5 ms·

I want to ignore most of this article to complain about an inaccuracy that keeps coming up. > More broadly, they said the change will break end-to-end encrypti

by kemayo 5y ago

I want to ignore most of this article to complain about an inaccuracy that keeps coming up. > More broadly, they said the change will break end-to-end encryption for iMessage, which Apple has staunchly defended in other contexts. But... it wouldn't. The iMessage feature doesn't expose the contents of your message to anyone else under any circumstance. If you're a child under 13 and your parents have opted in to this feature, you get a choice of seeing naked-pictures sent to you and having your parents be notified that you chose to, and not seeing it with no notifications of anything. (But once you're 13+, no notifications would occur either way.) There are potential issues with this, mostly relating to abusive families being controlling. They'd have to do weird things like forcing their teenaged children to keep making new under-13 accounts to actually take advantage of it like that, though. And none of these issues impact the e2e status of iMessage in any way. Apple really screwed up PR by launching the iMessage feature alongside the scanning-and-reporting iCloud Photos feature. There's so much confusion out there about this. (The breaking-e2e aspect does exist with the iCloud Photos scanning... not that it's currently e2e, of course.)

TechBro8615 5y ago
So one part of the proposal breaks e2e encryption for Photos.app, and the other breaks it for Messages.
- kemayo 5y ago
  How does this break e2e for Messages? They're still only ever decrypted on your device, and their content is never shared with others. You have to radically redefine what "e2e encryption" means for this to qualify as breaking it. There's no e2e encryption for Photos currently, so it can't be breaking it there. If you use iCloud Photos, your photos are stored encrypted, but Apple has the key and could be doing all the cloud-scanning it felt like.
  - TechBro8615 5y ago
    Not sure it needs to exist already to be broken
    - kemayo 5y ago
      A hypothetical future where Apple doesn't have the encryptions keys for iCloud Photo Library, but this on-device scanning for uploads to iCloud Photo Library is happening -- that sounds more secure than the status quo, in which totally arbitrary searches of your photos could be done on the server in response to warrants/NSLs. I'm sure in such a future there'd be quite the argument happening about whether you could call it e2e.
      - TechBro8615 5y ago
        What also sounds more secure than the status quo is not scanning my private photos anywhere – not on my device, and not in your cloud where I grant you custody of them.
        kemayo 5y ago
        Although this is true, none of the major cloud services seem inclined to actually do that. Google, Microsoft, Dropbox, Facebook, they're all scanning photos[0]. Let's not pretend that this sort of thing is happening in isolation. There really is a big legal movement towards requiring encryption backdoors, and programs like Apple's here are effectively part of a big negotiation with law enforcement -- note that the reason Apple's currently not e2e is apparently that the FBI pushed them on it[1]. "We'll give you what you claim is important, CSAM scans, and in return we'll lock everything else up securely". Is this great? No. Would an absolutist "law enforcement can have nothing" position backfire into stupid legal decisions? Plausibly. [0]: https://en.wikipedia.org/wiki/PhotoDNA https://en.wikipedia.org/wiki/PhotoDNA [1]: https://www.popularmechanics.com/technology/security/a30631827/apple-fbi-encryption-whatsapp/ https://www.popularmechanics.com/technology/security/a306318...
EricE 5y ago
You can only inspect something if it's decrypted. Content is no longer private if there is anything inspecting it other than you. I expect cloud providers to fiddle with my data - because they can and do. I don't expect vendors, especially one touting themselves as being more privacy focused than everyone else, to be sifting through my data on device. Yes, today it's a carefully designed algorithm designed to be one way. The algorithm isn't the problem. The problem is the method used to deliver this algorithm can also be used to deliver *other* algorithms. And no, especially since 9/11 I have zero faith that this is as far as this mechanism will ever be used.
- kemayo 5y ago
  Okay, but your device literally has to decrypt the message in order to show it to you. It then does other things that are vaguely "content analysis" like generating link previews and marking up the text to make dates clickable. The iMessage feature is "it looks like someone has sent you a picture of their dick, are you sure you want to see that?" I know adults who'd like to turn that feature on. Could it hypothetically be extended in the future? Sure. But arguing against this feature as-is is about the same as arguing against the feature that lets you search for "dog" in your photos.

by kemayo 5y ago

TechBro8615 5y ago

So one part of the proposal breaks e2e encryption for Photos.app, and the other breaks it for Messages.

kemayo 5y ago
How does this break e2e for Messages? They're still only ever decrypted on your device, and their content is never shared with others. You have to radically redefine what "e2e encryption" means for this to qualify as breaking it. There's no e2e encryption for Photos currently, so it can't be breaking it there. If you use iCloud Photos, your photos are stored encrypted, but Apple has the key and could be doing all the cloud-scanning it felt like.
- TechBro8615 5y ago
  Not sure it needs to exist already to be broken
  - kemayo 5y ago
    A hypothetical future where Apple doesn't have the encryptions keys for iCloud Photo Library, but this on-device scanning for uploads to iCloud Photo Library is happening -- that sounds more secure than the status quo, in which totally arbitrary searches of your photos could be done on the server in response to warrants/NSLs. I'm sure in such a future there'd be quite the argument happening about whether you could call it e2e.
    - TechBro8615 5y ago
      What also sounds more secure than the status quo is not scanning my private photos anywhere – not on my device, and not in your cloud where I grant you custody of them.
      - kemayo 5y ago
        Although this is true, none of the major cloud services seem inclined to actually do that. Google, Microsoft, Dropbox, Facebook, they're all scanning photos[0]. Let's not pretend that this sort of thing is happening in isolation. There really is a big legal movement towards requiring encryption backdoors, and programs like Apple's here are effectively part of a big negotiation with law enforcement -- note that the reason Apple's currently not e2e is apparently that the FBI pushed them on it[1]. "We'll give you what you claim is important, CSAM scans, and in return we'll lock everything else up securely". Is this great? No. Would an absolutist "law enforcement can have nothing" position backfire into stupid legal decisions? Plausibly. [0]: https://en.wikipedia.org/wiki/PhotoDNA https://en.wikipedia.org/wiki/PhotoDNA [1]: https://www.popularmechanics.com/technology/security/a30631827/apple-fbi-encryption-whatsapp/ https://www.popularmechanics.com/technology/security/a306318...

EricE 5y ago

You can only inspect something if it's decrypted. Content is no longer private if there is anything inspecting it other than you. I expect cloud providers to fiddle with my data - because they can and do. I don't expect vendors, especially one touting themselves as being more privacy focused than everyone else, to be sifting through my data on device. Yes, today it's a carefully designed algorithm designed to be one way. The algorithm isn't the problem. The problem is the method used to deliver this algorithm can also be used to deliver *other* algorithms. And no, especially since 9/11 I have zero faith that this is as far as this mechanism will ever be used.

kemayo 5y ago
Okay, but your device literally has to decrypt the message in order to show it to you. It then does other things that are vaguely "content analysis" like generating link previews and marking up the text to make dates clickable. The iMessage feature is "it looks like someone has sent you a picture of their dick, are you sure you want to see that?" I know adults who'd like to turn that feature on. Could it hypothetically be extended in the future? Sure. But arguing against this feature as-is is about the same as arguing against the feature that lets you search for "dog" in your photos.