2 ms·

Do you ask for the same audit at Facebook, Google, Microsoft, Dropbox, and countless others who are already doing this and have been for years? I do not share

Do you ask for the same audit at Facebook, Google, Microsoft, Dropbox, and countless others who are already doing this and have been for years? I do not share your same concern of some abused db _today_.

amadeuspagel 5y ago
Neither Google nor Microsoft scan pictures people have on their devices running Android or Windows. I'm not sure how that's even applicable to Facebook and Dropbox.
- azinman2 5y ago
  You’re asking for an auditing chain presumably due to concerns about governments putting in photos of things that aren’t CP. Apple is only doing this for photos that get uploaded to iCloud, with this neural hash that gets uploaded with it. The actual verification of a CP match occurs on the server due to the hashes being blinded. So in many ways, it’s very similar to what these other cloud providers effectively do — search for CP matches on uploaded data. If you’re concerned about non-CP being scanned for, then you should already be concerned about that with everyone else. Thus if you’re asking for auditing of Apple, then you should widen your request. If you do, then sure, I can understand that. If you’re not concerned about the existing system, then I think you’re being non-consistent. Most people in comments to me seem to be non-consistent, and are being overly knee jerk about this… myself included initially.
- dwaite 5y ago
  Microsoft, Google, Facebook, Dropbox, etc. all scan photos which are cloud hosted for CSAM. Apple's new system scans only photos which are cloud hosted for CSAM. This would be the source of the inconsistency - that the code to do scanning is on the client side of the uploader rather than the server side of the uploader does not change any abuse scenarios, but exclusively serves "slippery slope" arguments of full on-device surveillance.
  - noptd 5y ago
    >does not change any abuse scenarios It absolutely does. When the scanning is server-side, companies can only scan the files you choose to send to their servers but with a client-side system in place, all it takes is a change in company policy and a few simple directory config changes to result in ANY file on your device being scanned. Slippery slope or not, the client-side system massively lowers the bar for abuse and that cannot be ignored.
    - azinman2 5y ago
      Except it's only occurring while simultaneously uploading to iCloud. The hash is metadata that goes along with it.
feanaro 5y ago
We should definitely start. Also, do those companies implement such subversive technology in devices they sell you?
sennight 5y ago
Sure, but I don't expect it from third party cloud platforms - in the same way I wouldn't expect accountability from a garbage man who reports to the police after finding evidence of crime in my garbage. Apple is, for some insane reason, trying to establish the precedent that the contents of your Apple product are now part of the public space - where expectation of privacy isn't a thing.
- azinman2 5y ago
  But that isn’t true. This is only photos uploaded to iCloud.
  - sennight 5y ago
    Why would you lie about something so easily disproven? "Instead of scanning images in the cloud, the system performs on-device matching..." https://www.apple.com/child-safety/ https://www.apple.com/child-safety/
    - azinman2 5y ago
      Lie? I don't take kindly to such words, because you're ascribing malicious intent where there is none. Please check your tone... HN comments are about assuming the best in everyone. This is only applying to photos uploaded to iCloud. Every single thing talks exactly about that, including the technical details: https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni... The hash matching is occurring on device, but only for iCloud photo images: > Before an image is stored in iCloud Photos, an on-device matching process is performed for that image against the database of known CSAM hashes. This matching process is powered by a cryptographic technology called private set intersection, which determines whether there is a match without revealing the result. The device creates a cryptographic safety voucher that encodes the match result. It also encrypts the image’s NeuralHash and a visual derivative. This voucher is uploaded to iCloud Photos along with the image. Read that PDF. You'll see everything in it is designed for iCloud photos only.
istingray 5y ago
I don't use those services for this reason. Apple was the last remaining option that didn't do surveillance.

amadeuspagel 5y ago

Neither Google nor Microsoft scan pictures people have on their devices running Android or Windows. I'm not sure how that's even applicable to Facebook and Dropbox.

azinman2 5y ago
You’re asking for an auditing chain presumably due to concerns about governments putting in photos of things that aren’t CP. Apple is only doing this for photos that get uploaded to iCloud, with this neural hash that gets uploaded with it. The actual verification of a CP match occurs on the server due to the hashes being blinded. So in many ways, it’s very similar to what these other cloud providers effectively do — search for CP matches on uploaded data. If you’re concerned about non-CP being scanned for, then you should already be concerned about that with everyone else. Thus if you’re asking for auditing of Apple, then you should widen your request. If you do, then sure, I can understand that. If you’re not concerned about the existing system, then I think you’re being non-consistent. Most people in comments to me seem to be non-consistent, and are being overly knee jerk about this… myself included initially.
dwaite 5y ago
Microsoft, Google, Facebook, Dropbox, etc. all scan photos which are cloud hosted for CSAM. Apple's new system scans only photos which are cloud hosted for CSAM. This would be the source of the inconsistency - that the code to do scanning is on the client side of the uploader rather than the server side of the uploader does not change any abuse scenarios, but exclusively serves "slippery slope" arguments of full on-device surveillance.
- noptd 5y ago
  >does not change any abuse scenarios It absolutely does. When the scanning is server-side, companies can only scan the files you choose to send to their servers but with a client-side system in place, all it takes is a change in company policy and a few simple directory config changes to result in ANY file on your device being scanned. Slippery slope or not, the client-side system massively lowers the bar for abuse and that cannot be ignored.
  - azinman2 5y ago
    Except it's only occurring while simultaneously uploading to iCloud. The hash is metadata that goes along with it.

feanaro 5y ago

We should definitely start. Also, do those companies implement such subversive technology in devices they sell you?

sennight 5y ago

Sure, but I don't expect it from third party cloud platforms - in the same way I wouldn't expect accountability from a garbage man who reports to the police after finding evidence of crime in my garbage. Apple is, for some insane reason, trying to establish the precedent that the contents of your Apple product are now part of the public space - where expectation of privacy isn't a thing.

azinman2 5y ago
But that isn’t true. This is only photos uploaded to iCloud.
- sennight 5y ago
  Why would you lie about something so easily disproven? "Instead of scanning images in the cloud, the system performs on-device matching..." https://www.apple.com/child-safety/ https://www.apple.com/child-safety/
  - azinman2 5y ago
    Lie? I don't take kindly to such words, because you're ascribing malicious intent where there is none. Please check your tone... HN comments are about assuming the best in everyone. This is only applying to photos uploaded to iCloud. Every single thing talks exactly about that, including the technical details: https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni... The hash matching is occurring on device, but only for iCloud photo images: > Before an image is stored in iCloud Photos, an on-device matching process is performed for that image against the database of known CSAM hashes. This matching process is powered by a cryptographic technology called private set intersection, which determines whether there is a match without revealing the result. The device creates a cryptographic safety voucher that encodes the match result. It also encrypts the image’s NeuralHash and a visual derivative. This voucher is uploaded to iCloud Photos along with the image. Read that PDF. You'll see everything in it is designed for iCloud photos only.

istingray 5y ago

I don't use those services for this reason. Apple was the last remaining option that didn't do surveillance.