7 ms·

There is an alternative, more reasonable way to look at the Apple proposal. The scanning occurs in order to upload files to iCloud photos. Your device is atte

There is an alternative, more reasonable way to look at the Apple proposal. The scanning occurs in order to upload files to iCloud photos. Your device is attesting that data you upload to iCloud photos is not pre-established CSAM. If you do not like the privacy implications of having your content inspected locally, on your device, simply choose another cloud photo provider and turn off iCloud photos. You are told about the system and you are free to turn the service off. That doesn't sound like a massive privacy invasion to me.

lern_too_spel 5y ago
iOS doesn't allow other cloud photo services to upload in the background except via flaky hacks, so the choice for iPhone users is really between iCloud Photos and crippled alternatives.
- anonuser123456 5y ago
  This is the tradeoff of the Apple ecosystem. For most users the trade off is a no-brainer because they don't care about the theoretical concerns that, in expectation, do not apply to them. I mean, what is the probability of this technology causing an innocent user harm? 1/1,000,000 ? 1/10,000,000? 1/100,000,000?
  - amznthrwaway 5y ago
    All evidence is that the chance of harm is literally zero. This stuff is used to scan pics on every photo hosting service already, and there’s no known instances of a life ruined over a hash collision. Every one of the harm narratives comes from a slippery slope fallacy.
  - skoskie 5y ago
    According to Apple, 1/1 Trillion chance of a false report per year. So the chance for a single photo to be incorrectly matched is much higher. But by setting a threshold at ~30 images before triggering a manual review, they get the odds extremely low. My bet is that error threshold will remain a constant for them. As tech gets better, they will reduce the threshold accordingly to maintain that error rate. In five years, I’m guessing they will only need three images to trigger a review.
- ajh13 5y ago
  I use NextCloud which syncs my photos from my iPhone to my in-home server. Then I use borgbackup to encrypt my photos/videos and send them to a cloud provider. All of it is automated and wasn't too much of a hassle to setup.
  - matthewdgreen 5y ago
    iCloud does more than just uploading. It enables transparent sync and offloading of photos. This means if your device has limited storage, iCloud Photos can shunt photo data out to the cloud while maintaining a local representation of the photo's existence. These iCloud features are "baked into" the APIs that apps use to integrate with the system photo library, e.g.: https://developer.apple.com/documentation/photokit/phasset#1656308 https://developer.apple.com/documentation/photokit/phasset#1... You can come up with third party solutions that accomplish some portion of this use case (photo backup) but you'll never be able to accomplish what Apple does with iCloud Photos unless Apple opens its APIs.
    - shuckles 5y ago
      A third party could implement the PHAsset abstraction over their own implementation of a photo library action sheet and the file provider APIs. It wouldn’t get you to feature parity, but the major differences are but minor frictions if your privacy threat model involves nation state adversaries. It is not possible to write an app on iOS that has permanent, transparent background network and runtime access, and it’s also not clear allowing such apps would be a privacy benefit for users at large. Apple already makes exceptions to this for certain apps (e.g. it seems like my Verizon Wireless app has background runtime). Are you suggesting that Apple should nominate a few photo services receive the same exception?
      - lern_too_spel 5y ago
        It's a benefit for users at large because they get to use services that provide more benefits (like Google Photos search and automatic video creation), services with more privacy (like self-hosted photo services), or services that are cheaper (like Amazon Photos). Android has demonstrated that there is no need to whitelist this. This is purely a lock-in play for Apple.
sirbutters 5y ago
This comment should be way up. People afraid of "what else" Apple can start scanning on our devices has always been a reality, way before CSAM. If they ever decided to remove the feature, it's not like it will magically make it impossible for Apple to ever scan our devices again in the future. They can run whatever code they want on their device. We've always put our trust on Apple to not do any shady things on our phone. This new outrage makes no sense at all. As you said, people can turn iCloud Photos off to disable the scan. Therefore people need to STFU.
- Infernal 5y ago
  > We've always put our trust on Apple to not do any shady things on our phone …and now we have a case in point of them doing shady things on our phones. This breaks the trust.
  - Retric 5y ago
    I don’t see what’s shady about this because it’s so public. They could do everything that’s happening on phone on the iCloud servers without telling you. So at worst it uses extra bandwidth per upload and some processing power and thus battery life from your phone. The minor advantage is you can actually inspect their procedural hashing algorithm, though not how they compare images server side. Sure, they could do something else in the future but that’s alway the risk with every update.
    - Infernal 5y ago
      It's the same point as above. They could do shady things with your data on their server. They could do shady things with the data on your phone. They always /could/, and up till now I trusted them not to. But now they /have/, that is the change.
      - Retric 5y ago
        Ok they lost your trust and it’s completely your choice to make that decision however you want, but how was this shady?
matthewdgreen 5y ago
iCloud Photos is a synchronization service that is integrated very tightly into the core iOS system. Even the basic APIs that allow apps to integrate with the system photo library are "iCloud aware" in the sense that the photo might not be on your device. iCloud Photos makes it possible to page photos on and off your device, which is a critical feature for people who can't afford to pay for the high-end iOS devices with extensive NVRAM storage. You, as a user, can turn off iCloud Photos. But your device functionality will be limited. And you cannot replace that functionality with any third-party alternative that will have the same feature-set and access to the low-level device features: Apple ensures this through the design of their OS and its extensive security features. There is a version of "you don't have to use iCloud Photos" in which Apple opens their OS to competing cloud services. But you can't say this is an option while also locking the device down to use one cloud provider.
- shuckles 5y ago
  It is hard to square the idea that Apple’s proposed CSAM detection pipeline is a fundamental affront to privacy, a human right, with the argument that turning off iCloud Photos is a false choice because alternatives don’t or can’t have feature parity. Even more so because every cloud photo service with the scale and quality of iCloud Photos is doing the same (and arguably worse!). I use Nextcloud and it is a more or less ok user experience; the major inconvenience is that your photo library isn’t available in UIImagePickerControllers. The image preview mechanics you describe can already be simulated with file provider APIs. Edit. I think my point more simply stated is that if you think turning off iCloud Photos or switching photo sync with another cloud provider “solved” the privacy problem, then you are in the same group of people who are annoyed that they can’t use Spotify with Siri or AirPlay 2. Welcome to the large number of 2nd class citizens on iOS. It’s not great out here, but it certainly doesn’t make the toggle a false choice.
  - matthewdgreen 5y ago
    I don’t think you need to square those options. I think that scanning people’s photos is very much an affront to privacy. Apple clearly agrees with me at some level because they are advertising that their system is “opt in”: you only get scanned if you turn on iCloud Photos. But this argument assumes that for most users this is a choice. For many users who have purchased iPhones with lower storage levels this is not really a choice — they have to use iCloud Photos to get the functionality they paid for, else they can’t synchronize photos and have to manually manage and risk deleting photos. They can use third party apps, but only with reduced functionality because Apple has chosen to privilege their own cloud service and lock those functions away from third party developers. To me it seems like Apple’s opt-in consent argument would make sense if and only if they offered users equivalent choices in third party cloud functionality: which they don’t.
jellicle 5y ago
Pretty obviously the only reason to scan on-device is that you intend to expand on-device scanning to all files on the device, regardless of whether they are uploaded or not. ("We don't want child molesters to get away by turning off uploads," said Apple spokesperson.) Literally no reason to develop this otherwise. Scanning cloud images would be 100x easier.
- shuckles 5y ago
  Apple has declared their criteria for evaluating the privacy of their CSAM scanning approach in their USENIX talk, and none of it relies on scanning all files. If you want to accuse them of lying, you will need to bring a lot more evidence since (i) presumably you believe they weren’t lying in the past and (ii) it would be an enormous liability if they were now. There are many reasonable criteria under which the proposed model is superior for privacy. Perhaps the only reasonable criteria under which it is not is some kind of scope creep in what files are scanned. (Scope creep in what content is scanned for is a risk - an even greater one as there is no transparency over the hash list - of incumbent solutions as well.)
- benhurmarcel 5y ago
  Either that, or Apple really doesn’t want their server to access (ie. decrypt) all photos by default. Maybe they actually weren’t lying when they defended being more private by having all computing happen on-device, and the server not accessing your data. Now, what seems more likely to you? They suddenly decided to go towards scanning all offline files for no business nor legal benefit, or they tried to respect their own marketing of how their ecosystem should work?
adventured 5y ago
What you said changes nothing about the concerns the parent comment/s raised: which is, having the scanning on the device in any manner what-so-ever. That is the objection. The fundamental issue is that Apple is crossing an important privacy line: my property (my phone) vs their property (their external servers). It's identical to saying that because USPS (or any mail carrier) is allowed to scan mail that moves through their system, across their property, they should also be allowed to come into my home and scan mail there. Hey, they promise to only look at mail while inside the home, what's the big deal. It represents the same shift: my home vs their shipping infrastructure. People would universally go ballistic if USPS/UPS/Fedex declared they were going to begin routinely entering homes to examine mail packages before they were sent out. No matter how you dressed that up (they only do it if you print a shipping label first, indicating preparation to send a package through their system), it wouldn't assuage anyone.

lern_too_spel 5y ago

iOS doesn't allow other cloud photo services to upload in the background except via flaky hacks, so the choice for iPhone users is really between iCloud Photos and crippled alternatives.

anonuser123456 5y ago
This is the tradeoff of the Apple ecosystem. For most users the trade off is a no-brainer because they don't care about the theoretical concerns that, in expectation, do not apply to them. I mean, what is the probability of this technology causing an innocent user harm? 1/1,000,000 ? 1/10,000,000? 1/100,000,000?
- amznthrwaway 5y ago
  All evidence is that the chance of harm is literally zero. This stuff is used to scan pics on every photo hosting service already, and there’s no known instances of a life ruined over a hash collision. Every one of the harm narratives comes from a slippery slope fallacy.
- skoskie 5y ago
  According to Apple, 1/1 Trillion chance of a false report per year. So the chance for a single photo to be incorrectly matched is much higher. But by setting a threshold at ~30 images before triggering a manual review, they get the odds extremely low. My bet is that error threshold will remain a constant for them. As tech gets better, they will reduce the threshold accordingly to maintain that error rate. In five years, I’m guessing they will only need three images to trigger a review.
ajh13 5y ago
I use NextCloud which syncs my photos from my iPhone to my in-home server. Then I use borgbackup to encrypt my photos/videos and send them to a cloud provider. All of it is automated and wasn't too much of a hassle to setup.
- matthewdgreen 5y ago
  iCloud does more than just uploading. It enables transparent sync and offloading of photos. This means if your device has limited storage, iCloud Photos can shunt photo data out to the cloud while maintaining a local representation of the photo's existence. These iCloud features are "baked into" the APIs that apps use to integrate with the system photo library, e.g.: https://developer.apple.com/documentation/photokit/phasset#1656308 https://developer.apple.com/documentation/photokit/phasset#1... You can come up with third party solutions that accomplish some portion of this use case (photo backup) but you'll never be able to accomplish what Apple does with iCloud Photos unless Apple opens its APIs.
  - shuckles 5y ago
    A third party could implement the PHAsset abstraction over their own implementation of a photo library action sheet and the file provider APIs. It wouldn’t get you to feature parity, but the major differences are but minor frictions if your privacy threat model involves nation state adversaries. It is not possible to write an app on iOS that has permanent, transparent background network and runtime access, and it’s also not clear allowing such apps would be a privacy benefit for users at large. Apple already makes exceptions to this for certain apps (e.g. it seems like my Verizon Wireless app has background runtime). Are you suggesting that Apple should nominate a few photo services receive the same exception?
    - lern_too_spel 5y ago
      It's a benefit for users at large because they get to use services that provide more benefits (like Google Photos search and automatic video creation), services with more privacy (like self-hosted photo services), or services that are cheaper (like Amazon Photos). Android has demonstrated that there is no need to whitelist this. This is purely a lock-in play for Apple.

sirbutters 5y ago

This comment should be way up. People afraid of "what else" Apple can start scanning on our devices has always been a reality, way before CSAM. If they ever decided to remove the feature, it's not like it will magically make it impossible for Apple to ever scan our devices again in the future. They can run whatever code they want on their device. We've always put our trust on Apple to not do any shady things on our phone. This new outrage makes no sense at all. As you said, people can turn iCloud Photos off to disable the scan. Therefore people need to STFU.

Infernal 5y ago
> We've always put our trust on Apple to not do any shady things on our phone …and now we have a case in point of them doing shady things on our phones. This breaks the trust.
- Retric 5y ago
  I don’t see what’s shady about this because it’s so public. They could do everything that’s happening on phone on the iCloud servers without telling you. So at worst it uses extra bandwidth per upload and some processing power and thus battery life from your phone. The minor advantage is you can actually inspect their procedural hashing algorithm, though not how they compare images server side. Sure, they could do something else in the future but that’s alway the risk with every update.
  - Infernal 5y ago
    It's the same point as above. They could do shady things with your data on their server. They could do shady things with the data on your phone. They always /could/, and up till now I trusted them not to. But now they /have/, that is the change.
    - Retric 5y ago
      Ok they lost your trust and it’s completely your choice to make that decision however you want, but how was this shady?

matthewdgreen 5y ago

iCloud Photos is a synchronization service that is integrated very tightly into the core iOS system. Even the basic APIs that allow apps to integrate with the system photo library are "iCloud aware" in the sense that the photo might not be on your device. iCloud Photos makes it possible to page photos on and off your device, which is a critical feature for people who can't afford to pay for the high-end iOS devices with extensive NVRAM storage. You, as a user, can turn off iCloud Photos. But your device functionality will be limited. And you cannot replace that functionality with any third-party alternative that will have the same feature-set and access to the low-level device features: Apple ensures this through the design of their OS and its extensive security features. There is a version of "you don't have to use iCloud Photos" in which Apple opens their OS to competing cloud services. But you can't say this is an option while also locking the device down to use one cloud provider.

shuckles 5y ago
It is hard to square the idea that Apple’s proposed CSAM detection pipeline is a fundamental affront to privacy, a human right, with the argument that turning off iCloud Photos is a false choice because alternatives don’t or can’t have feature parity. Even more so because every cloud photo service with the scale and quality of iCloud Photos is doing the same (and arguably worse!). I use Nextcloud and it is a more or less ok user experience; the major inconvenience is that your photo library isn’t available in UIImagePickerControllers. The image preview mechanics you describe can already be simulated with file provider APIs. Edit. I think my point more simply stated is that if you think turning off iCloud Photos or switching photo sync with another cloud provider “solved” the privacy problem, then you are in the same group of people who are annoyed that they can’t use Spotify with Siri or AirPlay 2. Welcome to the large number of 2nd class citizens on iOS. It’s not great out here, but it certainly doesn’t make the toggle a false choice.
- matthewdgreen 5y ago
  I don’t think you need to square those options. I think that scanning people’s photos is very much an affront to privacy. Apple clearly agrees with me at some level because they are advertising that their system is “opt in”: you only get scanned if you turn on iCloud Photos. But this argument assumes that for most users this is a choice. For many users who have purchased iPhones with lower storage levels this is not really a choice — they have to use iCloud Photos to get the functionality they paid for, else they can’t synchronize photos and have to manually manage and risk deleting photos. They can use third party apps, but only with reduced functionality because Apple has chosen to privilege their own cloud service and lock those functions away from third party developers. To me it seems like Apple’s opt-in consent argument would make sense if and only if they offered users equivalent choices in third party cloud functionality: which they don’t.

jellicle 5y ago

Pretty obviously the only reason to scan on-device is that you intend to expand on-device scanning to all files on the device, regardless of whether they are uploaded or not. ("We don't want child molesters to get away by turning off uploads," said Apple spokesperson.) Literally no reason to develop this otherwise. Scanning cloud images would be 100x easier.

shuckles 5y ago
Apple has declared their criteria for evaluating the privacy of their CSAM scanning approach in their USENIX talk, and none of it relies on scanning all files. If you want to accuse them of lying, you will need to bring a lot more evidence since (i) presumably you believe they weren’t lying in the past and (ii) it would be an enormous liability if they were now. There are many reasonable criteria under which the proposed model is superior for privacy. Perhaps the only reasonable criteria under which it is not is some kind of scope creep in what files are scanned. (Scope creep in what content is scanned for is a risk - an even greater one as there is no transparency over the hash list - of incumbent solutions as well.)
benhurmarcel 5y ago
Either that, or Apple really doesn’t want their server to access (ie. decrypt) all photos by default. Maybe they actually weren’t lying when they defended being more private by having all computing happen on-device, and the server not accessing your data. Now, what seems more likely to you? They suddenly decided to go towards scanning all offline files for no business nor legal benefit, or they tried to respect their own marketing of how their ecosystem should work?

adventured 5y ago

What you said changes nothing about the concerns the parent comment/s raised: which is, having the scanning on the device in any manner what-so-ever. That is the objection. The fundamental issue is that Apple is crossing an important privacy line: my property (my phone) vs their property (their external servers). It's identical to saying that because USPS (or any mail carrier) is allowed to scan mail that moves through their system, across their property, they should also be allowed to come into my home and scan mail there. Hey, they promise to only look at mail while inside the home, what's the big deal. It represents the same shift: my home vs their shipping infrastructure. People would universally go ballistic if USPS/UPS/Fedex declared they were going to begin routinely entering homes to examine mail packages before they were sent out. No matter how you dressed that up (they only do it if you print a shipping label first, indicating preparation to send a package through their system), it wouldn't assuage anyone.