is thought to report telemetry to Apple when signatures are found. How is CSAM scanning new and different from those existing closed-source systems?
- neolog 5y agoI'd say the primary differences are that the CSAM scan is a perceptual hash rather than a regular file hash, and that the technical infrastructure of the CSAM system is designed from the ground up to be used against (rather than for) the user and report them individually to authorities for violation.
- floatingatoll 5y agoDo you have an alternate design in mind that is both "used for the user", and is also effective at reporting CSAM content being uploaded from the device, without allowing CSAM abusers to opt-out of that reporting? I haven't been able to come up with anything myself, but maybe you've had better luck.
- neolog 5y agoI can only point to other people who know more than me. https://stratechery.com/2021/apples-mistake/ https://stratechery.com/2021/apples-mistake/ is a smart tech commentator https://www.nytimes.com/2021/08/11/opinion/apple-iphones-privacy.html https://www.nytimes.com/2021/08/11/opinion/apple-iphones-pri... are two security/encryption experts