7 ms·

What do you think are the chances we'll see a server-side implementation instead of the so far proposed client-side one?

by sebiw 5y ago

CubsFan1060 5y ago
My prediction, based on zero evidence whatsoever. They'll implement it server side, and eventually introduce encrypted iCloud photos. But your choice is to allow this scheme (scan on device before upload) and have E2EE, or to not have E2E encryption and have it scanned on the server side.
- sebiw 5y ago
  Huh, I never really thought about the possibility that Apple would implement both schemes. I don't think they will go down that path, though. Why: Cost and complexity for Apple would be somewhat higher and the surrounding discussion about capabilities (abuse of the client-side system for other things than CSAM scanning) would persist just because of the existence of client-side scanning. Let's see how this story continues.
- jpxw 5y ago
  I highly doubt they’d offer a choice like this. 99% of their customers won’t know what these terms mean.
  - derefr 5y ago
    I’m guessing that rather than a choice, it’d be one or the other depending on the market, with most countries getting the server-side version, while totalitarian countries where people are already used to being spied on get the client-side one.
- deleted 5y ago
  [deleted]
- cwizou 5y ago
  Interesting thought but Apple never gives choice on much (well except Safari UI now!), and I don't see them giving an explicit choice on this. If they really had for a goal to implement E2EE, I could maybe see this now that you are mentioning it. However if I had to make a guess, they'll go server-side scanning only, and E2EE backups/Photos will never happen. To me it's a pipe dream to believe they would offer E2EE, there's too much international pressure from governments around the world to keep iCloud backups open and going E2EE would trigger unpalatable retaliations.
  - rjvir 5y ago
    I think it's plausible that they'd offer E2EE for all of iCloud. They already do it for iMessage, and it makes it easier to turn down subpoenas if they can credibly claim that they can't even access the data themselves. Likewise, offering an explicit choice also seems plausible. The full E2EE flow might have UX downsides (for example, the user might need to write down a recovery seed phrase on paper), so they might not force all users into that flow.
    - cwizou 5y ago
      But that's the thing, they have reached a compromise regarding iMessage being "E2EE" by keeping all those avenues (iCloud backups and iMessage on iCloud) that essentially trade E2EE for the convenience. Most users opt-in to the convenience for iMessage making it, for all purposes, no longer E2EE. I don't see them removing that precisely because of iMessage.
    - deleted 5y ago
      [deleted]
- deleted 5y ago
  [deleted]
- dylan604 5y ago
  Is there an alternate where they upload, scan, encrypt only non-offending data? Is there a way to share a public key that only allows for encrypting but not decrypting that would make this a viable option?
blacktriangle 5y ago
Assuming they become very clear about advertising what they are doing and whether your data is stored locally or in their cloud, I might be okay with this. Having a vendor scanning my own personal device is downright terrifying to the point of walking away from iOS full stop. However the same logic can be applied to Apple's servers, and I think has serious implications for how we view cloud services going forward. If a company signs up to host my content, doesn't it make sense they would like to examine that content to make sure they are not breaking any laws simply by being in possession of said content? The real answer is the same it's always been, we need to abandon the cloud in favor of going back to self-hosting and bring back the fully distributed internet, the problem is just getting technology to the point where doing so is easy enough for non-technical users.
- CubsFan1060 5y ago
  This is already done by quite a few places. Take a look at PhotoDNA. I believe at least OneDrive and Gmail have been confirmed to do this same scanning. For reference, from 2014: https://techcrunch.com/2014/08/06/why-the-gmail-scan-that-led-to-a-mans-arrest-for-child-porn-was-not-a-privacy-violation/ https://techcrunch.com/2014/08/06/why-the-gmail-scan-that-le...
  - jliptzin 5y ago
    They scan material already on servers they own, I don't think anyone is surprised about this. If you don't want anyone seeing or scanning your data, don't push it to the cloud. Apple's new policy of analyzing your data before it even gets to their cloud would break that paradigm.
nowherebeen 5y ago
If server-side implementation, you mean they will scan images that I manually upload to iCloud, then I don't have a problem with it. As long as its off my personal device, and it is through my own action and not theirs. My device is my property, not theirs.
- madeofpalk 5y ago
  I guess the trade off here is that your data is still stored in (essentially) plain text on Apple's servers, and they (or whatever authorities) can still rifle through it at any time without telling you.
  - nowherebeen 5y ago
    iCloud is encrypted but Apple has the private keys so it’s only slightly better than plain text. You should not expect you data to be anything more whenever you post anything online. The only exception is E2EE but Apple will never offer it.
    - erikpukinskis 5y ago
      The whole point of this hashing thing everyone complained about was to enable E2EE.
      - madeofpalk 5y ago
        Just to be clear - that's pure speculation. There's no evidence (apart from this local CSAM detection) or other reports to back that up.
        nowherebeen 5y ago
        Agreed. If they really planned to enable E2EE, they would have announced it with the CSAM detection. It makes no sense to have all this backlash only to enable E2EE at a later date.
  - 5y ago
yyyk 5y ago
There's a good chance we'll have a server-side implementation and a client-side implementation. The currently proposed client-side implementation has obvious holes and there's no way Apple doesn't know that. They can expand client-side scanning massively or implement server-side scanning too. The latter will cause less objections, because 'Apple will not provide E2E' isn't a news item if they keep silent, while the client-side expansion will be.
simion314 5y ago
>What do you think are the chances we'll see a server-side implementation instead of the so far proposed client-side one? If Google, Microsoft and Facebook are doing this for years then the question is why is Apple not doing it? Did they not think about the children until last month?
JohnFen 5y ago
Personally, I wouldn't object to a server-side implementation at all. My objection is that it's client-side.

What do you think are the chances we'll see a server-side implementation instead of the so far proposed client-side one?

by sebiw 5y ago

What do you think are the chances we'll see a server-side implementation instead of the so far proposed client-side one?

CubsFan1060 5y ago

My prediction, based on zero evidence whatsoever. They'll implement it server side, and eventually introduce encrypted iCloud photos. But your choice is to allow this scheme (scan on device before upload) and have E2EE, or to not have E2E encryption and have it scanned on the server side.

sebiw 5y ago
Huh, I never really thought about the possibility that Apple would implement both schemes. I don't think they will go down that path, though. Why: Cost and complexity for Apple would be somewhat higher and the surrounding discussion about capabilities (abuse of the client-side system for other things than CSAM scanning) would persist just because of the existence of client-side scanning. Let's see how this story continues.
jpxw 5y ago
I highly doubt they’d offer a choice like this. 99% of their customers won’t know what these terms mean.
- derefr 5y ago
  I’m guessing that rather than a choice, it’d be one or the other depending on the market, with most countries getting the server-side version, while totalitarian countries where people are already used to being spied on get the client-side one.
deleted 5y ago
[deleted]
cwizou 5y ago
Interesting thought but Apple never gives choice on much (well except Safari UI now!), and I don't see them giving an explicit choice on this. If they really had for a goal to implement E2EE, I could maybe see this now that you are mentioning it. However if I had to make a guess, they'll go server-side scanning only, and E2EE backups/Photos will never happen. To me it's a pipe dream to believe they would offer E2EE, there's too much international pressure from governments around the world to keep iCloud backups open and going E2EE would trigger unpalatable retaliations.
- rjvir 5y ago
  I think it's plausible that they'd offer E2EE for all of iCloud. They already do it for iMessage, and it makes it easier to turn down subpoenas if they can credibly claim that they can't even access the data themselves. Likewise, offering an explicit choice also seems plausible. The full E2EE flow might have UX downsides (for example, the user might need to write down a recovery seed phrase on paper), so they might not force all users into that flow.
  - cwizou 5y ago
    But that's the thing, they have reached a compromise regarding iMessage being "E2EE" by keeping all those avenues (iCloud backups and iMessage on iCloud) that essentially trade E2EE for the convenience. Most users opt-in to the convenience for iMessage making it, for all purposes, no longer E2EE. I don't see them removing that precisely because of iMessage.
  - deleted 5y ago
    [deleted]
deleted 5y ago
[deleted]
dylan604 5y ago
Is there an alternate where they upload, scan, encrypt only non-offending data? Is there a way to share a public key that only allows for encrypting but not decrypting that would make this a viable option?

blacktriangle 5y ago

Assuming they become very clear about advertising what they are doing and whether your data is stored locally or in their cloud, I might be okay with this. Having a vendor scanning my own personal device is downright terrifying to the point of walking away from iOS full stop. However the same logic can be applied to Apple's servers, and I think has serious implications for how we view cloud services going forward. If a company signs up to host my content, doesn't it make sense they would like to examine that content to make sure they are not breaking any laws simply by being in possession of said content? The real answer is the same it's always been, we need to abandon the cloud in favor of going back to self-hosting and bring back the fully distributed internet, the problem is just getting technology to the point where doing so is easy enough for non-technical users.

CubsFan1060 5y ago
This is already done by quite a few places. Take a look at PhotoDNA. I believe at least OneDrive and Gmail have been confirmed to do this same scanning. For reference, from 2014: https://techcrunch.com/2014/08/06/why-the-gmail-scan-that-led-to-a-mans-arrest-for-child-porn-was-not-a-privacy-violation/ https://techcrunch.com/2014/08/06/why-the-gmail-scan-that-le...
- jliptzin 5y ago
  They scan material already on servers they own, I don't think anyone is surprised about this. If you don't want anyone seeing or scanning your data, don't push it to the cloud. Apple's new policy of analyzing your data before it even gets to their cloud would break that paradigm.

nowherebeen 5y ago

If server-side implementation, you mean they will scan images that I manually upload to iCloud, then I don't have a problem with it. As long as its off my personal device, and it is through my own action and not theirs. My device is my property, not theirs.

madeofpalk 5y ago
I guess the trade off here is that your data is still stored in (essentially) plain text on Apple's servers, and they (or whatever authorities) can still rifle through it at any time without telling you.
- nowherebeen 5y ago
  iCloud is encrypted but Apple has the private keys so it’s only slightly better than plain text. You should not expect you data to be anything more whenever you post anything online. The only exception is E2EE but Apple will never offer it.
  - erikpukinskis 5y ago
    The whole point of this hashing thing everyone complained about was to enable E2EE.
    - madeofpalk 5y ago
      Just to be clear - that's pure speculation. There's no evidence (apart from this local CSAM detection) or other reports to back that up.
      - nowherebeen 5y ago
        Agreed. If they really planned to enable E2EE, they would have announced it with the CSAM detection. It makes no sense to have all this backlash only to enable E2EE at a later date.
- 5y ago

yyyk 5y ago

There's a good chance we'll have a server-side implementation and a client-side implementation. The currently proposed client-side implementation has obvious holes and there's no way Apple doesn't know that. They can expand client-side scanning massively or implement server-side scanning too. The latter will cause less objections, because 'Apple will not provide E2E' isn't a news item if they keep silent, while the client-side expansion will be.

simion314 5y ago

>What do you think are the chances we'll see a server-side implementation instead of the so far proposed client-side one? If Google, Microsoft and Facebook are doing this for years then the question is why is Apple not doing it? Did they not think about the children until last month?

JohnFen 5y ago

Personally, I wouldn't object to a server-side implementation at all. My objection is that it's client-side.