7 ms·

> The system relies on a database of hashes—cryptographic representations of images—of known CSAM photos provided by National Center for Missing & Exploited Chi

by geoah 5y ago

> The system relies on a database of hashes—cryptographic representations of images—of known CSAM photos provided by National Center for Missing & Exploited Children (NCMEC) and other child protection organizations. “Cryptographic representations of images”. That’s not the case though right? These are “neuralhashes” afaik which are nowhere close to cryptographic hashes but rather locality sensitive hashes which is a fancy speak for “the closer two images look like, the more similar the hash”. Vice and others keeps calling the cryptographic. Am I missing something here?

andrewmcwatters 5y ago
Edit: "The main purpose of the hash is to ensure that identical and visually similar images result in the same hash, and images that are different from one another result in different hashes."[1] Apple isn't using a "similar image, similar hash" system. They're using a "similar image, same hash" system. [1]: https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...
- heavyset_go 5y ago
  > There really is no sound concept of "the more similar the hash." Perceptual hashes are not cryptographic hashes. Perceptual hashing systems do compare hashes using a distance metric like the Hamming distance. If two images have similar hashes, then they look kind of similar to one another. That's the point of perceptual hashing.
  - salawat 5y ago
    Except when you're not measuring the similarity you think you are, because NeuralNets are f&#@ing weird. You know, let me put it this way. Yiu know that one really weird family member I'm pretty sure everyone either has or is? Guess what? They're a neural net too. This is what Apple is asking you to trust.
    - heavyset_go 5y ago
      I agree, I'm just talking about the difference between cryptographic hashes and other types of hashes.
  - deleted 5y ago
    [deleted]
  - andrewmcwatters 5y ago
    This isn’t what Apple is doing, regardless of the fact they are using the same terminology. See my edit above.
- function_seven 5y ago
  EDIT: Parent edited his comment to clarify. I understand the point now. I'm wrong about similar images needing to have "similar" hashes. Those hashes either need to match exactly, or else not be considered at all. IGNORE THIS: I think that's the parent comment's point. These are definitely not cryptographic hashes, since they—by design and necessity—need to mirror hash similarity to the perceptual similarity of the input images.
  - deleted 5y ago
    [deleted]
  - whoknowswhat11 5y ago
    They are almost the opposite. The programs create different hashes (though very similar) depending on platform you run on even with SAME input. No crypto hash works even close to this.
  - deleted 5y ago
    [deleted]
crooked-v 5y ago
Something to note here is that in the hash collision that was discovered, the two images look nothing alike. One is a picture of a dog, the other is blobby grey static.
- smoldesu 5y ago
  Furthermore, it may well be possible to combine that blobby grey static with another image, manipulating it's visual hash to create a "sleeper" positive. If this was possible in a week, then it's going to be very interesting to watch the technology change/evolve over the next few years.
  - floatingatoll 5y ago
    Doing so would create a positive that still doesn't pass Apple's human visual check against the (blurred) CSAM content associated with that checksum, and if it somehow did, it would still then also have to occur at qty.30 or more, and they'd have to pass a human visual check against the (unblurred) CSAM content by one of the agencies in possession of it. It's not possible to spoof that final test unless you possess real CSAM content, at which point you don't need to spoof that final test and you'll end up arrested for possession.
    - deleted 5y ago
      [deleted]
    - laverya 5y ago
      And if you make the second image be actual, 18+ porn? Will Apple be able to tell the difference between that and CSAM after the blur is applied? Bonus points if you match poses, coloration, background, etc.
      - floatingatoll 5y ago
        The only way to match poses, coloration, background, etc is to possess illegal CSAM content. If you do so successfully, you will result in your crafted image passing the blur check and reaching the agency that possesses the original image for final verification, where it will immediately fail because it is obviously a replica. You will then trigger that agency leading law enforcement to find the creator of the image, so that they can arrest whoever possesses CSAM content in order to model replicas after it. I think that's a perfectly acceptable outcome, since anyone with the hubris to both possess CSAM content and create replicas of it especially deserves to be arrested. Do you see a more problematic outcome here?
whoknowswhat11 5y ago
No - the reporting is absolutely terrible here. 1) These are more share similar visual features than crypto hashes. 2) HN posters have been claiming that apple reviewing flagged photos is a felony -> because HN commentators are claiming flagged photos are somehow "known" CASM - this is also likely totally false. The images may not be CASM and the idea that a moderation queue results in felony charges is near ridiculous. 3) This illustrates why apple's approach here (manual review after 30 images or so flagged) is not unreasonable. The push to say that this review is unnecessary is totally misguided. 4) They use words like "hash collision" for something that is not a hash. In fact, different devices will calculate DIFFERENT hashes for the SAME image at times. One request I have - before folks cite legal opinions - those opinions should have the name of a lawyer on them. Not this "I talked to a lawyer" because we have no idea if you described things accurately.
- sandworm101 5y ago
  >> those opinions should have the name of a lawyer on them. Not going to happen. Lawyers in the US have issues with offering unsolicited advice, and other problems with issuing advice into states where they are not admitted. So likely none of the US lawyers (and the great many more law students) here will ever put their real name to a comment.
  - agbell 5y ago
    This. Also try contacting a lawyer who knows this area and asking to pay for a legal opinion brief so that you can post it online to be debated by legions of software developers. Lawyers I know would politely decline that.
    - whoknowswhat11 5y ago
      No - this is actually done supposedly as part of biz dev. So your own firm may cover some costs if you have something to say. If you found someone to pay for you to do an analysis or offer your thoughts - you'd be in heaven!
  - 5y ago
Someone 5y ago
The neural hash itself isn’t cryptographic, but there’s cryptography involved in the process. They use “private set intersection” (https://en.wikipedia.org/wiki/Private_set_intersection https://en.wikipedia.org/wiki/Private_set_intersection) to compute a value that itself doesn’t say whether an image is in the forbidden list, yet when combined with sufficiently many other such values can be used to do that. They also encrypt the “NeuralHash and a visual derivative” on iCloud in such a way that Apple can only decrypt that if they got sufficiently many matching images (using https://en.wikipedia.org/wiki/Secret_sharing https://en.wikipedia.org/wiki/Secret_sharing) (For details and, possibly, corrections on my interpretation, see Apple’s technical summary at https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni... and https://www.apple.com/child-safety/pdf/Apple_PSI_System_Security_Protocol_and_Analysis.pdf https://www.apple.com/child-safety/pdf/Apple_PSI_System_Secu...)
robertoandred 5y ago
The CSAM hashes are encrypted and blinded, possible Vice and others conflated and/or combined steps.
atonse 5y ago
Yea by reading about this whole scandal I learned about perceptual hashes, because the whole time I kept thinking "can't they just alter one pixel and entirely change the hash" because I was only familiar with cryptographic hashes. It's a huge, huge, huge distinction.
jdavis703 5y ago
In a certain sense it is cryptographic because the original CSAM images remains secret. While the hash is not useful for maintaining integrity it still provides confidentiality. Edit: this is apparently not true as demonstrated by researchers.
- judge2020 5y ago
  This has technically been proven false: > Microsoft says that the "PhotoDNA hash is not reversible". That's not true. PhotoDNA hashes can be projected into a 26x26 grayscale image that is only a little blurry. 26x26 is larger than most desktop icons; it's enough detail to recognize people and objects. Reversing a PhotoDNA hash is no more complicated than solving a 26x26 Sudoku puzzle; a task well-suited for computers. https://www.hackerfactor.com/blog/index.php?/archives/929-One-Bad-Apple.html#:~:text=I%20have%20a%20whitepaper,possession%20of%20child%20pornography https://www.hackerfactor.com/blog/index.php?/archives/929-On...
  - robertoandred 5y ago
    PhotoDNA and NeuralHash are not the same thing.
    - judge2020 5y ago
      Apple is using a private perceptual hash on the backend, likely to further filter out bad/spam tickets. https://twitter.com/fayfiftynine/status/1427899951120490497?s=21 https://twitter.com/fayfiftynine/status/1427899951120490497?... Given neuralhash is a hash of a hash, I imagine they’re running photodna and not some custom solution which would require Apple ingesting and hasing all of the images themselves using another custom perceptual hash system. > . Instead of scanning images in the cloud, the system performs on-device matching using a database of known CSAM image hashes provided by NCMEC and other child-safety organizations. Apple further transforms this database into an unreadable set of hashes, which is securely stored on users’ devices. https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf#page=4 https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...
3np 5y ago
This is one of the most common misunderstandings, both when people are arguing for or against. People who understand tech well enough to recognize hashes like MD5 and SHA don't dive deep enough to understand that this is something completely different. I even suspect this is deliberate from Apple's side when announcing and talking about these changes - making people wrongly believe that only exact matches will trigger, except possibly in extremely rare cases and under concious attacks. They could have called it "fingerprint" or something but deliberately went with a technical term that even confuses technical people who know well enough what a hash usually means. Vice is falling victim to this misunderstanding stemming from the conflation of "hash".

by geoah 5y ago

andrewmcwatters 5y ago

Edit: "The main purpose of the hash is to ensure that identical and visually similar images result in the same hash, and images that are different from one another result in different hashes."[1] Apple isn't using a "similar image, similar hash" system. They're using a "similar image, same hash" system. [1]: https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...

heavyset_go 5y ago
> There really is no sound concept of "the more similar the hash." Perceptual hashes are not cryptographic hashes. Perceptual hashing systems do compare hashes using a distance metric like the Hamming distance. If two images have similar hashes, then they look kind of similar to one another. That's the point of perceptual hashing.
- salawat 5y ago
  Except when you're not measuring the similarity you think you are, because NeuralNets are f&#@ing weird. You know, let me put it this way. Yiu know that one really weird family member I'm pretty sure everyone either has or is? Guess what? They're a neural net too. This is what Apple is asking you to trust.
  - heavyset_go 5y ago
    I agree, I'm just talking about the difference between cryptographic hashes and other types of hashes.
- deleted 5y ago
  [deleted]
- andrewmcwatters 5y ago
  This isn’t what Apple is doing, regardless of the fact they are using the same terminology. See my edit above.
function_seven 5y ago
EDIT: Parent edited his comment to clarify. I understand the point now. I'm wrong about similar images needing to have "similar" hashes. Those hashes either need to match exactly, or else not be considered at all. IGNORE THIS: I think that's the parent comment's point. These are definitely not cryptographic hashes, since they—by design and necessity—need to mirror hash similarity to the perceptual similarity of the input images.
- deleted 5y ago
  [deleted]
- whoknowswhat11 5y ago
  They are almost the opposite. The programs create different hashes (though very similar) depending on platform you run on even with SAME input. No crypto hash works even close to this.
- deleted 5y ago
  [deleted]

crooked-v 5y ago

Something to note here is that in the hash collision that was discovered, the two images look nothing alike. One is a picture of a dog, the other is blobby grey static.

smoldesu 5y ago
Furthermore, it may well be possible to combine that blobby grey static with another image, manipulating it's visual hash to create a "sleeper" positive. If this was possible in a week, then it's going to be very interesting to watch the technology change/evolve over the next few years.
- floatingatoll 5y ago
  Doing so would create a positive that still doesn't pass Apple's human visual check against the (blurred) CSAM content associated with that checksum, and if it somehow did, it would still then also have to occur at qty.30 or more, and they'd have to pass a human visual check against the (unblurred) CSAM content by one of the agencies in possession of it. It's not possible to spoof that final test unless you possess real CSAM content, at which point you don't need to spoof that final test and you'll end up arrested for possession.
  - deleted 5y ago
    [deleted]
  - laverya 5y ago
    And if you make the second image be actual, 18+ porn? Will Apple be able to tell the difference between that and CSAM after the blur is applied? Bonus points if you match poses, coloration, background, etc.
    - floatingatoll 5y ago
      The only way to match poses, coloration, background, etc is to possess illegal CSAM content. If you do so successfully, you will result in your crafted image passing the blur check and reaching the agency that possesses the original image for final verification, where it will immediately fail because it is obviously a replica. You will then trigger that agency leading law enforcement to find the creator of the image, so that they can arrest whoever possesses CSAM content in order to model replicas after it. I think that's a perfectly acceptable outcome, since anyone with the hubris to both possess CSAM content and create replicas of it especially deserves to be arrested. Do you see a more problematic outcome here?

whoknowswhat11 5y ago

No - the reporting is absolutely terrible here. 1) These are more share similar visual features than crypto hashes. 2) HN posters have been claiming that apple reviewing flagged photos is a felony -> because HN commentators are claiming flagged photos are somehow "known" CASM - this is also likely totally false. The images may not be CASM and the idea that a moderation queue results in felony charges is near ridiculous. 3) This illustrates why apple's approach here (manual review after 30 images or so flagged) is not unreasonable. The push to say that this review is unnecessary is totally misguided. 4) They use words like "hash collision" for something that is not a hash. In fact, different devices will calculate DIFFERENT hashes for the SAME image at times. One request I have - before folks cite legal opinions - those opinions should have the name of a lawyer on them. Not this "I talked to a lawyer" because we have no idea if you described things accurately.

sandworm101 5y ago
>> those opinions should have the name of a lawyer on them. Not going to happen. Lawyers in the US have issues with offering unsolicited advice, and other problems with issuing advice into states where they are not admitted. So likely none of the US lawyers (and the great many more law students) here will ever put their real name to a comment.
- agbell 5y ago
  This. Also try contacting a lawyer who knows this area and asking to pay for a legal opinion brief so that you can post it online to be debated by legions of software developers. Lawyers I know would politely decline that.
  - whoknowswhat11 5y ago
    No - this is actually done supposedly as part of biz dev. So your own firm may cover some costs if you have something to say. If you found someone to pay for you to do an analysis or offer your thoughts - you'd be in heaven!
- 5y ago

Someone 5y ago

The neural hash itself isn’t cryptographic, but there’s cryptography involved in the process. They use “private set intersection” (https://en.wikipedia.org/wiki/Private_set_intersection https://en.wikipedia.org/wiki/Private_set_intersection) to compute a value that itself doesn’t say whether an image is in the forbidden list, yet when combined with sufficiently many other such values can be used to do that. They also encrypt the “NeuralHash and a visual derivative” on iCloud in such a way that Apple can only decrypt that if they got sufficiently many matching images (using https://en.wikipedia.org/wiki/Secret_sharing https://en.wikipedia.org/wiki/Secret_sharing) (For details and, possibly, corrections on my interpretation, see Apple’s technical summary at https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni... and https://www.apple.com/child-safety/pdf/Apple_PSI_System_Security_Protocol_and_Analysis.pdf https://www.apple.com/child-safety/pdf/Apple_PSI_System_Secu...)

robertoandred 5y ago

The CSAM hashes are encrypted and blinded, possible Vice and others conflated and/or combined steps.

atonse 5y ago

Yea by reading about this whole scandal I learned about perceptual hashes, because the whole time I kept thinking "can't they just alter one pixel and entirely change the hash" because I was only familiar with cryptographic hashes. It's a huge, huge, huge distinction.

jdavis703 5y ago

In a certain sense it is cryptographic because the original CSAM images remains secret. While the hash is not useful for maintaining integrity it still provides confidentiality. Edit: this is apparently not true as demonstrated by researchers.

judge2020 5y ago
This has technically been proven false: > Microsoft says that the "PhotoDNA hash is not reversible". That's not true. PhotoDNA hashes can be projected into a 26x26 grayscale image that is only a little blurry. 26x26 is larger than most desktop icons; it's enough detail to recognize people and objects. Reversing a PhotoDNA hash is no more complicated than solving a 26x26 Sudoku puzzle; a task well-suited for computers. https://www.hackerfactor.com/blog/index.php?/archives/929-One-Bad-Apple.html#:~:text=I%20have%20a%20whitepaper,possession%20of%20child%20pornography https://www.hackerfactor.com/blog/index.php?/archives/929-On...
- robertoandred 5y ago
  PhotoDNA and NeuralHash are not the same thing.
  - judge2020 5y ago
    Apple is using a private perceptual hash on the backend, likely to further filter out bad/spam tickets. https://twitter.com/fayfiftynine/status/1427899951120490497?s=21 https://twitter.com/fayfiftynine/status/1427899951120490497?... Given neuralhash is a hash of a hash, I imagine they’re running photodna and not some custom solution which would require Apple ingesting and hasing all of the images themselves using another custom perceptual hash system. > . Instead of scanning images in the cloud, the system performs on-device matching using a database of known CSAM image hashes provided by NCMEC and other child-safety organizations. Apple further transforms this database into an unreadable set of hashes, which is securely stored on users’ devices. https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf#page=4 https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...

3np 5y ago

This is one of the most common misunderstandings, both when people are arguing for or against. People who understand tech well enough to recognize hashes like MD5 and SHA don't dive deep enough to understand that this is something completely different. I even suspect this is deliberate from Apple's side when announcing and talking about these changes - making people wrongly believe that only exact matches will trigger, except possibly in extremely rare cases and under concious attacks. They could have called it "fingerprint" or something but deliberately went with a technical term that even confuses technical people who know well enough what a hash usually means. Vice is falling victim to this misunderstanding stemming from the conflation of "hash".