8 ms·

The photos were synced to Google Drive where we know it would be scanned...which is fine. Apple's proposal would report you as soon as you took the picture.

by fyzix 4y ago

sentientslug 4y ago
You are incorrect. A quick google search will show you that the Apple CSAM detection was only going to be implemented to photos uploaded to iCloud.
infotogivenm 4y ago
Do you have a source for that? I somewhat recall their proposal was only to ever scan photos uploaded to iCloud.
- hamandcheese 4y ago
  I believe that was the plan, initially, however the scanning was still happening on device. That has many people rightfully concerned that the scanning could extend to local-only images next.
  - infotogivenm 4y ago
    What a strange concern. Sending hashes of images as you take them to a remote server is very easy to do in any OS update, if they really wanted to betray their customer base's privacy expectations like that. IMO the more logical guess as to the actual reason Apple wants to do this - to approach e2e encrypted iCloud photos in a LE-friendly way.
    - philistine 4y ago
      The thing is they never announced e2e iCloud photos with the new process. So we could presume, but I honestly believe they never intend to give it to us.
    - hamandcheese 4y ago
      iCloud backups are not e2e encrypted, though. And I don’t think anyone was suggesting that Apple would secretly betray users. The concern is normalization of the notion of on-device scanning before (publicly) expanding the scope to all images.
      - j16sdiz 4y ago
        If are talking about the whole device backup, Most of it are encrypted with your phone unlock pin or recovery code. Only iMessages (iirc) are not e2ee.
      - infotogivenm 4y ago
        I was not suggesting this either... And yes, iCloud backups if you choose to use them are mostly not e2e encrypted (some important bits like iCloud keychain etc aside). In any case, I think this concern of yours is unfounded, as echoed by many in the other comments below, and you should rethink it before continuing to push it. The amount of scanning has not changed since the invention of corporate image hosting on the internet; you still cannot use iCloud to host known illegal content - they just moved where the scanning takes place. I don't see how this makes it any more likely or normalized to scan your non-iCloud photos.
  - sentientslug 4y ago
    It's illogical to fault Apple for something that they hadn't even talked about implementing ("local-only images" as you put it)
  - astrange 4y ago
    They have it backwards, scanning cloud uploads on device is more private than scanning them in the cloud.
    - hamandcheese 4y ago
      Only if iCloud photos were e2e encrypted, which they are not. Then cloud scanning would necessarily mean removing the e2e encryption. Since the photos are decryptable by keys in Apple’s possession, there is no real advantage to scanning on-device unless Apple/the government wanted to increase the scope of the scanning beyond iCloud. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
      - j16sdiz 4y ago
        iCloud photo are not e2ee, but encrypted at rest. The key is encrypted with your password. Once you're logout, they are not supposed to be able to access them..
        infotogivenm 4y ago
        This isn't true at all FWIW, except for the "encrypted at rest" part. "At rest" just means Apple doesn't dump them onto hard drives somewhere in plaintext. Their security model is documented in detail and is worth understanding. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 https://support.apple.com/guide/security/welcome/web https://support.apple.com/guide/security/welcome/web
      - astrange 4y ago
        The advantage is that it doesn't use those keys, and you can see what it's doing. Less time spent ever decrypted = more private.
  - JimDabell 4y ago
    > That has many people rightfully concerned that the scanning could extend to local-only images next. Apple didn’t propose this, and the scheme that Apple did propose was very inconvenient if they actually wanted to do this. They would have had to redesign how the system worked to do it, at which point most of the system would become completely useless. Nobody would come up with a system like Apple’s if they wanted to do what you describe. There are much simpler ways to do that which would have saved Apple a lot of time and effort. The only reason to design a system like Apple’s is to limit knowledge in all directions as much as possible. Nobody was rightfully concerned about this, they got outraged because they would rather jump to conclusions over headlines than take the time to read about how the scheme worked.
    - hamandcheese 4y ago
      The only reason to design a system like Apple’s is so that it is impossible to opt out of once it is rolled out to non-iCloud photos. iCloud photos are not e2e encrypted. If only iCloud photos were the true final target, there is absolutely no need for on-device scanning.
      - JimDabell 4y ago
        > The only reason to design a system like Apple’s is so that it is impossible to opt out of once it is rolled out to non-iCloud photos. This doesn’t make any sense because this system cannot be rolled out to non-iCloud photos. They would have to redesign how it worked. So the whole idea that Apple designed it this way for reasons that only kick in when it’s rolled out to non-iCloud photos is incoherent. If Apple were designing it for that purpose they would have picked a design that actually worked in those circumstances.
        hamandcheese 4y ago
        What about the design makes this only possible for iCloud? The scanning occurs on device. What limits it to only iCloud photos?
- acchow 4y ago
  The announcement was a little confusing, but Apple said they would scan photos being sent to iCloud but the scanning would occur on device (I suppose right before uploading).
58028641 4y ago
I was under the impression that Apple only planned to scan photos that would be uploaded to the cloud. Is that incorrect?
- JohnBooty 4y ago
  They were planning to compare hashes/fingerprints of your photos against known, existing child porn images.
  - MBCook 4y ago
    This is the thing that confuses me about this discussion. Apple planned to look for known abuse images. People freaked out and they had to back down. Google already scans for possible abuse images including new ones using AI. Thus it found and reported a father for a pic he had just taken. And Apple is somehow the worse of the two.
    - gpm 4y ago
      Everyone agrees that stopping CSAM in a way that respects everyone rights is a good thing. We aren't making a results oriented objection to the goal, but a methods oriented objection. The courts at least all agree that a company can be compelled to scan content in their possession, the creator of the content has no significant privacy rights. This is known as the third party doctrine. All Google is doing is doing this kind of scanning. Apple meanwhile, wants to take your device (something that they cannot be compelled to do, due to the 4th amendment restriction against seizures) and use it to scan the content on your device (something they cannot be compelled to do, due to the 4th amendment restriction against searches) to decide whether or not there is illegal content on it. The company violating you worse is pretty obviously the one doing things to you that the government couldn't compel them to do, because (if compelled) it would violate your rights.
      - MBCook 4y ago
        But they were not not going to do it if you chose to use iCloud Photos. It’s basically a condition in the ToS, just like Google has one saying they can scan stuff in Google Photos. It seems like hair-splitting to me. In both cases your photos are getting checked if you want to use the cloud storage service. Why is it worse to do on device (where it’s private) instead of on Google’s server (where you have to give them a plaintext copy of the photo)? “Oh but Apple could change that with any update”. Couldn’t Google do the same with any update to Android, or even a Google Play Services update?
Spartan-S63 4y ago
You're leaving out the detail that the CSAM scanning and detection would only occur if you upload your photos to iCloud. If you don't have iCloud photos turned on, the scanning wouldn't happen. Additionally, scanning would happen on-device at time of upload and not on Apple's servers.
- gonehome 4y ago
  Not only that but Apple’s only matched hashes of known CSAM kept in the NCMEC database. Google meanwhile scans for algorithmically determined new content and ruins people’s lives without any ability to appeal (even after national news coverage): https://stratechery.com/2022/rights-laws-and-google/ https://stratechery.com/2022/rights-laws-and-google/ Also Apple was clearly doing this so they could enable e2e encryption on iCloud.
  - kevin_thibedeau 4y ago
    They were doing it as a favor to the DOJ to avoid an investigation into their business practices.
    - kikokikokiko 4y ago
      To be fair they were probably doing it as a disguise to the real goal: spy on everything you do on your phone and send it to the "authorities", no questions asked. Before the autists noticed it after it was implemented, Apple simply announced beforehand that it's devices would start spying on you, but it's to protect the kids you know...
      - type0 4y ago
        > but it's to protect the kids you know... Yeah, but the big question still remains, do they protect me from terrorists as well?
        DesiLurker 4y ago
MBCook 4y ago
Apple’s proposal scanned for KNOWN abuse images. It didn’t try to identify NEW images the way Google did. So in the same situation Apple’s proposal (which was designed with the input of many experts to avoid false positives and respect privacy) COULD NOT have flagged the father.
philistine 4y ago
Apple’s proposal would have only worked against previously known pictures in the database maintained by the non-profit. The story we’re discussing here is due to machine learning deciding the pictures were CSAM.

The photos were synced to Google Drive where we know it would be scanned...which is fine. Apple's proposal would report you as soon as you took the picture.

by fyzix 4y ago

The photos were synced to Google Drive where we know it would be scanned...which is fine. Apple's proposal would report you as soon as you took the picture.

sentientslug 4y ago

You are incorrect. A quick google search will show you that the Apple CSAM detection was only going to be implemented to photos uploaded to iCloud.

infotogivenm 4y ago

Do you have a source for that? I somewhat recall their proposal was only to ever scan photos uploaded to iCloud.

hamandcheese 4y ago
I believe that was the plan, initially, however the scanning was still happening on device. That has many people rightfully concerned that the scanning could extend to local-only images next.
- infotogivenm 4y ago
  What a strange concern. Sending hashes of images as you take them to a remote server is very easy to do in any OS update, if they really wanted to betray their customer base's privacy expectations like that. IMO the more logical guess as to the actual reason Apple wants to do this - to approach e2e encrypted iCloud photos in a LE-friendly way.
  - philistine 4y ago
    The thing is they never announced e2e iCloud photos with the new process. So we could presume, but I honestly believe they never intend to give it to us.
  - hamandcheese 4y ago
    iCloud backups are not e2e encrypted, though. And I don’t think anyone was suggesting that Apple would secretly betray users. The concern is normalization of the notion of on-device scanning before (publicly) expanding the scope to all images.
    - j16sdiz 4y ago
      If are talking about the whole device backup, Most of it are encrypted with your phone unlock pin or recovery code. Only iMessages (iirc) are not e2ee.
    - infotogivenm 4y ago
      I was not suggesting this either... And yes, iCloud backups if you choose to use them are mostly not e2e encrypted (some important bits like iCloud keychain etc aside). In any case, I think this concern of yours is unfounded, as echoed by many in the other comments below, and you should rethink it before continuing to push it. The amount of scanning has not changed since the invention of corporate image hosting on the internet; you still cannot use iCloud to host known illegal content - they just moved where the scanning takes place. I don't see how this makes it any more likely or normalized to scan your non-iCloud photos.
- sentientslug 4y ago
  It's illogical to fault Apple for something that they hadn't even talked about implementing ("local-only images" as you put it)
- astrange 4y ago
  They have it backwards, scanning cloud uploads on device is more private than scanning them in the cloud.
  - hamandcheese 4y ago
    Only if iCloud photos were e2e encrypted, which they are not. Then cloud scanning would necessarily mean removing the e2e encryption. Since the photos are decryptable by keys in Apple’s possession, there is no real advantage to scanning on-device unless Apple/the government wanted to increase the scope of the scanning beyond iCloud. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
    - j16sdiz 4y ago
      iCloud photo are not e2ee, but encrypted at rest. The key is encrypted with your password. Once you're logout, they are not supposed to be able to access them..
      - infotogivenm 4y ago
        This isn't true at all FWIW, except for the "encrypted at rest" part. "At rest" just means Apple doesn't dump them onto hard drives somewhere in plaintext. Their security model is documented in detail and is worth understanding. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 https://support.apple.com/guide/security/welcome/web https://support.apple.com/guide/security/welcome/web
    - astrange 4y ago
      The advantage is that it doesn't use those keys, and you can see what it's doing. Less time spent ever decrypted = more private.
- JimDabell 4y ago
  > That has many people rightfully concerned that the scanning could extend to local-only images next. Apple didn’t propose this, and the scheme that Apple did propose was very inconvenient if they actually wanted to do this. They would have had to redesign how the system worked to do it, at which point most of the system would become completely useless. Nobody would come up with a system like Apple’s if they wanted to do what you describe. There are much simpler ways to do that which would have saved Apple a lot of time and effort. The only reason to design a system like Apple’s is to limit knowledge in all directions as much as possible. Nobody was rightfully concerned about this, they got outraged because they would rather jump to conclusions over headlines than take the time to read about how the scheme worked.
  - hamandcheese 4y ago
    The only reason to design a system like Apple’s is so that it is impossible to opt out of once it is rolled out to non-iCloud photos. iCloud photos are not e2e encrypted. If only iCloud photos were the true final target, there is absolutely no need for on-device scanning.
    - JimDabell 4y ago
      > The only reason to design a system like Apple’s is so that it is impossible to opt out of once it is rolled out to non-iCloud photos. This doesn’t make any sense because this system cannot be rolled out to non-iCloud photos. They would have to redesign how it worked. So the whole idea that Apple designed it this way for reasons that only kick in when it’s rolled out to non-iCloud photos is incoherent. If Apple were designing it for that purpose they would have picked a design that actually worked in those circumstances.
      - hamandcheese 4y ago
        What about the design makes this only possible for iCloud? The scanning occurs on device. What limits it to only iCloud photos?
acchow 4y ago
The announcement was a little confusing, but Apple said they would scan photos being sent to iCloud but the scanning would occur on device (I suppose right before uploading).

58028641 4y ago

I was under the impression that Apple only planned to scan photos that would be uploaded to the cloud. Is that incorrect?

JohnBooty 4y ago
They were planning to compare hashes/fingerprints of your photos against known, existing child porn images.
- MBCook 4y ago
  This is the thing that confuses me about this discussion. Apple planned to look for known abuse images. People freaked out and they had to back down. Google already scans for possible abuse images including new ones using AI. Thus it found and reported a father for a pic he had just taken. And Apple is somehow the worse of the two.
  - gpm 4y ago
    Everyone agrees that stopping CSAM in a way that respects everyone rights is a good thing. We aren't making a results oriented objection to the goal, but a methods oriented objection. The courts at least all agree that a company can be compelled to scan content in their possession, the creator of the content has no significant privacy rights. This is known as the third party doctrine. All Google is doing is doing this kind of scanning. Apple meanwhile, wants to take your device (something that they cannot be compelled to do, due to the 4th amendment restriction against seizures) and use it to scan the content on your device (something they cannot be compelled to do, due to the 4th amendment restriction against searches) to decide whether or not there is illegal content on it. The company violating you worse is pretty obviously the one doing things to you that the government couldn't compel them to do, because (if compelled) it would violate your rights.
    - MBCook 4y ago
      But they were not not going to do it if you chose to use iCloud Photos. It’s basically a condition in the ToS, just like Google has one saying they can scan stuff in Google Photos. It seems like hair-splitting to me. In both cases your photos are getting checked if you want to use the cloud storage service. Why is it worse to do on device (where it’s private) instead of on Google’s server (where you have to give them a plaintext copy of the photo)? “Oh but Apple could change that with any update”. Couldn’t Google do the same with any update to Android, or even a Google Play Services update?

Spartan-S63 4y ago

You're leaving out the detail that the CSAM scanning and detection would only occur if you upload your photos to iCloud. If you don't have iCloud photos turned on, the scanning wouldn't happen. Additionally, scanning would happen on-device at time of upload and not on Apple's servers.

gonehome 4y ago
Not only that but Apple’s only matched hashes of known CSAM kept in the NCMEC database. Google meanwhile scans for algorithmically determined new content and ruins people’s lives without any ability to appeal (even after national news coverage): https://stratechery.com/2022/rights-laws-and-google/ https://stratechery.com/2022/rights-laws-and-google/ Also Apple was clearly doing this so they could enable e2e encryption on iCloud.
- kevin_thibedeau 4y ago
  They were doing it as a favor to the DOJ to avoid an investigation into their business practices.
  - kikokikokiko 4y ago
    To be fair they were probably doing it as a disguise to the real goal: spy on everything you do on your phone and send it to the "authorities", no questions asked. Before the autists noticed it after it was implemented, Apple simply announced beforehand that it's devices would start spying on you, but it's to protect the kids you know...
    - type0 4y ago
      > but it's to protect the kids you know... Yeah, but the big question still remains, do they protect me from terrorists as well?
      - DesiLurker 4y ago

MBCook 4y ago

Apple’s proposal scanned for KNOWN abuse images. It didn’t try to identify NEW images the way Google did. So in the same situation Apple’s proposal (which was designed with the input of many experts to avoid false positives and respect privacy) COULD NOT have flagged the father.

philistine 4y ago

Apple’s proposal would have only worked against previously known pictures in the database maintained by the non-profit. The story we’re discussing here is due to machine learning deciding the pictures were CSAM.