4 ms·

Is there a free API for small SaaS products to use to check user uploaded images for CP and other violent imagery? Seems like such a tool should be a funded pub

Is there a free API for small SaaS products to use to check user uploaded images for CP and other violent imagery? Seems like such a tool should be a funded public service. I think AWS has something but it's likely paid and I don't use them. I'm pretty sure these tools are only available to companies that have the budget for it. Imagine open source projects like Wordpress and Mastodon having the option to toggle on such CP scanning of user uploaded content that would use the API?

_7gt4 5y ago
PhotoDNA, but it requires a suite of lawyers since the material it uses to fingerprint is high res enough to make it identifiable again. Or create false positives.
sirshmooey 5y ago
Cloudflare has the CSAM Scanning Tool for all accounts, not sure how well it works. https://blog.cloudflare.com/the-csam-scanning-tool/ https://blog.cloudflare.com/the-csam-scanning-tool/
nonameiguess 5y ago
The article describes schemes where perpetrators share images via file hosting services by encrypting and sharing symmetric keys out of band. There is no way you can possibly identify the file content if they're doing that. The only way is for law enforcement to discover the nature of the photos by other means and then tell you which files are actually CSAM, which works perfectly well until somebody they haven't caught yet who still has local copies uploads again from a different Tor entrance using a different encryption key.
- KarlKemp 5y ago
  Hosting encrypted zips en masse would also seem to be slightly shady? Sure, there are legitimate uses for that. But if it’s 90% of what your customers share on your platform, you might want to consider that it’s also legal not to host that type of file.
  - philipkglass 5y ago
    Most of those file sharing platforms get a lot of business from copyright infringers. Keeping files password-protected allows the platform to respond to takedown requests but deal with a minimal number of takedowns. The platform doesn't need to tell its users to do things that way; it's just a natural outcome of incentives. Uploaders don't want their uploads removed. I remember downloading encrypted .rar files to get expensive textbooks even back in the early days of RapidShare. The sites are by their nature pretty sketchy but usually for less heinous reasons than those under discussion here.

_7gt4 5y ago

PhotoDNA, but it requires a suite of lawyers since the material it uses to fingerprint is high res enough to make it identifiable again. Or create false positives.

sirshmooey 5y ago

Cloudflare has the CSAM Scanning Tool for all accounts, not sure how well it works. https://blog.cloudflare.com/the-csam-scanning-tool/ https://blog.cloudflare.com/the-csam-scanning-tool/

nonameiguess 5y ago

The article describes schemes where perpetrators share images via file hosting services by encrypting and sharing symmetric keys out of band. There is no way you can possibly identify the file content if they're doing that. The only way is for law enforcement to discover the nature of the photos by other means and then tell you which files are actually CSAM, which works perfectly well until somebody they haven't caught yet who still has local copies uploads again from a different Tor entrance using a different encryption key.

KarlKemp 5y ago
Hosting encrypted zips en masse would also seem to be slightly shady? Sure, there are legitimate uses for that. But if it’s 90% of what your customers share on your platform, you might want to consider that it’s also legal not to host that type of file.
- philipkglass 5y ago
  Most of those file sharing platforms get a lot of business from copyright infringers. Keeping files password-protected allows the platform to respond to takedown requests but deal with a minimal number of takedowns. The platform doesn't need to tell its users to do things that way; it's just a natural outcome of incentives. Uploaders don't want their uploads removed. I remember downloading encrypted .rar files to get expensive textbooks even back in the early days of RapidShare. The sites are by their nature pretty sketchy but usually for less heinous reasons than those under discussion here.