5 ms·

Presumably Apple would be afraid that, say, the EU becomes suspicious, issues a court order to obtain the hashes, notices they cannot audit the CCP hashes, poin

Presumably Apple would be afraid that, say, the EU becomes suspicious, issues a court order to obtain the hashes, notices they cannot audit the CCP hashes, pointedly asks "what is this", becomes absolutely livid that their citizens are spied on by a country that is not them, fines Apple out the wazoo, then extradites whoever is responsible and puts them in prison. I mean, China's not the only player in this. Putting extra hashes to surveil Chinese citizens, yeah, they might do that, but it'd be suicide to put them anywhere else.

riffraff 5y ago
Seems pretty trivial to have different servers sides per country, and put there a different db. EU, China, Iran, US: everyone gets to spy on their own children and forbid whatever they want.
- breuleux 5y ago
  The db is encrypted and uploaded to user devices. If each country gets a different db, the payload will be different in each country, which does not make sense if it's all supposed to be CSAM. So Apple would likely just say "these were mandated by the US government for US citizens," punting the ball in their court, unless they are forbidden to say so, in which case they'll say nothing, but we all know what it means. That's when you know you should change phones and stop using all cloud services, because obviously all cloud services scan for the same thing. On the flip side, though, at least Apple will have given us a canary. And that's why I don't think Apple will be asked to add these hashes: if the governments don't want their citizens to know what's being scanned server side, pushing the equivalent data to clients would tip their hand. They might just write Apple off as a loss and rely on Google, Facebook, etc.
  - sillysaurusx 5y ago
    This isn’t true. The db is blinded. We have no way of knowing what’s in it. It would be trivial to have the same payload on each device, and extract different answers using the matching server side db which varies by country. Perhaps not trivial, but just short.
    - breuleux 5y ago
      I feel that it's the kind of scheme that requires too much cooperation from too many people and organizations with conflicting incentives. It's possible some countries would not want the hashes from certain other governments in the db at all. And then what? I may be wrong, but I also believe we can know how many hashes are in the db, which means that if it contains extra hashes from dozens of governments, it would become suspiciously large relative to how many CSAM images we know exist. Furthermore, in this scenario the db cannot be auditable, so the scheme falls apart as soon as some rogue judge decides to order an audit. I honestly don't think Apple wants to deal with any of that crap and that they would rather silently can the system and do exactly what everybody else does than place themselves in the line of fire when their own unique trademark system is being abused.
      - sillysaurusx 5y ago
        Would they rather deal with the CCP shutting off iPhone sales in China? History has shown that the CCP is willing to do that if it comes down to it. (I remind you that at one time, Google was a primary search engine in China.)
    - azinman2 5y ago
      What do you mean blinded? It’s already been promised there will be a way to verify the hash db on your own device.
      - sillysaurusx 5y ago
        It’s blinded in the cryptographic sense. It’s a specific term. I would go into detail, but <reasons>. Suffice to say, unless you provide proof, I am reasonably confident there’s no way to verify the hash db doesn’t contain extra hashes other than the CSAM hashes provided by the US government. But I’ve been wrong many times before.
        azinman2 5y ago
        Well first of all, it's not provided by the US government. It's a non-profit, and Apple has already said they're going to look for another db from another nation and only included hashes that are the union of the two to prevent exactly this kind of attack. If what you mean by blinded is that you don't know what the source image is for the hash, that's true. Otherwise Apple would just be putting a database of child porn on everyone's phones. You gotta find some kind of balance here. What do you mean you can't verify it doesn't contain extra hashes? Meaning that Apple will say here are the hashes in your phone, but secretly will have extra hashes they're not telling you about? Not only is this the kind of thing that security researchers will quickly find, you're assuming a very sinister set of features from Apple that they'll only tell you half the story. If that were the case, then why offer the hashes at all? It's an extremely cynical take. The reality is all of the complaints about this system went from this specific implementation, and then as details get revealed, it's now all about the future hypothetical situations. I'm personally concerned about future regulations, but those regulations could/would exist independently of this specific system. Further, Dropbox, Facebook, Microsoft, Google, etc all have user data unencrypted on their servers and are also just as vulnerable to said legislation. If the argument is this is searching your device, well the current implementation is its only searching what would be uploaded to a server instead. If you suggest that could change to anything on your device due to legislation, wouldn't that happen anyway? And then what is Google going to do... not follow the same laws? Both companies would have to implement new architectures and systems for complying. I'm generally concerned about the future of privacy, but I think people (including myself initially) have gone too far in losing their minds.
  - dhosek 5y ago
    >That's when you know you should change phones You'd have to switch to a dumb phone. Assuming you can find one that works on contemporary networks.
- knodi123 5y ago
  Yeah, but if they tell us they're doing that, then it's pretty obvious what they're up to. And if they don't tell us they're doing that, but do it anyway - then they have to perpetually pay every developer involved in that upgrade enough money to keep their mouth shut indefinitely - knowing that the developers know that APPLE knows how much they'd lose in fines if they got caught. Which is an unreasonably large liability, IMO.
  - vineyardmike 5y ago
    > if they tell us they're doing that, then it's pretty obvious what they're up to. didn't they already say the DB would be nation dependent?
- FabHK 5y ago
  It would be good, I think, if people read Apple's threat assessment before calling it "pretty trivial": > • Database update transparency: it must not be possible to surreptitiously change the encrypted CSAM database that’s used by the process. > • Database and software universality: it must not be possible to target specific accounts with a different encrypted CSAM database, or with different software performing the blinded matching. I mean, you can argue that Apple's safeguards are insufficient etc., but at least acknowledge that Apple has thought about this, outlined some solutions, and considers it a manageable threat. ETA: > Since no remote updates of the database are possible, and since Apple distributes the same signed operating system image to all users worldwide, it is not possible – inadvertently or through coercion – for Apple to provide targeted users with a different CSAM database. This meets our database update transparency and database universality requirements. > Apple will publish a Knowledge Base article containing a root hash of the encrypted CSAM hash database included with each version of every Apple operating system that supports the feature. Additionally, users will be able to inspect the root hash of the encrypted database present on their device, and compare it to the expected root hash in the Knowledge Base article. That the calculation of the root hash shown to the user in Settings is accurate is subject to code inspection by security researchers like all other iOS device-side security claims. > This approach enables third-party technical audits: an auditor can confirm that for any given root hash of the encrypted CSAM database in the Knowledge Base article or on a device, the database was generated only from an intersection of hashes from participating child safety organizations, with no additions, removals, or changes. Facilitating the audit does not require the child safety organization to provide any sensitive information like raw hashes or the source images used to generate the hashes – they must provide only a non-sensitive attestation of the full database that they sent to Apple. [1] https://www.apple.com/child-safety/pdf/Security_Threat_Model_Review_of_Apple_Child_Safety_Features.pdf https://www.apple.com/child-safety/pdf/Security_Threat_Model...
  - stickfigure 5y ago
    That's a lovely technical solution! It will last right up until the CCP rubber-hoses[0] Apple with "add these hashes or stop selling iPhones in China". Apple will cave. They've demonstrated the technology works. The CCP is paying attention. Look for this feature to be mandated across all phones soon. Pandora's box has been opened. [0]: https://xkcd.com/538/ https://xkcd.com/538/ (this link comes up with terrifying frequency on HN)
dgellow 5y ago
I think that you overestimate the EU reaction. Every few years we learn that our Europeans leaders and some citizens have been again spied by foreign powers, such as the US, and absolutely nothing ever happened.
- breuleux 5y ago
  The US is an ally and it is somewhat harder to punish a nation state than a company. Why would Apple take the risk? China can't exactly reveal that they are banning an American company for not spying on American citizens, and it's not clear what convincing pretext they could provide instead, so I don't think they would actually go through with a ban and Apple would probably just call their bluff.
- azinman2 5y ago
  A friend in the military told me years ago France was the number one hacker of the US gov. It goes both ways. This may have shifted over time as China, Russia, NK, Iran increase their attacks, but it doesn’t diminish the fact that the EU is also hacking the US without repercussions.
- FabHK 5y ago
  > I think that you overestimate the EU reaction. Great (depressing) Twitter account: Is EU Concerned? @ISEUConcerned Very, deeply, strongly, seriously, gravely, extremely, unprecedentedly https://twitter.com/ISEUConcerned https://twitter.com/ISEUConcerned
  - dgellow 5y ago
    Thanks, that's a really funny one :)
dont__panic 5y ago
> extradites whoever is responsible and puts them in prison If we lived in a world where the people who make these kind of decisions for companies were actually accountable in this way, life might be better in a lot of different ways. But sadly we do not.
c3534l 5y ago
I thought it was already common knowledge that China puts in different hardware backdoors for computers destined to different countries. I remember a while back a news story where China accidentally shipped a box of phones backdoored for China into the US.
Bjartr 5y ago
> citizens are spied on by a country that is not them I thought countries often have under the table agreements with one another to explicitly spy on each others citizens, since its illegal for the country to spy on its own citizens. It's illegal for the other country too, but it's a lot easier to turn a blind eye to it.
- ChemSpider 5y ago
  The EU is not spying on any of its citizen. If you think otherwise, please link to some sources. Otherwise these are baseless rumors. These "everyone is doing it" statements are nonsense. Not everything is doing it.
  - TheSpiceIsLife 5y ago
    You’re probably right. The USA is probably doing it for them. NSA tapped German Chancellery for decades, WikiLeaks claims NSA spying row: Denmark accused of helping US spy on European officials US caught spying on EU ‘allies’ AGAIN…not like the Europeans will do anything about it
  - int_19h 5y ago
    Just one example: https://en.wikipedia.org/wiki/Federal_Office_for_the_Protection_of_the_Constitution#Activities_and_operations https://en.wikipedia.org/wiki/Federal_Office_for_the_Protect... https://www.spiegel.de/international/germany/infiltrating-the-far-right-german-intelligence-has-130-informants-in-extremist-party-a-803136.html https://www.spiegel.de/international/germany/infiltrating-th...

riffraff 5y ago

Seems pretty trivial to have different servers sides per country, and put there a different db. EU, China, Iran, US: everyone gets to spy on their own children and forbid whatever they want.

breuleux 5y ago
The db is encrypted and uploaded to user devices. If each country gets a different db, the payload will be different in each country, which does not make sense if it's all supposed to be CSAM. So Apple would likely just say "these were mandated by the US government for US citizens," punting the ball in their court, unless they are forbidden to say so, in which case they'll say nothing, but we all know what it means. That's when you know you should change phones and stop using all cloud services, because obviously all cloud services scan for the same thing. On the flip side, though, at least Apple will have given us a canary. And that's why I don't think Apple will be asked to add these hashes: if the governments don't want their citizens to know what's being scanned server side, pushing the equivalent data to clients would tip their hand. They might just write Apple off as a loss and rely on Google, Facebook, etc.
- sillysaurusx 5y ago
  This isn’t true. The db is blinded. We have no way of knowing what’s in it. It would be trivial to have the same payload on each device, and extract different answers using the matching server side db which varies by country. Perhaps not trivial, but just short.
  - breuleux 5y ago
    I feel that it's the kind of scheme that requires too much cooperation from too many people and organizations with conflicting incentives. It's possible some countries would not want the hashes from certain other governments in the db at all. And then what? I may be wrong, but I also believe we can know how many hashes are in the db, which means that if it contains extra hashes from dozens of governments, it would become suspiciously large relative to how many CSAM images we know exist. Furthermore, in this scenario the db cannot be auditable, so the scheme falls apart as soon as some rogue judge decides to order an audit. I honestly don't think Apple wants to deal with any of that crap and that they would rather silently can the system and do exactly what everybody else does than place themselves in the line of fire when their own unique trademark system is being abused.
    - sillysaurusx 5y ago
      Would they rather deal with the CCP shutting off iPhone sales in China? History has shown that the CCP is willing to do that if it comes down to it. (I remind you that at one time, Google was a primary search engine in China.)
  - azinman2 5y ago
    What do you mean blinded? It’s already been promised there will be a way to verify the hash db on your own device.
    - sillysaurusx 5y ago
      It’s blinded in the cryptographic sense. It’s a specific term. I would go into detail, but <reasons>. Suffice to say, unless you provide proof, I am reasonably confident there’s no way to verify the hash db doesn’t contain extra hashes other than the CSAM hashes provided by the US government. But I’ve been wrong many times before.
      - azinman2 5y ago
        Well first of all, it's not provided by the US government. It's a non-profit, and Apple has already said they're going to look for another db from another nation and only included hashes that are the union of the two to prevent exactly this kind of attack. If what you mean by blinded is that you don't know what the source image is for the hash, that's true. Otherwise Apple would just be putting a database of child porn on everyone's phones. You gotta find some kind of balance here. What do you mean you can't verify it doesn't contain extra hashes? Meaning that Apple will say here are the hashes in your phone, but secretly will have extra hashes they're not telling you about? Not only is this the kind of thing that security researchers will quickly find, you're assuming a very sinister set of features from Apple that they'll only tell you half the story. If that were the case, then why offer the hashes at all? It's an extremely cynical take. The reality is all of the complaints about this system went from this specific implementation, and then as details get revealed, it's now all about the future hypothetical situations. I'm personally concerned about future regulations, but those regulations could/would exist independently of this specific system. Further, Dropbox, Facebook, Microsoft, Google, etc all have user data unencrypted on their servers and are also just as vulnerable to said legislation. If the argument is this is searching your device, well the current implementation is its only searching what would be uploaded to a server instead. If you suggest that could change to anything on your device due to legislation, wouldn't that happen anyway? And then what is Google going to do... not follow the same laws? Both companies would have to implement new architectures and systems for complying. I'm generally concerned about the future of privacy, but I think people (including myself initially) have gone too far in losing their minds.
- dhosek 5y ago
  >That's when you know you should change phones You'd have to switch to a dumb phone. Assuming you can find one that works on contemporary networks.
knodi123 5y ago
Yeah, but if they tell us they're doing that, then it's pretty obvious what they're up to. And if they don't tell us they're doing that, but do it anyway - then they have to perpetually pay every developer involved in that upgrade enough money to keep their mouth shut indefinitely - knowing that the developers know that APPLE knows how much they'd lose in fines if they got caught. Which is an unreasonably large liability, IMO.
- vineyardmike 5y ago
  > if they tell us they're doing that, then it's pretty obvious what they're up to. didn't they already say the DB would be nation dependent?
FabHK 5y ago
It would be good, I think, if people read Apple's threat assessment before calling it "pretty trivial": > • Database update transparency: it must not be possible to surreptitiously change the encrypted CSAM database that’s used by the process. > • Database and software universality: it must not be possible to target specific accounts with a different encrypted CSAM database, or with different software performing the blinded matching. I mean, you can argue that Apple's safeguards are insufficient etc., but at least acknowledge that Apple has thought about this, outlined some solutions, and considers it a manageable threat. ETA: > Since no remote updates of the database are possible, and since Apple distributes the same signed operating system image to all users worldwide, it is not possible – inadvertently or through coercion – for Apple to provide targeted users with a different CSAM database. This meets our database update transparency and database universality requirements. > Apple will publish a Knowledge Base article containing a root hash of the encrypted CSAM hash database included with each version of every Apple operating system that supports the feature. Additionally, users will be able to inspect the root hash of the encrypted database present on their device, and compare it to the expected root hash in the Knowledge Base article. That the calculation of the root hash shown to the user in Settings is accurate is subject to code inspection by security researchers like all other iOS device-side security claims. > This approach enables third-party technical audits: an auditor can confirm that for any given root hash of the encrypted CSAM database in the Knowledge Base article or on a device, the database was generated only from an intersection of hashes from participating child safety organizations, with no additions, removals, or changes. Facilitating the audit does not require the child safety organization to provide any sensitive information like raw hashes or the source images used to generate the hashes – they must provide only a non-sensitive attestation of the full database that they sent to Apple. [1] https://www.apple.com/child-safety/pdf/Security_Threat_Model_Review_of_Apple_Child_Safety_Features.pdf https://www.apple.com/child-safety/pdf/Security_Threat_Model...
- stickfigure 5y ago
  That's a lovely technical solution! It will last right up until the CCP rubber-hoses[0] Apple with "add these hashes or stop selling iPhones in China". Apple will cave. They've demonstrated the technology works. The CCP is paying attention. Look for this feature to be mandated across all phones soon. Pandora's box has been opened. [0]: https://xkcd.com/538/ https://xkcd.com/538/ (this link comes up with terrifying frequency on HN)

dgellow 5y ago

I think that you overestimate the EU reaction. Every few years we learn that our Europeans leaders and some citizens have been again spied by foreign powers, such as the US, and absolutely nothing ever happened.

breuleux 5y ago
The US is an ally and it is somewhat harder to punish a nation state than a company. Why would Apple take the risk? China can't exactly reveal that they are banning an American company for not spying on American citizens, and it's not clear what convincing pretext they could provide instead, so I don't think they would actually go through with a ban and Apple would probably just call their bluff.
azinman2 5y ago
A friend in the military told me years ago France was the number one hacker of the US gov. It goes both ways. This may have shifted over time as China, Russia, NK, Iran increase their attacks, but it doesn’t diminish the fact that the EU is also hacking the US without repercussions.
FabHK 5y ago
> I think that you overestimate the EU reaction. Great (depressing) Twitter account: Is EU Concerned? @ISEUConcerned Very, deeply, strongly, seriously, gravely, extremely, unprecedentedly https://twitter.com/ISEUConcerned https://twitter.com/ISEUConcerned
- dgellow 5y ago
  Thanks, that's a really funny one :)

dont__panic 5y ago

> extradites whoever is responsible and puts them in prison If we lived in a world where the people who make these kind of decisions for companies were actually accountable in this way, life might be better in a lot of different ways. But sadly we do not.

c3534l 5y ago

I thought it was already common knowledge that China puts in different hardware backdoors for computers destined to different countries. I remember a while back a news story where China accidentally shipped a box of phones backdoored for China into the US.

Bjartr 5y ago

> citizens are spied on by a country that is not them I thought countries often have under the table agreements with one another to explicitly spy on each others citizens, since its illegal for the country to spy on its own citizens. It's illegal for the other country too, but it's a lot easier to turn a blind eye to it.

ChemSpider 5y ago
The EU is not spying on any of its citizen. If you think otherwise, please link to some sources. Otherwise these are baseless rumors. These "everyone is doing it" statements are nonsense. Not everything is doing it.
- TheSpiceIsLife 5y ago
  You’re probably right. The USA is probably doing it for them. NSA tapped German Chancellery for decades, WikiLeaks claims NSA spying row: Denmark accused of helping US spy on European officials US caught spying on EU ‘allies’ AGAIN…not like the Europeans will do anything about it
- int_19h 5y ago
  Just one example: https://en.wikipedia.org/wiki/Federal_Office_for_the_Protection_of_the_Constitution#Activities_and_operations https://en.wikipedia.org/wiki/Federal_Office_for_the_Protect... https://www.spiegel.de/international/germany/infiltrating-the-far-right-german-intelligence-has-130-informants-in-extremist-party-a-803136.html https://www.spiegel.de/international/germany/infiltrating-th...