3 ms·

Apple keeps the scan results encrypted with a key they don't have until the device informs them that the threshold of 30 images that match known kiddie porn has

Apple keeps the scan results encrypted with a key they don't have until the device informs them that the threshold of 30 images that match known kiddie porn has been reached. After that, they get the decryption key and trigger a human review to make sure there haven't been 30 false positives at once. That is better, and more private, in a very meaningful way. False positive scan data sitting on the server is open to malicious misuse by anyone who can get a warrant. >Innocent man, 23, sues Arizona police for $1.5million after being arrested for murder and jailed for six days when Google's GPS tracker wrongly placed him at the scene of the 2018 crime https://www.dailymail.co.uk/news/article-7897319/Police-arrested-innocent-man-murder-using-Google-location-data.html https://www.dailymail.co.uk/news/article-7897319/Police-arre... Also, I sincerely doubt that Google has ended it's practice of refusing to hire a human being to check for false positives when a poorly performing algorithm is cheaper.

kelnos 5y ago
I do agree that it's more private, but I'm not sure it's better. I'm fine with the idea that if I upload stuff to someone else's server, they may take a look at it and maybe even punish me for what I've uploaded. Certainly if I encrypt the data before I upload it, they can't do that. But if I don't, then it's fine with me if they do. But my device should not be snitching on me. Yes, this device-side scanning is supposedly gated on enabling uploads to iCloud, but that doesn't really make for much of a distinction to me. And since Apple certainly has the capability, they are likely one secret court order away from being required to scan even photos that aren't being uploaded, at least on some targeted subset of devices.
- tshaddox 5y ago
  > And since Apple certainly has the capability, they are likely one secret court order away from being required to scan even photos that aren't being uploaded, at least on some targeted subset of devices. Apple has the ability to upload literally any software to iPhones, so this argument applies equally to literally any conceivable bad thing that software could do on iPhones.
  - GeekyBear 5y ago
    As well as any conceivable bad thing that Google could be ordered to add to Android.
    - tshaddox 5y ago
      Or Google with Chrome (way more reach than Android), or Microsoft with Windows, etc. This is why I reject slippery slope arguments for software updates to auto-updating platforms. They already have the ability to ship literally any conceivable software to millions of people, so the "slippery slope" already exists trivially for the evilest software you can imagine.

kelnos 5y ago

I do agree that it's more private, but I'm not sure it's better. I'm fine with the idea that if I upload stuff to someone else's server, they may take a look at it and maybe even punish me for what I've uploaded. Certainly if I encrypt the data before I upload it, they can't do that. But if I don't, then it's fine with me if they do. But my device should not be snitching on me. Yes, this device-side scanning is supposedly gated on enabling uploads to iCloud, but that doesn't really make for much of a distinction to me. And since Apple certainly has the capability, they are likely one secret court order away from being required to scan even photos that aren't being uploaded, at least on some targeted subset of devices.

tshaddox 5y ago
> And since Apple certainly has the capability, they are likely one secret court order away from being required to scan even photos that aren't being uploaded, at least on some targeted subset of devices. Apple has the ability to upload literally any software to iPhones, so this argument applies equally to literally any conceivable bad thing that software could do on iPhones.
- GeekyBear 5y ago
  As well as any conceivable bad thing that Google could be ordered to add to Android.
  - tshaddox 5y ago
    Or Google with Chrome (way more reach than Android), or Microsoft with Windows, etc. This is why I reject slippery slope arguments for software updates to auto-updating platforms. They already have the ability to ship literally any conceivable software to millions of people, so the "slippery slope" already exists trivially for the evilest software you can imagine.