3 ms·

If this were a reasonable vector, it'd already be an issue, at least if you use large email clients like Gmail, which already scan for CSAM. Edit: Downvotes be

If this were a reasonable vector, it'd already be an issue, at least if you use large email clients like Gmail, which already scan for CSAM. Edit: Downvotes because?...

speeder 5y ago
Because it IS already an issue. For example when CIA/NSA tools leaked, one of them had precisely this purpose.
cmsj 5y ago
Downvotes because nerds love to construct a super super unlikely corner case to argue against something ;)
- sweetheart 5y ago
  I'd call that out as totally unfair... if I haven't found myself doing that many times before hahaha.
- CamperBob2 5y ago
  We, the nerds, only have to be wrong once in order to allow immense harm to occur. Apple voluntarily put itself in that position. Conversely, the governments of the world get to keep trying, over and over.
brigade 5y ago
Those use a different perceptual hash that's intended to be kept secret. It's significantly harder to develop collisions for an algorithm you cannot inspect or obtain the output of. (well also, emailing actual CSAM is way easier and mostly just gets the sender reported)
- foldr 5y ago
  Surely the sender is also likely to get reported if they email the image with the perceptual hash collision. Lots of companies run these scans. E.g. if you send the image via gmail it will most likely be scanned by Google.
- cherioo 5y ago
  Apple also uses a second, different perceptual hash that's intended to be kept secret, on server side.
  - therealjumbo 5y ago
    Then why have a client side scanner in the first place? You're exposing the hashes to the world, you're not able to E2E encrypt anything if you need to server side scan, which you probably do since trusting the client no matter what is generally bad in potentially adverserial situations, and you get all this negative press and loss of reputation and potentially pressure from governments around the world to use this for other ends. Cui Bono?
    - nicce 5y ago
      I think you have misunderstood the system. The second scan applies only for those images which are flagged as positive, which are then accessible by Apple. This is applied to detect adversarial hashes. The rest of the images stays encrypted. So, indeed on-device scanning is the only way to enable at least partial E2EE with CSAM detection. Yes, this was PR failure Apple. They rushed the announcement because of the leaks, and secondly they thought that people will understant the system when they did not. There is too much misundersting. That scanning for example is built-in so deep into the iCloud pipeline, that one does not simply change the policy for scanning the whole phone.
      - therealjumbo 5y ago
        >I think you have misunderstood the system. On a technical level I think you're correct. As a holistic approach to the problem, I still disagree. This is too cute for its own good. The PR misunderstanding is a symptom of that. >The second scan applies only for those images which are flagged as positive, which are then accessible by Apple. In the end, Apples software is scanning all of the images, why is it any more privacy respecting to do it this way? I guess reasonable people can disagree on that, personally I wasn't fully aware of the cloud side scanning either, and I don't think the public was either. This is similar to Snowden's revelations, if you were paying attention you probably already knew a lot of that, but the incident made everyone aware of it in a very blunt way. >The rest of the images stays encrypted I think this is unclear, Apple can still decrypt those other images, how else could you view them in a browser? This goes back to what Stratechery said about capability vs policy.
- gunapologist99 5y ago
  At least we know that secrets never leak out.

If this were a reasonable vector, it'd already be an issue, at least if you use large email clients like Gmail, which already scan for CSAM. Edit: Downvotes because?...

speeder 5y ago

Because it IS already an issue. For example when CIA/NSA tools leaked, one of them had precisely this purpose.

cmsj 5y ago

Downvotes because nerds love to construct a super super unlikely corner case to argue against something ;)

sweetheart 5y ago
I'd call that out as totally unfair... if I haven't found myself doing that many times before hahaha.
CamperBob2 5y ago
We, the nerds, only have to be wrong once in order to allow immense harm to occur. Apple voluntarily put itself in that position. Conversely, the governments of the world get to keep trying, over and over.

brigade 5y ago

Those use a different perceptual hash that's intended to be kept secret. It's significantly harder to develop collisions for an algorithm you cannot inspect or obtain the output of. (well also, emailing actual CSAM is way easier and mostly just gets the sender reported)

foldr 5y ago
Surely the sender is also likely to get reported if they email the image with the perceptual hash collision. Lots of companies run these scans. E.g. if you send the image via gmail it will most likely be scanned by Google.
cherioo 5y ago
Apple also uses a second, different perceptual hash that's intended to be kept secret, on server side.
- therealjumbo 5y ago
  Then why have a client side scanner in the first place? You're exposing the hashes to the world, you're not able to E2E encrypt anything if you need to server side scan, which you probably do since trusting the client no matter what is generally bad in potentially adverserial situations, and you get all this negative press and loss of reputation and potentially pressure from governments around the world to use this for other ends. Cui Bono?
  - nicce 5y ago
    I think you have misunderstood the system. The second scan applies only for those images which are flagged as positive, which are then accessible by Apple. This is applied to detect adversarial hashes. The rest of the images stays encrypted. So, indeed on-device scanning is the only way to enable at least partial E2EE with CSAM detection. Yes, this was PR failure Apple. They rushed the announcement because of the leaks, and secondly they thought that people will understant the system when they did not. There is too much misundersting. That scanning for example is built-in so deep into the iCloud pipeline, that one does not simply change the policy for scanning the whole phone.
    - therealjumbo 5y ago
      >I think you have misunderstood the system. On a technical level I think you're correct. As a holistic approach to the problem, I still disagree. This is too cute for its own good. The PR misunderstanding is a symptom of that. >The second scan applies only for those images which are flagged as positive, which are then accessible by Apple. In the end, Apples software is scanning all of the images, why is it any more privacy respecting to do it this way? I guess reasonable people can disagree on that, personally I wasn't fully aware of the cloud side scanning either, and I don't think the public was either. This is similar to Snowden's revelations, if you were paying attention you probably already knew a lot of that, but the incident made everyone aware of it in a very blunt way. >The rest of the images stays encrypted I think this is unclear, Apple can still decrypt those other images, how else could you view them in a browser? This goes back to what Stratechery said about capability vs policy.
gunapologist99 5y ago
At least we know that secrets never leak out.