7 ms·

Apple has yet to make a valid reason for implementing client side CSAM scanning. According to Apple only images that will be uploaded to iCloud will be scanned

Apple has yet to make a valid reason for implementing client side CSAM scanning. According to Apple only images that will be uploaded to iCloud will be scanned. If this is the case there is zero reason to scan locally and you can just scan the uploaded image once it is on the server. Apple has not implemented E2E nor has it released a statement indicating this will be implemented in the future.

YetAnotherNick 5y ago
Also they will be doing scanning in their server anyways as there are other ways to upload it in iCloud than using latest iOS.
mrweasel 5y ago
One reason for client side could be to save on datacenter compute resources. That would seem like a perfectly valid reason, if that’s their reasoning.
- AnonC 5y ago
  If it’s going to really save a significant amount of data center resources, then it’s also probably going to reduce the battery lifespan of all these devices significantly. That may probably be good for Apple’s bottom line temporarily, but it will hurt in the long run. I’d imagine it’d be a lot easier to optimize the data center compute resources than optimizing the scanning on individual devices and not trashing battery lifespan.
  - josefx 5y ago
    > I’d imagine it’d be a lot easier to optimize the data center compute resources than optimizing the scanning on individual devices and not trashing battery lifespan. No amount of data center optimization will beat running computations on hundreds of millions of devices other people have to pay for.
- jtbayly 5y ago
  If that’s a valid reason to steal electricity and compute resources from your customers, then why not go the whole way and use all the Mac’s as storage and compute for iCloud?
koolhaas 5y ago
Presumably, it’s done this way so they can say computers other than your personal device do not scan photos and “look” at decrypted and potentially innocent photos. And technically the original image is never decrypted in iCloud by Apple - if 30 images are flagged they are then able to decrypt the CSAM scan meta data which contains resized thumbnails, for confirmation. In summary, I’m guessing they tried to invent a way where their server software never has to decrypt and analyze original photos, so they stay encrypted at rest.
- grlass 5y ago
  calling resized thumbnails metadata is a bit of a stretch imo. Surely that's just the data, but resized?
  - koolhaas 5y ago
    Yes I agree, bit of a stretch. Based on their whitepaper, it's a smaller version of the original image, I guess just large enough to support the human verification step. But I'm unsure that the thumbnail is included with every CSAM "voucher" -- it's likely only included when you pass the 30 image limit. Need to read that section more clearly.
    - saithound 5y ago
      A thumbnail is included with every safety voucher. However, it is encrypted with a key that resides on your hardware and is unknown to Apple. So Apple doesn't have enough information to decrypt your thumbnails at will. A secret sharing scheme is used to drip-feed Apple the key: each time a positive match occurs, Apple learns a bit more about your key. Once the threshold is reached, Apple will have learned enough to recover your encryption key, and will be able to use it to decrypt all your matching thumbnails at once.
      - koolhaas 5y ago
        Fascinating, thanks for clarifying.
simondotau 5y ago
There is an interesting constitutional quirk which arises from the scanning being done client side, specifically for US citizens. If the US Government forced Apple to add other entries to the hash table, this would constitute a warrantless Government search of the private physical property of US citizens. This is a clear-cut, unambiguous breach of the 4th Amendment. Whereas if the CSAM scanning was performed exclusively in the cloud, protection under the 4th Amendment does not exist as it would likely fall under the third party doctrine. Now I'm not saying the US Government would let mere unconstitutionality get in the way of any surveillance program. But Apple would. You don't think Apple wouldn't be itching for another opportunity to flex in public? Especially now, with their reputation on the line? Apple would love nothing more than to have more opportunities like they got with the San Bernardino iPhone.
- rangerdan 5y ago
  > If the US Government forced Apple to add other entries to the hash table, this would constitute a warrantless Government search of the private physical property of US citizens. This is a clear-cut, unambiguous breach of the 4th Amendment. There's no reason not to assume this isn't already happening, being closed source and proprietary. The question to ask is, what are we going to do about it?
  - simondotau 5y ago
    If you take that line of argument, you must also accept that you have no reason not to assume that binary distributions of Android and Windows haven't been doing similar things for the past decade.
    - shawnz 5y ago
      I agree with you in that I don't think the problem is the closed-source aspect. Closed source software can still be audited (with difficulty). The problem is that the source material for the hashes can't be audited, even when we know exactly how the system works.
    - rangerdan 5y ago
Grustaf 5y ago
Most people feel that things that happen on your device are safer than things in the cloud, you have probably noticed how Apple constantly stress that this or that happens "on device". And for the suspicious, it's of course much easier to notice if Apple would change their algorithms if they happen on device.
websites2023 5y ago
> If this is the case there is zero reason to scan locally and you can just scan the uploaded image once it is on the server. You’re having a house party. Because of the pandemic, you’d rather people who have COVID not attend. You can’t trust everyone to get vaccinated or get tested beforehand. So, you decided to set up a rapid-test system, just to be sure. Would you rather test in your kitchen or your driveway?
- addingnumbers 5y ago
  Why the contagion analogy? If contagion wasn't a factor, I'd rather test in the kitchen, it's cozier. Are you suggesting CSAM will infect more unwilling victims if it gets into a private iCloud account?
  - websites2023 5y ago
    CSAM on the server means the server is tainted and likely to be searched by governments. Good plan to keep it off eliminates that excuse.
    - addingnumbers 5y ago
      I don't see how this scanning reduces the likelihood of a government searching their servers. Seems to me like this can only result in more court orders than they had before scanning.
      - websites2023 5y ago
        If you’re Apple, and you’re throwing your weight around in the US bread and butter market to convince the FBI to not scan your servers for CSAM, which is more compelling: we check for it when it gets here, or we keep it off our servers using crypto hash magic?
user-the-name 5y ago
Apple basically never announces things before they are ready to be released, so them not announcing this means very little. They may be working on it, and their usual secrecy is biting them in the ass very hard.

YetAnotherNick 5y ago

Also they will be doing scanning in their server anyways as there are other ways to upload it in iCloud than using latest iOS.

mrweasel 5y ago

One reason for client side could be to save on datacenter compute resources. That would seem like a perfectly valid reason, if that’s their reasoning.

AnonC 5y ago
If it’s going to really save a significant amount of data center resources, then it’s also probably going to reduce the battery lifespan of all these devices significantly. That may probably be good for Apple’s bottom line temporarily, but it will hurt in the long run. I’d imagine it’d be a lot easier to optimize the data center compute resources than optimizing the scanning on individual devices and not trashing battery lifespan.
- josefx 5y ago
  > I’d imagine it’d be a lot easier to optimize the data center compute resources than optimizing the scanning on individual devices and not trashing battery lifespan. No amount of data center optimization will beat running computations on hundreds of millions of devices other people have to pay for.
jtbayly 5y ago
If that’s a valid reason to steal electricity and compute resources from your customers, then why not go the whole way and use all the Mac’s as storage and compute for iCloud?

koolhaas 5y ago

Presumably, it’s done this way so they can say computers other than your personal device do not scan photos and “look” at decrypted and potentially innocent photos. And technically the original image is never decrypted in iCloud by Apple - if 30 images are flagged they are then able to decrypt the CSAM scan meta data which contains resized thumbnails, for confirmation. In summary, I’m guessing they tried to invent a way where their server software never has to decrypt and analyze original photos, so they stay encrypted at rest.

grlass 5y ago
calling resized thumbnails metadata is a bit of a stretch imo. Surely that's just the data, but resized?
- koolhaas 5y ago
  Yes I agree, bit of a stretch. Based on their whitepaper, it's a smaller version of the original image, I guess just large enough to support the human verification step. But I'm unsure that the thumbnail is included with every CSAM "voucher" -- it's likely only included when you pass the 30 image limit. Need to read that section more clearly.
  - saithound 5y ago
    A thumbnail is included with every safety voucher. However, it is encrypted with a key that resides on your hardware and is unknown to Apple. So Apple doesn't have enough information to decrypt your thumbnails at will. A secret sharing scheme is used to drip-feed Apple the key: each time a positive match occurs, Apple learns a bit more about your key. Once the threshold is reached, Apple will have learned enough to recover your encryption key, and will be able to use it to decrypt all your matching thumbnails at once.
    - koolhaas 5y ago
      Fascinating, thanks for clarifying.

simondotau 5y ago

There is an interesting constitutional quirk which arises from the scanning being done client side, specifically for US citizens. If the US Government forced Apple to add other entries to the hash table, this would constitute a warrantless Government search of the private physical property of US citizens. This is a clear-cut, unambiguous breach of the 4th Amendment. Whereas if the CSAM scanning was performed exclusively in the cloud, protection under the 4th Amendment does not exist as it would likely fall under the third party doctrine. Now I'm not saying the US Government would let mere unconstitutionality get in the way of any surveillance program. But Apple would. You don't think Apple wouldn't be itching for another opportunity to flex in public? Especially now, with their reputation on the line? Apple would love nothing more than to have more opportunities like they got with the San Bernardino iPhone.

rangerdan 5y ago
> If the US Government forced Apple to add other entries to the hash table, this would constitute a warrantless Government search of the private physical property of US citizens. This is a clear-cut, unambiguous breach of the 4th Amendment. There's no reason not to assume this isn't already happening, being closed source and proprietary. The question to ask is, what are we going to do about it?
- simondotau 5y ago
  If you take that line of argument, you must also accept that you have no reason not to assume that binary distributions of Android and Windows haven't been doing similar things for the past decade.
  - shawnz 5y ago
    I agree with you in that I don't think the problem is the closed-source aspect. Closed source software can still be audited (with difficulty). The problem is that the source material for the hashes can't be audited, even when we know exactly how the system works.
  - rangerdan 5y ago

Grustaf 5y ago

Most people feel that things that happen on your device are safer than things in the cloud, you have probably noticed how Apple constantly stress that this or that happens "on device". And for the suspicious, it's of course much easier to notice if Apple would change their algorithms if they happen on device.

websites2023 5y ago

> If this is the case there is zero reason to scan locally and you can just scan the uploaded image once it is on the server. You’re having a house party. Because of the pandemic, you’d rather people who have COVID not attend. You can’t trust everyone to get vaccinated or get tested beforehand. So, you decided to set up a rapid-test system, just to be sure. Would you rather test in your kitchen or your driveway?

addingnumbers 5y ago
Why the contagion analogy? If contagion wasn't a factor, I'd rather test in the kitchen, it's cozier. Are you suggesting CSAM will infect more unwilling victims if it gets into a private iCloud account?
- websites2023 5y ago
  CSAM on the server means the server is tainted and likely to be searched by governments. Good plan to keep it off eliminates that excuse.
  - addingnumbers 5y ago
    I don't see how this scanning reduces the likelihood of a government searching their servers. Seems to me like this can only result in more court orders than they had before scanning.
    - websites2023 5y ago
      If you’re Apple, and you’re throwing your weight around in the US bread and butter market to convince the FBI to not scan your servers for CSAM, which is more compelling: we check for it when it gets here, or we keep it off our servers using crypto hash magic?

user-the-name 5y ago

Apple basically never announces things before they are ready to be released, so them not announcing this means very little. They may be working on it, and their usual secrecy is biting them in the ass very hard.