4 ms·

While some folks have legitimate concerns about any scanning, the majority of pushback isn't about the fact that scanning is occurring. It's about the fact that

While some folks have legitimate concerns about any scanning, the majority of pushback isn't about the fact that scanning is occurring. It's about the fact that the scanning occurs locally on your device, which is meaningfully different, and rightly raises a million and one concerns about the future of such a feature. The pushback is about the continued erosion of boundaries between what is "mine" and what is in Apple's purview. Questions/criticisms about security theater aside, this is the difference between the TSA looking in my bags when I get to the airport vs. the TSA having the ability to look in all of my suitcases while I'm still at home. One might immediately respond "but they can only look when you intend to take that bag directly to the airport to fly", to which I say "it's really fucking creepy that they can look in my bag while it's still sitting in my living room". This is not equivalent to existing server-side scanning.

azinman2 5y ago
But it’s not “scanning” on your device. It’s uploading a hash at the same time as the photo, and the server then does additional work to determine if it’s a match or not. Scanning implies you’re going over all my files with some frequency and then acting upon some violation. Here the system is designed so the device doesn’t know when the server has found a match or not.
- haswell 5y ago
  > It’s uploading a hash And where did that hash come from?
  - azinman2 5y ago
    Your device computed it during the upload process.
    - haswell 5y ago
      And that computation is something that did not exist prior to the introduction of this feature, nor is that computation useful for anything other than the operation of this feature. You can split hairs over terminology and call this "scanning" or "analysis" or "inspection", but the end result is the same. Your device is now computing information with the sole intent of using that information to make a judgement about the content you're uploading and about you/your account. Without that "scan/inspection/analysis", the server-side process can't do anything on its own.
      - azinman2 5y ago
        It could do all the same stuff because it’s getting the unencrypted photo currently. So it seems therefore that this is being done to allow for full encryption or to have that database of hashes more restricted by how they’re slowly distributed. Why else? I don’t think it’s splitting hairs — semantics matter. Scanning your system for illegal stuff has a very different connotation, and if you read the comments on HN, even in this more technical audience there’s a lot of confusion and incorrect understanding. People are still thinking this is being implemented outside of iCloud photos, for instance. Go read all the browse cache worries in comments.
        haswell 5y ago
        > Scanning your system for illegal stuff has a very different connotation And yet, when you examine the end-to-end system, this is exactly what they're doing. If I have a long, flexible piece of wood that's capable of bending, and a very strong string, and a dowel rod, feathers, and a sharp piece of metal, I can claim that "I just have a flexible piece of wood" or "I just have feather". But if what I really possess is an unassembled bow, and upon assembly I can use it to fire arrows, suddenly I have a weapon. It would be disingenuous to claim that the individual parts I have are all harmless when their sole intent is to be used in combination in a manner that can inflict harm or death. > So it seems therefore that this is being done to allow for full encryption And to what end? What value would such a feature provide when the first end has been compromised?
        azinman2 5y ago
        I'm not sure what you mean by an unassembled bow here, or more specifically, what the bow is that you're referring to. People have worries that this could lead everything from to identifying dissidents that might be in possession of specific photos to identifying copyrighted materials on your device whether they were going to iCloud or not. The construction of the system negates both of these things. It matters if it's tied to iCloud or not. Otherwise it is 'scanning' your system, which in this case, isn't something that is actually built anymore than it could be built at any time. It's not like Apple can't build whatever software/hardware it wants or needs. This was just as true before as it is now. To me the bigger issue is the worry about what hashes will it be... will that expand past the intersection of two CP databases. Maybe? Maybe not? But that risk was the same before (or even worse since it could have been done fully in secret and targeted to specific individuals or regions) on a pure server-side solution. All this work isn't being done just to save some CPU cycles in Apple datacenter. >And to what end? What value would such a feature provide when the first end has been compromised? I don't understand your question, and I don't fully understand your compromised position. If the concern is finding all kinds of bad things on your phone independent of this CP thing, that always could have been the case and what was built isn't enough for that (it's hashes not classifiers, the db is distributed to the entire world and verifiable that its the same on all devices, you could always see the network traffic despite turning off iCloud services, etc).
Grustaf 5y ago
> It's about the fact that the scanning occurs locally on your device, which is meaningfully different Yeah it IS different, most people feel much better about things that happen on device. Since this only happens for photos on their way to iCloud, in your analogy it would be like searching the bags when you put them in the cab to go to the airport. Furthermore, it would be like TSA had a machine that could search your bags for guns, without any human even seeing an x-ray of them. Plus the machine would need 30 gun alerts before it takes any action at all. I don't know about you but I would not have any issues whatsoever with that.
- haswell 5y ago
  > most people feel much better about things that happen on device This indicates you may be misunderstanding why people generally feel better about things happening on device. Apple's own tagline "What happens on your iPhone, stays on your iPhone." includes a very strong hint. That hint is: > Stays on your iPhone Nothing about the features we're discussing here stay on your iPhone. Doing something locally is no longer meaningful if the express intent of doing that thing is to phone home when certain conditions are met.
  - Grustaf 5y ago
    Do you want to bet?
- blendergeek 5y ago
  > Since this only happens for photos on their way to iCloud, in your analogy it would be like searching the bags when you put them in the cab to go to the airport. I think this would be more like if the TSA installed scanners in everybody's houses that scan everything as you put it in your suitcase. Yeah, it only scans things on the way to the airport, but the scanners are in my house. I don't want them there. My house is my domain. It's the same way with my phone. I don't want the government/Apple evil detector running on my phone. I know that a false positive is unlikely and I know that Apple and the government have made very clear they will only look for Real Evil. I still don't want the scanners on my phone.
Lamad123 5y ago
I hate analogies, but this one is spot on.

azinman2 5y ago

But it’s not “scanning” on your device. It’s uploading a hash at the same time as the photo, and the server then does additional work to determine if it’s a match or not. Scanning implies you’re going over all my files with some frequency and then acting upon some violation. Here the system is designed so the device doesn’t know when the server has found a match or not.

haswell 5y ago
> It’s uploading a hash And where did that hash come from?
- azinman2 5y ago
  Your device computed it during the upload process.
  - haswell 5y ago
    And that computation is something that did not exist prior to the introduction of this feature, nor is that computation useful for anything other than the operation of this feature. You can split hairs over terminology and call this "scanning" or "analysis" or "inspection", but the end result is the same. Your device is now computing information with the sole intent of using that information to make a judgement about the content you're uploading and about you/your account. Without that "scan/inspection/analysis", the server-side process can't do anything on its own.
    - azinman2 5y ago
      It could do all the same stuff because it’s getting the unencrypted photo currently. So it seems therefore that this is being done to allow for full encryption or to have that database of hashes more restricted by how they’re slowly distributed. Why else? I don’t think it’s splitting hairs — semantics matter. Scanning your system for illegal stuff has a very different connotation, and if you read the comments on HN, even in this more technical audience there’s a lot of confusion and incorrect understanding. People are still thinking this is being implemented outside of iCloud photos, for instance. Go read all the browse cache worries in comments.
      - haswell 5y ago
        > Scanning your system for illegal stuff has a very different connotation And yet, when you examine the end-to-end system, this is exactly what they're doing. If I have a long, flexible piece of wood that's capable of bending, and a very strong string, and a dowel rod, feathers, and a sharp piece of metal, I can claim that "I just have a flexible piece of wood" or "I just have feather". But if what I really possess is an unassembled bow, and upon assembly I can use it to fire arrows, suddenly I have a weapon. It would be disingenuous to claim that the individual parts I have are all harmless when their sole intent is to be used in combination in a manner that can inflict harm or death. > So it seems therefore that this is being done to allow for full encryption And to what end? What value would such a feature provide when the first end has been compromised?
        azinman2 5y ago
        I'm not sure what you mean by an unassembled bow here, or more specifically, what the bow is that you're referring to. People have worries that this could lead everything from to identifying dissidents that might be in possession of specific photos to identifying copyrighted materials on your device whether they were going to iCloud or not. The construction of the system negates both of these things. It matters if it's tied to iCloud or not. Otherwise it is 'scanning' your system, which in this case, isn't something that is actually built anymore than it could be built at any time. It's not like Apple can't build whatever software/hardware it wants or needs. This was just as true before as it is now. To me the bigger issue is the worry about what hashes will it be... will that expand past the intersection of two CP databases. Maybe? Maybe not? But that risk was the same before (or even worse since it could have been done fully in secret and targeted to specific individuals or regions) on a pure server-side solution. All this work isn't being done just to save some CPU cycles in Apple datacenter. >And to what end? What value would such a feature provide when the first end has been compromised? I don't understand your question, and I don't fully understand your compromised position. If the concern is finding all kinds of bad things on your phone independent of this CP thing, that always could have been the case and what was built isn't enough for that (it's hashes not classifiers, the db is distributed to the entire world and verifiable that its the same on all devices, you could always see the network traffic despite turning off iCloud services, etc).

Grustaf 5y ago

> It's about the fact that the scanning occurs locally on your device, which is meaningfully different Yeah it IS different, most people feel much better about things that happen on device. Since this only happens for photos on their way to iCloud, in your analogy it would be like searching the bags when you put them in the cab to go to the airport. Furthermore, it would be like TSA had a machine that could search your bags for guns, without any human even seeing an x-ray of them. Plus the machine would need 30 gun alerts before it takes any action at all. I don't know about you but I would not have any issues whatsoever with that.

haswell 5y ago
> most people feel much better about things that happen on device This indicates you may be misunderstanding why people generally feel better about things happening on device. Apple's own tagline "What happens on your iPhone, stays on your iPhone." includes a very strong hint. That hint is: > Stays on your iPhone Nothing about the features we're discussing here stay on your iPhone. Doing something locally is no longer meaningful if the express intent of doing that thing is to phone home when certain conditions are met.
- Grustaf 5y ago
  Do you want to bet?
blendergeek 5y ago
> Since this only happens for photos on their way to iCloud, in your analogy it would be like searching the bags when you put them in the cab to go to the airport. I think this would be more like if the TSA installed scanners in everybody's houses that scan everything as you put it in your suitcase. Yeah, it only scans things on the way to the airport, but the scanners are in my house. I don't want them there. My house is my domain. It's the same way with my phone. I don't want the government/Apple evil detector running on my phone. I know that a false positive is unlikely and I know that Apple and the government have made very clear they will only look for Real Evil. I still don't want the scanners on my phone.

Lamad123 5y ago

I hate analogies, but this one is spot on.