13 ms·

Part of me wonders if the calculus includes either (a) the open letter signed by (effectively) ~10k verified developers [1], (b) the complaint letters from grou

Part of me wonders if the calculus includes either (a) the open letter signed by (effectively) ~10k verified developers [1], (b) the complaint letters from groups like the EFF [2, 3], or (c) expert and qualified input from their (presumably huge) marketing department... [1] https://appleprivacyletter.com/ https://appleprivacyletter.com/ [2] https://act.eff.org/action/tell-apple-don-t-scan-our-phones https://act.eff.org/action/tell-apple-don-t-scan-our-phones [3] https://www.eff.org/deeplinks/2021/08/apples-plan-think-different-about-encryption-opens-backdoor-your-private-life https://www.eff.org/deeplinks/2021/08/apples-plan-think-diff...

judge2020 5y ago
Or D) employees who weren’t part of the discussions heard about it the day before the official announcement, and made a stink about it internally.
- haswell 5y ago
  E) All of the above
  - lumost 5y ago
    F) They received requests to scan for other forms of content from various governments.
    - sslayer 5y ago
      G) Secret Pedo BoardMembers/Investors/Mutual Fund Manager threaten to dump all Apple Stock.
    - valkmit 5y ago
      Underrated comment right here
    - marcan_42 5y ago
      G) Turns out they can't know if they're scanning for other forms of content, since they delegate computing the hash lists of banned content to government organizations like NCMEC anyway.
      - darwingr 5y ago
        So a hash for a public key used to encrypt something could be in there? Banned books? A video of unsavoury evidence to an institution?
        dave7 5y ago
        Yes indeed.
- jtbayly 5y ago
  E) Their promise that they would only include scanning of images that appeared in multiple countries' databases. As of right now, is there even a database other than the one NCMEC has? I suspect they are waiting for the NCMEC to spin up its European branch.
  - josefx 5y ago
    They are probably just waiting for several countries to spin up their databases of gay porn and blasphemous / regime critical memes. Shouldn't be too hard to find two of those countries working on a shared "child abuse" database now that the feature has been widely publicized.
    - camgunz 5y ago
      Honestly, maybe that happened and they went "oh. shit." and now they're "delaying".
    - Animats 5y ago
      There's so much censorship now worldwide, and it's increasing. Russia doesn't allow promotion of the gay agenda. Parts of the Islamic world view criticism of Islam as a killing offense. China won't tolerate the flag of Taiwan, Falun Gong, or criticism of the Party. Afghanistan no longer allows music. A decade ago, all those things were on the Internet worldwide.
      - ilamont 5y ago
        China is also cracking down on LGBTQ groups: https://www.bbc.com/news/world-asia-china-57759480 https://www.bbc.com/news/world-asia-china-57759480 Many of the closed WeChat accounts display messages saying that they had "violated" Internet regulations, without giving further details. The account names have also been deleted and just read "unnamed". "After receiving relevant complaints, all content has been blocked and the account has been suspended," the notice said. The crackdown is the latest example of what some call growing intolerance toward the LGBT community. Last year, Shanghai Pride week, modelled on Pride events in the West, was cancelled without explanation after 11 years of it going ahead. In 2019, the Oscar-winning Freddie Mercury biopic Bohemian Rhapsody was released in Chinese cinemas, but references to the Queen singer's sexuality and AIDS diagnosis were censored. In 2018, Weibo said all posts related to homosexuality would be taken down, although it backtracked after massive outrage.
koheripbal 5y ago
More likely D) The regulatory threats from the EU.
- gambiting 5y ago
  Wasn't the feature meant to be US only - at least for now anyway?
  - Mindwipe 5y ago
    Apple said themselves, there's only one iOS ROM, so it was there on everyone else's devices regardless.
    - FabHK 5y ago
      But enabled only for the US region initially. That is bad in itself, though, I think, insofar as it signals that the system can be switched on and off, and thus maybe configured, on a per-region basis, which does seem to open the door for government pressure and abuse.
- threatofrain 5y ago
  The EU's mood is cloudy here, as there's also legislative pressure against child porn coming up this year.
jug 5y ago
The cite even researchers as leading to the decision. Maybe flaws with perceptual hashes? It took a mere day to discover a hash collision after reverse engineering the system. Granted, the colliding image looked like a grey mess, but I wonder how far a malicious party might get after a year.
- mlac 5y ago
  I don't really understand the argument that was thrown out by many people: "Attackers will frame people by planting hash collisions on their phones!" So... a) a bad actor is going to target someone, and have the resources to generate enough collisions that(b) look like CP, but aren't CP? but are close enough (c) to pass human review and cause an investigation so (d) they need the hash collisions to look like CP, but not be real CP? or ???? If a bad actor wants to frame someone, it's easy to do this today - hack their system or home network, open it to the internet, place the photos, call the FBI and report an anonymous tip, with the URL where it is hosted and open to the internet. Don't need hash collisions. Hacking someone's iPhone (How do you get the photos on there without forensic logs that they were added?) or iCloud so that you can place hash collisions that look like crap and fail to pass the review doesn't make sense and leaves too much of a trail. Oh? And someone won't notice thousands of photos just added to their phone? A bigger threat would be deepfake CP. When that becomes a reality, it will be a mess, because an attacker could theoretically generate an unlimited amount of it, and it will be extremely difficult to tell if it is authentic. Those hashes wouldn't be in the CSAM database, but if the attacker put them out on a server to be taken down, they would get added eventually and then show up in a scan elsewhere. But I'd be pretty horrified (and definitely call my attorney, Apple, and local FBI field office) if thousands of CSAM images just showed up in my iPhone photo stream. Edit: Downvotes are fine, and I completely understand other arguments against this, but this one has just not made sense to me...
  - gunapologist99 5y ago
    This is a very simple attack to pull off; email someone with the colliding image embedded in the MIME document. Set height and width equal to zero or one pixel. Even if the user never actually sees it or marks it as spam, it's still on their device and in their email. For bonus points, spoof the "From" as from Apple. At the very least, they're getting SWATted.
newbamboo 5y ago
They ruined their reputation for being relatively secure devices. I’m done with them, for good. Anybody who cares about security has likely jumped ship now too. Normies will eventually ditch them when they realize most tech people have bailed. Unfortunately the best alternative, google, is even worse. Hopefully the loss of demand causes a decrease in device sales across the board. Landlines still work. Smartphones and their consequences have been a disaster for the human race.

judge2020 5y ago

Or D) employees who weren’t part of the discussions heard about it the day before the official announcement, and made a stink about it internally.

haswell 5y ago
E) All of the above
- lumost 5y ago
  F) They received requests to scan for other forms of content from various governments.
  - sslayer 5y ago
    G) Secret Pedo BoardMembers/Investors/Mutual Fund Manager threaten to dump all Apple Stock.
  - valkmit 5y ago
    Underrated comment right here
  - marcan_42 5y ago
    G) Turns out they can't know if they're scanning for other forms of content, since they delegate computing the hash lists of banned content to government organizations like NCMEC anyway.
    - darwingr 5y ago
      So a hash for a public key used to encrypt something could be in there? Banned books? A video of unsavoury evidence to an institution?
      - dave7 5y ago
        Yes indeed.
jtbayly 5y ago
E) Their promise that they would only include scanning of images that appeared in multiple countries' databases. As of right now, is there even a database other than the one NCMEC has? I suspect they are waiting for the NCMEC to spin up its European branch.
- josefx 5y ago
  They are probably just waiting for several countries to spin up their databases of gay porn and blasphemous / regime critical memes. Shouldn't be too hard to find two of those countries working on a shared "child abuse" database now that the feature has been widely publicized.
  - camgunz 5y ago
    Honestly, maybe that happened and they went "oh. shit." and now they're "delaying".
  - Animats 5y ago
    There's so much censorship now worldwide, and it's increasing. Russia doesn't allow promotion of the gay agenda. Parts of the Islamic world view criticism of Islam as a killing offense. China won't tolerate the flag of Taiwan, Falun Gong, or criticism of the Party. Afghanistan no longer allows music. A decade ago, all those things were on the Internet worldwide.
    - ilamont 5y ago
      China is also cracking down on LGBTQ groups: https://www.bbc.com/news/world-asia-china-57759480 https://www.bbc.com/news/world-asia-china-57759480 Many of the closed WeChat accounts display messages saying that they had "violated" Internet regulations, without giving further details. The account names have also been deleted and just read "unnamed". "After receiving relevant complaints, all content has been blocked and the account has been suspended," the notice said. The crackdown is the latest example of what some call growing intolerance toward the LGBT community. Last year, Shanghai Pride week, modelled on Pride events in the West, was cancelled without explanation after 11 years of it going ahead. In 2019, the Oscar-winning Freddie Mercury biopic Bohemian Rhapsody was released in Chinese cinemas, but references to the Queen singer's sexuality and AIDS diagnosis were censored. In 2018, Weibo said all posts related to homosexuality would be taken down, although it backtracked after massive outrage.

koheripbal 5y ago

More likely D) The regulatory threats from the EU.

gambiting 5y ago
Wasn't the feature meant to be US only - at least for now anyway?
- Mindwipe 5y ago
  Apple said themselves, there's only one iOS ROM, so it was there on everyone else's devices regardless.
  - FabHK 5y ago
    But enabled only for the US region initially. That is bad in itself, though, I think, insofar as it signals that the system can be switched on and off, and thus maybe configured, on a per-region basis, which does seem to open the door for government pressure and abuse.
threatofrain 5y ago
The EU's mood is cloudy here, as there's also legislative pressure against child porn coming up this year.

jug 5y ago

The cite even researchers as leading to the decision. Maybe flaws with perceptual hashes? It took a mere day to discover a hash collision after reverse engineering the system. Granted, the colliding image looked like a grey mess, but I wonder how far a malicious party might get after a year.

mlac 5y ago
I don't really understand the argument that was thrown out by many people: "Attackers will frame people by planting hash collisions on their phones!" So... a) a bad actor is going to target someone, and have the resources to generate enough collisions that(b) look like CP, but aren't CP? but are close enough (c) to pass human review and cause an investigation so (d) they need the hash collisions to look like CP, but not be real CP? or ???? If a bad actor wants to frame someone, it's easy to do this today - hack their system or home network, open it to the internet, place the photos, call the FBI and report an anonymous tip, with the URL where it is hosted and open to the internet. Don't need hash collisions. Hacking someone's iPhone (How do you get the photos on there without forensic logs that they were added?) or iCloud so that you can place hash collisions that look like crap and fail to pass the review doesn't make sense and leaves too much of a trail. Oh? And someone won't notice thousands of photos just added to their phone? A bigger threat would be deepfake CP. When that becomes a reality, it will be a mess, because an attacker could theoretically generate an unlimited amount of it, and it will be extremely difficult to tell if it is authentic. Those hashes wouldn't be in the CSAM database, but if the attacker put them out on a server to be taken down, they would get added eventually and then show up in a scan elsewhere. But I'd be pretty horrified (and definitely call my attorney, Apple, and local FBI field office) if thousands of CSAM images just showed up in my iPhone photo stream. Edit: Downvotes are fine, and I completely understand other arguments against this, but this one has just not made sense to me...
- gunapologist99 5y ago
  This is a very simple attack to pull off; email someone with the colliding image embedded in the MIME document. Set height and width equal to zero or one pixel. Even if the user never actually sees it or marks it as spam, it's still on their device and in their email. For bonus points, spoof the "From" as from Apple. At the very least, they're getting SWATted.

newbamboo 5y ago

They ruined their reputation for being relatively secure devices. I’m done with them, for good. Anybody who cares about security has likely jumped ship now too. Normies will eventually ditch them when they realize most tech people have bailed. Unfortunately the best alternative, google, is even worse. Hopefully the loss of demand causes a decrease in device sales across the board. Landlines still work. Smartphones and their consequences have been a disaster for the human race.