5 ms·

Run an on-device scan against a hash database. Using a technology shown to have very frequent collisions. And then they notify law enforcement if they get a hi

Run an on-device scan against a hash database. Using a technology shown to have very frequent collisions. And then they notify law enforcement if they get a hit. Which means even if you're innocent - all your devices get confiscated for months, you probably rack up tens of thousands of dollars in legal fees, maybe lose your job, probably lose your friends and get the boot from any social organizations or groups. They're waiting for two things. One, CSAM to get out of the news cycle and the furor among users about CSAM to die down. This is standard corporate PR "emergency" management practice. Two, to slide it into a point release after some minor, inconsequential change to say they "listened to users." iPhones with auto-updates enabled won't automatically upgrade to a new major release, but they will happily automatically upgrade to a point release. You can of course upgrade to iOS 15 and turn off auto-updates, but then you won't get security updates, like the people staying on iOS 14. Stay on iOS 14 until Apple surrenders completely on this.

Jtsummers 5y ago
If they get 30 (?) hits then they review the data and then they refer it to law enforcement if the reviewers determine that they were CSAM images. It's not for a single collision and it's not immediately referred to law enforcement. There are still major risks and concerns with this model, but at least describe it correctly.
- philwelch 5y ago
  How do they review the data if your iCloud photos are E2E encrypted?
  - jduckles 5y ago
    They're only encrypted when on iCloud, not when on your device. The hashes are computed on your device.
    - philwelch 5y ago
      So how do they capture the unencrypted images from my device for "review"?
      - WorldMaker 5y ago
        That's why the CSAM scanner is on your device. It computes the hashes in place on then unencrypted images before uploading encrypted copies to iCloud. That's why from some perspectives it is a net privacy win versus Google/Microsoft's similar tools that require them to have decryption backdoor keys on their clouds to process these CSAM requests and other FBI/TLA/et al warrants. Apple is saying they don't have backdoor keys at all on iCloud and if they are forced to do CSAM scanning it has to be on device, without leaving the device to have access to the unencrypted images. Only if you hit the reporting threshold (supposedly 30+ hash violations) would it also encrypt copies to a reporting database on iCloud (and again only if you were uploading those photos to iCloud in the first place).
        philwelch 5y ago
        So, again, how do they review those images? Does Apple have the key to the reporting database?
        WorldMaker 5y ago
        Yes, that would be why it sends copies, encrypted with a different key to the users' own storage keys.
        philwelch 5y ago
        So in other words, the only thing stopping Apple from viewing my iCloud photos is an if statement.
        kemayo 5y ago
        That would also be true for any use of iCloud Photos, no? If you don't trust this, then you also can't trust them to be storing them encrypted on their servers.
  - Jtsummers 5y ago
    I'm guessing you haven't been following the issue. More details in [1], but briefly: They hash the images that you're uploading to iCloud. If it matches one of the hashes in the database, then it gets encrypted and transmitted to them. No single data packet can be decrypted, they need 30 (?) matches with that database in order to get a decryption key that then allows them to review the uploaded images. They don't send the actual images to the reviewers, it's altered in some way. At that point the reviewer will have 30 (?) thumbnails (?) to review. If the images look like CSAM, then they'll report it to NCMEC who then report it to law enforcement (NCMEC is not, itself, a law enforcement agency). The ? are because I don't think they've publicly stated (or I've not read) what the threshold for decryption is or how they modify the images that get sent to the reviewers. [0] https://www.apple.com/child-safety/ https://www.apple.com/child-safety/ [1] https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...
    - philwelch 5y ago
      > I'm guessing you haven't been following the issue. Not as closely as some people. That's why I asked the question in the first place. But thanks for answering.
  - tillinghast 5y ago
    Let the reader understand. (i.e. They're encrypted in transfer and while stored, but Apple holds the keys: https://qr.ae/pGSHY8 https://qr.ae/pGSHY8, https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/apple-platform-security-guide.pdf https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app... [search for 'iCloud'])
    - danudey 5y ago
      For the lazy: > Each file is broken into chunks and encrypted by iCloud using AES128 and a key derived from each chunk’s contents, with the keys using SHA256. The keys and the file’s metadata are stored by Apple in the user’s iCloud account. The encrypted chunks of the file are stored, without any user-identifying information or the keys, using both Apple and third party storage services—such as Amazon Web Services or Google Cloud Platform—but these partners don’t have the keys to decrypt the user’s data stored on their servers. As far as I can tell, they don't say anything specific about where or how Apple stores the keys and metadata, so it should be assumed that Apple could decrypt your photos if they wanted to.
      - thrashh 5y ago
        End-to-end encryption prevents a third party from reading your content, but if you are getting your encryption software from the same people that are storing your encrypted data, the only thing stopping them from reading your data is corporate policy. Which is fine, because I use iCloud and many other cloud services, but you have to acknowledge the fact.
  - sneak 5y ago
    iCloud photos are not E2E encrypted. Apple has announced no plans whatsoever to make them such. Apple, their sysadmins, and the government can see every photo you have in iCloud. Apple had plans (and, an inside source tells me, an implementation) to do E2E for iCloud Backup, but the FBI asked them not to, so they scrapped it: https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv... This undermines the credibility of those who are claiming, without evidence, that this clientside CSAM scanning is a prelude to launching E2E for iCloud data.
    - philwelch 5y ago
      Okay, so basically they are just sort of pinky-swearing that your iCloud photos are encrypted on iCloud, but not in any way that prevents Apple or the government from decrypting them anyway. This raises the followup question of "why bother scanning the images on-device?", but I can infer two fairly obvious answers. First, the encryption still keeps AWS/Azure/GCP from seeing my photos. Second, and more cynically, they'd have to pay to do computation in the cloud; on-device computation is free to them. > This undermines the credibility of those who are claiming, without evidence, that this clientside CSAM scanning is a prelude to launching E2E for iCloud data. I agree; this is consistent with my initial point of confusion. Thanks!
      - GeekyBear 5y ago
        > Okay, so basically they are just sort of pinky-swearing that your iCloud photos are encrypted on iCloud, but not in any way that prevents Apple or the government from decrypting them anyway. How do you imagine that Google and Microsoft are able to scan the entire contents of your account? They can all read the data on their servers >This raises the followup question of "why bother scanning the images on-device? Because running the scan on device and encrypting the results protects users from having their account associated with the inevitable false positives that are going to crop up. Apple can't decrypt the scan results your device produces until the threshold of 30 matching images is reached. If someone issues a warrant to Apple for every account that has a single match, they can honestly report that they don't have that information. Google and Microsoft give you no such protection. Any data held on their server is wide open for misuse by anyone who can issue a warrant.
- KennyBlanken 5y ago
  Why should technology so bad it needs thirty mulligans have the power to completely destroy your life? And exactly how are they obligated to keep those policies? Answer: they aren't. There isn't some law saying '30 hits before we report you', and Apple is certainly going to drop the number as the public gets more used to the idea of CSAM. They'll keep dropping it until the news articles start coming out about how it's destroying lives. This is corporate law enforcement. You don't have a right to due process, any say in their policies, or protection via any sort of oversight.
  - GeekyBear 5y ago
    Again, Google and Microsoft have already been scanning everything on your account for the past decade without any such protections against incriminating users based on false positives.
    - privacyisntdead 5y ago
      Account is not the same as your device
      - GeekyBear 5y ago
        Apple isn't scanning the contents of your device. They are discussing scanning content you upload to iCloud Photos. So, yes. It's the same.
        privacyisntdead 5y ago
        "Before an image is stored in iCloud Photos, the following on-device matching process is performed for that image against the blinded hash table database." https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni... Apple disagrees with you.
        GeekyBear 5y ago
GeekyBear 5y ago
> Run an on-device scan against a hash database. Using a technology shown to have very frequent collisions. Google and Microsoft have been scanning everything in your account against a hash database for the past decade. Also, unlike Apple's system which doesn't even notify Apple of the first 30 positive results (to protect you from the inevitable false positives) Google and Microsoft offer users no such protection. >then they notify law enforcement if they get a hit. Which means even if you're innocent - all your devices get confiscated for months, you probably rack up tens of thousands of dollars in legal fees, maybe lose your job, probably lose your friends and get the boot from any social organizations or groups. Again, Google and Microsoft have already been doing this for the past decade. >a man [was] arrested on child pornography charges, after Google tipped off authorities about illegal images found in the Houston suspect's Gmail account https://techcrunch.com/2014/08/06/why-the-gmail-scan-that-led-to-a-mans-arrest-for-child-porn-was-not-a-privacy-violation/ https://techcrunch.com/2014/08/06/why-the-gmail-scan-that-le...
- KennyBlanken 5y ago
  Scanning content on a gmail account is not even remotely anything like scanning my device.
  - ilogik 5y ago
    the photos are only scanned just before being uploaded to iCloud. If you have CSAM on your phone, just turn off iCloud sync
    - rgovostes 5y ago
      Also, if you plan on burying a body in the woods, make sure you turn on Airplane Mode first.
    - andrei_says_ 5y ago
      Great advice and great job repeating the manipulative framing of “if you’re not a pedophile, you have nothing to fear.” Also, if you have anything that may be matched by unknowable and unverifiable matching hashes and algorithms provided by multiple nation states now or ever in the future, including but not limited to political activists, protests, anti-animal-abuse activists, climate activists, and select ethnicities, or copyright violations of any kind… switch off iCloud sync. Until that switch gets ignored. This cannot and will not be limited to CSAM. The matching is much more complicated than “hashes of existing images.” Here’s a good in-depth interview on the tech and the issues. https://m.youtube.com/watch?v=9ZZ5erGSKgs https://m.youtube.com/watch?v=9ZZ5erGSKgs
sharikous 5y ago
> Two, to slide it into a point release after some minor, inconsequential change to say they "listened to users." I doubt it will happen. Apple is not known for that sort of interaction. Whatever will happen it will happen silently without Apple admitting to bend down to any backlash. Also, the pressure to implement device scanning is coming from governments. So it is naive to think Apple will ever surrender. Most probably in the near future every single electronic device will try to leak your data as much as it physically can do.
- newsbinator 5y ago
  > Apple is not known for that sort of interaction. Apple was not known to err on the side of "think of the children" or "let's help catch criminals" instead of personal privacy. But now they're known for new things.
c7DJTLrn 5y ago
>Stay on iOS 14 until Apple surrenders completely on this Or vote with your wallet and abandon the Apple ecosystem. But nobody will because they don't have the bollocks.
- duped 5y ago
  More that I need a smart phone for work and life but there are no viable alternatives to iOS and Android, and I trust Apple slightly more than Google not to spy on me and use it against me
  - axiosgunnar 5y ago
    Literally this
  - 0x6862 5y ago
    On many Android devices you can flash an AOSP RON which is a very viable alternative
    - KennyBlanken 5y ago
      They're not a very viable alternative unless you plan on never trying to run any major/popular apps, because they all use Google Play Services APIs/libraries/toolboxes. Install Google Play Services and Google gets whatever info they want from your phone.

Jtsummers 5y ago

If they get 30 (?) hits then they review the data and then they refer it to law enforcement if the reviewers determine that they were CSAM images. It's not for a single collision and it's not immediately referred to law enforcement. There are still major risks and concerns with this model, but at least describe it correctly.

philwelch 5y ago
How do they review the data if your iCloud photos are E2E encrypted?
- jduckles 5y ago
  They're only encrypted when on iCloud, not when on your device. The hashes are computed on your device.
  - philwelch 5y ago
    So how do they capture the unencrypted images from my device for "review"?
    - WorldMaker 5y ago
      That's why the CSAM scanner is on your device. It computes the hashes in place on then unencrypted images before uploading encrypted copies to iCloud. That's why from some perspectives it is a net privacy win versus Google/Microsoft's similar tools that require them to have decryption backdoor keys on their clouds to process these CSAM requests and other FBI/TLA/et al warrants. Apple is saying they don't have backdoor keys at all on iCloud and if they are forced to do CSAM scanning it has to be on device, without leaving the device to have access to the unencrypted images. Only if you hit the reporting threshold (supposedly 30+ hash violations) would it also encrypt copies to a reporting database on iCloud (and again only if you were uploading those photos to iCloud in the first place).
      - philwelch 5y ago
        So, again, how do they review those images? Does Apple have the key to the reporting database?
        WorldMaker 5y ago
        Yes, that would be why it sends copies, encrypted with a different key to the users' own storage keys.
        philwelch 5y ago
        So in other words, the only thing stopping Apple from viewing my iCloud photos is an if statement.
        kemayo 5y ago
        That would also be true for any use of iCloud Photos, no? If you don't trust this, then you also can't trust them to be storing them encrypted on their servers.
- Jtsummers 5y ago
  I'm guessing you haven't been following the issue. More details in [1], but briefly: They hash the images that you're uploading to iCloud. If it matches one of the hashes in the database, then it gets encrypted and transmitted to them. No single data packet can be decrypted, they need 30 (?) matches with that database in order to get a decryption key that then allows them to review the uploaded images. They don't send the actual images to the reviewers, it's altered in some way. At that point the reviewer will have 30 (?) thumbnails (?) to review. If the images look like CSAM, then they'll report it to NCMEC who then report it to law enforcement (NCMEC is not, itself, a law enforcement agency). The ? are because I don't think they've publicly stated (or I've not read) what the threshold for decryption is or how they modify the images that get sent to the reviewers. [0] https://www.apple.com/child-safety/ https://www.apple.com/child-safety/ [1] https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...
  - philwelch 5y ago
    > I'm guessing you haven't been following the issue. Not as closely as some people. That's why I asked the question in the first place. But thanks for answering.
- tillinghast 5y ago
  Let the reader understand. (i.e. They're encrypted in transfer and while stored, but Apple holds the keys: https://qr.ae/pGSHY8 https://qr.ae/pGSHY8, https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/apple-platform-security-guide.pdf https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app... [search for 'iCloud'])
  - danudey 5y ago
    For the lazy: > Each file is broken into chunks and encrypted by iCloud using AES128 and a key derived from each chunk’s contents, with the keys using SHA256. The keys and the file’s metadata are stored by Apple in the user’s iCloud account. The encrypted chunks of the file are stored, without any user-identifying information or the keys, using both Apple and third party storage services—such as Amazon Web Services or Google Cloud Platform—but these partners don’t have the keys to decrypt the user’s data stored on their servers. As far as I can tell, they don't say anything specific about where or how Apple stores the keys and metadata, so it should be assumed that Apple could decrypt your photos if they wanted to.
    - thrashh 5y ago
      End-to-end encryption prevents a third party from reading your content, but if you are getting your encryption software from the same people that are storing your encrypted data, the only thing stopping them from reading your data is corporate policy. Which is fine, because I use iCloud and many other cloud services, but you have to acknowledge the fact.
- sneak 5y ago
  iCloud photos are not E2E encrypted. Apple has announced no plans whatsoever to make them such. Apple, their sysadmins, and the government can see every photo you have in iCloud. Apple had plans (and, an inside source tells me, an implementation) to do E2E for iCloud Backup, but the FBI asked them not to, so they scrapped it: https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv... This undermines the credibility of those who are claiming, without evidence, that this clientside CSAM scanning is a prelude to launching E2E for iCloud data.
  - philwelch 5y ago
    Okay, so basically they are just sort of pinky-swearing that your iCloud photos are encrypted on iCloud, but not in any way that prevents Apple or the government from decrypting them anyway. This raises the followup question of "why bother scanning the images on-device?", but I can infer two fairly obvious answers. First, the encryption still keeps AWS/Azure/GCP from seeing my photos. Second, and more cynically, they'd have to pay to do computation in the cloud; on-device computation is free to them. > This undermines the credibility of those who are claiming, without evidence, that this clientside CSAM scanning is a prelude to launching E2E for iCloud data. I agree; this is consistent with my initial point of confusion. Thanks!
    - GeekyBear 5y ago
      > Okay, so basically they are just sort of pinky-swearing that your iCloud photos are encrypted on iCloud, but not in any way that prevents Apple or the government from decrypting them anyway. How do you imagine that Google and Microsoft are able to scan the entire contents of your account? They can all read the data on their servers >This raises the followup question of "why bother scanning the images on-device? Because running the scan on device and encrypting the results protects users from having their account associated with the inevitable false positives that are going to crop up. Apple can't decrypt the scan results your device produces until the threshold of 30 matching images is reached. If someone issues a warrant to Apple for every account that has a single match, they can honestly report that they don't have that information. Google and Microsoft give you no such protection. Any data held on their server is wide open for misuse by anyone who can issue a warrant.
KennyBlanken 5y ago
Why should technology so bad it needs thirty mulligans have the power to completely destroy your life? And exactly how are they obligated to keep those policies? Answer: they aren't. There isn't some law saying '30 hits before we report you', and Apple is certainly going to drop the number as the public gets more used to the idea of CSAM. They'll keep dropping it until the news articles start coming out about how it's destroying lives. This is corporate law enforcement. You don't have a right to due process, any say in their policies, or protection via any sort of oversight.
- GeekyBear 5y ago
  Again, Google and Microsoft have already been scanning everything on your account for the past decade without any such protections against incriminating users based on false positives.
  - privacyisntdead 5y ago
    Account is not the same as your device
    - GeekyBear 5y ago
      Apple isn't scanning the contents of your device. They are discussing scanning content you upload to iCloud Photos. So, yes. It's the same.
      - privacyisntdead 5y ago
        "Before an image is stored in iCloud Photos, the following on-device matching process is performed for that image against the blinded hash table database." https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni... Apple disagrees with you.
        GeekyBear 5y ago

GeekyBear 5y ago

> Run an on-device scan against a hash database. Using a technology shown to have very frequent collisions. Google and Microsoft have been scanning everything in your account against a hash database for the past decade. Also, unlike Apple's system which doesn't even notify Apple of the first 30 positive results (to protect you from the inevitable false positives) Google and Microsoft offer users no such protection. >then they notify law enforcement if they get a hit. Which means even if you're innocent - all your devices get confiscated for months, you probably rack up tens of thousands of dollars in legal fees, maybe lose your job, probably lose your friends and get the boot from any social organizations or groups. Again, Google and Microsoft have already been doing this for the past decade. >a man [was] arrested on child pornography charges, after Google tipped off authorities about illegal images found in the Houston suspect's Gmail account https://techcrunch.com/2014/08/06/why-the-gmail-scan-that-led-to-a-mans-arrest-for-child-porn-was-not-a-privacy-violation/ https://techcrunch.com/2014/08/06/why-the-gmail-scan-that-le...

KennyBlanken 5y ago
Scanning content on a gmail account is not even remotely anything like scanning my device.
- ilogik 5y ago
  the photos are only scanned just before being uploaded to iCloud. If you have CSAM on your phone, just turn off iCloud sync
  - rgovostes 5y ago
    Also, if you plan on burying a body in the woods, make sure you turn on Airplane Mode first.
  - andrei_says_ 5y ago
    Great advice and great job repeating the manipulative framing of “if you’re not a pedophile, you have nothing to fear.” Also, if you have anything that may be matched by unknowable and unverifiable matching hashes and algorithms provided by multiple nation states now or ever in the future, including but not limited to political activists, protests, anti-animal-abuse activists, climate activists, and select ethnicities, or copyright violations of any kind… switch off iCloud sync. Until that switch gets ignored. This cannot and will not be limited to CSAM. The matching is much more complicated than “hashes of existing images.” Here’s a good in-depth interview on the tech and the issues. https://m.youtube.com/watch?v=9ZZ5erGSKgs https://m.youtube.com/watch?v=9ZZ5erGSKgs

sharikous 5y ago

> Two, to slide it into a point release after some minor, inconsequential change to say they "listened to users." I doubt it will happen. Apple is not known for that sort of interaction. Whatever will happen it will happen silently without Apple admitting to bend down to any backlash. Also, the pressure to implement device scanning is coming from governments. So it is naive to think Apple will ever surrender. Most probably in the near future every single electronic device will try to leak your data as much as it physically can do.

newsbinator 5y ago
> Apple is not known for that sort of interaction. Apple was not known to err on the side of "think of the children" or "let's help catch criminals" instead of personal privacy. But now they're known for new things.

c7DJTLrn 5y ago

>Stay on iOS 14 until Apple surrenders completely on this Or vote with your wallet and abandon the Apple ecosystem. But nobody will because they don't have the bollocks.

duped 5y ago
More that I need a smart phone for work and life but there are no viable alternatives to iOS and Android, and I trust Apple slightly more than Google not to spy on me and use it against me
- axiosgunnar 5y ago
  Literally this
- 0x6862 5y ago
  On many Android devices you can flash an AOSP RON which is a very viable alternative
  - KennyBlanken 5y ago
    They're not a very viable alternative unless you plan on never trying to run any major/popular apps, because they all use Google Play Services APIs/libraries/toolboxes. Install Google Play Services and Google gets whatever info they want from your phone.