4 ms·

Do you have a source for that? I somewhat recall their proposal was only to ever scan photos uploaded to iCloud.

hamandcheese 4y ago
I believe that was the plan, initially, however the scanning was still happening on device. That has many people rightfully concerned that the scanning could extend to local-only images next.
- infotogivenm 4y ago
  What a strange concern. Sending hashes of images as you take them to a remote server is very easy to do in any OS update, if they really wanted to betray their customer base's privacy expectations like that. IMO the more logical guess as to the actual reason Apple wants to do this - to approach e2e encrypted iCloud photos in a LE-friendly way.
  - philistine 4y ago
    The thing is they never announced e2e iCloud photos with the new process. So we could presume, but I honestly believe they never intend to give it to us.
  - hamandcheese 4y ago
    iCloud backups are not e2e encrypted, though. And I don’t think anyone was suggesting that Apple would secretly betray users. The concern is normalization of the notion of on-device scanning before (publicly) expanding the scope to all images.
    - j16sdiz 4y ago
      If are talking about the whole device backup, Most of it are encrypted with your phone unlock pin or recovery code. Only iMessages (iirc) are not e2ee.
    - infotogivenm 4y ago
      I was not suggesting this either... And yes, iCloud backups if you choose to use them are mostly not e2e encrypted (some important bits like iCloud keychain etc aside). In any case, I think this concern of yours is unfounded, as echoed by many in the other comments below, and you should rethink it before continuing to push it. The amount of scanning has not changed since the invention of corporate image hosting on the internet; you still cannot use iCloud to host known illegal content - they just moved where the scanning takes place. I don't see how this makes it any more likely or normalized to scan your non-iCloud photos.
- sentientslug 4y ago
  It's illogical to fault Apple for something that they hadn't even talked about implementing ("local-only images" as you put it)
- astrange 4y ago
  They have it backwards, scanning cloud uploads on device is more private than scanning them in the cloud.
  - hamandcheese 4y ago
    Only if iCloud photos were e2e encrypted, which they are not. Then cloud scanning would necessarily mean removing the e2e encryption. Since the photos are decryptable by keys in Apple’s possession, there is no real advantage to scanning on-device unless Apple/the government wanted to increase the scope of the scanning beyond iCloud. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
    - j16sdiz 4y ago
      iCloud photo are not e2ee, but encrypted at rest. The key is encrypted with your password. Once you're logout, they are not supposed to be able to access them..
      - infotogivenm 4y ago
        This isn't true at all FWIW, except for the "encrypted at rest" part. "At rest" just means Apple doesn't dump them onto hard drives somewhere in plaintext. Their security model is documented in detail and is worth understanding. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 https://support.apple.com/guide/security/welcome/web https://support.apple.com/guide/security/welcome/web
    - astrange 4y ago
      The advantage is that it doesn't use those keys, and you can see what it's doing. Less time spent ever decrypted = more private.
- JimDabell 4y ago
  > That has many people rightfully concerned that the scanning could extend to local-only images next. Apple didn’t propose this, and the scheme that Apple did propose was very inconvenient if they actually wanted to do this. They would have had to redesign how the system worked to do it, at which point most of the system would become completely useless. Nobody would come up with a system like Apple’s if they wanted to do what you describe. There are much simpler ways to do that which would have saved Apple a lot of time and effort. The only reason to design a system like Apple’s is to limit knowledge in all directions as much as possible. Nobody was rightfully concerned about this, they got outraged because they would rather jump to conclusions over headlines than take the time to read about how the scheme worked.
  - hamandcheese 4y ago
    The only reason to design a system like Apple’s is so that it is impossible to opt out of once it is rolled out to non-iCloud photos. iCloud photos are not e2e encrypted. If only iCloud photos were the true final target, there is absolutely no need for on-device scanning.
    - JimDabell 4y ago
      > The only reason to design a system like Apple’s is so that it is impossible to opt out of once it is rolled out to non-iCloud photos. This doesn’t make any sense because this system cannot be rolled out to non-iCloud photos. They would have to redesign how it worked. So the whole idea that Apple designed it this way for reasons that only kick in when it’s rolled out to non-iCloud photos is incoherent. If Apple were designing it for that purpose they would have picked a design that actually worked in those circumstances.
      - hamandcheese 4y ago
        What about the design makes this only possible for iCloud? The scanning occurs on device. What limits it to only iCloud photos?
acchow 4y ago
The announcement was a little confusing, but Apple said they would scan photos being sent to iCloud but the scanning would occur on device (I suppose right before uploading).

I believe that was the plan, initially, however the scanning was still happening on device. That has many people rightfully concerned that the scanning could extend to local-only images next.

infotogivenm 4y ago
What a strange concern. Sending hashes of images as you take them to a remote server is very easy to do in any OS update, if they really wanted to betray their customer base's privacy expectations like that. IMO the more logical guess as to the actual reason Apple wants to do this - to approach e2e encrypted iCloud photos in a LE-friendly way.
- philistine 4y ago
  The thing is they never announced e2e iCloud photos with the new process. So we could presume, but I honestly believe they never intend to give it to us.
- hamandcheese 4y ago
  iCloud backups are not e2e encrypted, though. And I don’t think anyone was suggesting that Apple would secretly betray users. The concern is normalization of the notion of on-device scanning before (publicly) expanding the scope to all images.
  - j16sdiz 4y ago
    If are talking about the whole device backup, Most of it are encrypted with your phone unlock pin or recovery code. Only iMessages (iirc) are not e2ee.
  - infotogivenm 4y ago
    I was not suggesting this either... And yes, iCloud backups if you choose to use them are mostly not e2e encrypted (some important bits like iCloud keychain etc aside). In any case, I think this concern of yours is unfounded, as echoed by many in the other comments below, and you should rethink it before continuing to push it. The amount of scanning has not changed since the invention of corporate image hosting on the internet; you still cannot use iCloud to host known illegal content - they just moved where the scanning takes place. I don't see how this makes it any more likely or normalized to scan your non-iCloud photos.
sentientslug 4y ago
It's illogical to fault Apple for something that they hadn't even talked about implementing ("local-only images" as you put it)
astrange 4y ago
They have it backwards, scanning cloud uploads on device is more private than scanning them in the cloud.
- hamandcheese 4y ago
  Only if iCloud photos were e2e encrypted, which they are not. Then cloud scanning would necessarily mean removing the e2e encryption. Since the photos are decryptable by keys in Apple’s possession, there is no real advantage to scanning on-device unless Apple/the government wanted to increase the scope of the scanning beyond iCloud. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
  - j16sdiz 4y ago
    iCloud photo are not e2ee, but encrypted at rest. The key is encrypted with your password. Once you're logout, they are not supposed to be able to access them..
    - infotogivenm 4y ago
      This isn't true at all FWIW, except for the "encrypted at rest" part. "At rest" just means Apple doesn't dump them onto hard drives somewhere in plaintext. Their security model is documented in detail and is worth understanding. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303 https://support.apple.com/guide/security/welcome/web https://support.apple.com/guide/security/welcome/web
  - astrange 4y ago
    The advantage is that it doesn't use those keys, and you can see what it's doing. Less time spent ever decrypted = more private.
JimDabell 4y ago
> That has many people rightfully concerned that the scanning could extend to local-only images next. Apple didn’t propose this, and the scheme that Apple did propose was very inconvenient if they actually wanted to do this. They would have had to redesign how the system worked to do it, at which point most of the system would become completely useless. Nobody would come up with a system like Apple’s if they wanted to do what you describe. There are much simpler ways to do that which would have saved Apple a lot of time and effort. The only reason to design a system like Apple’s is to limit knowledge in all directions as much as possible. Nobody was rightfully concerned about this, they got outraged because they would rather jump to conclusions over headlines than take the time to read about how the scheme worked.
- hamandcheese 4y ago
  The only reason to design a system like Apple’s is so that it is impossible to opt out of once it is rolled out to non-iCloud photos. iCloud photos are not e2e encrypted. If only iCloud photos were the true final target, there is absolutely no need for on-device scanning.
  - JimDabell 4y ago
    > The only reason to design a system like Apple’s is so that it is impossible to opt out of once it is rolled out to non-iCloud photos. This doesn’t make any sense because this system cannot be rolled out to non-iCloud photos. They would have to redesign how it worked. So the whole idea that Apple designed it this way for reasons that only kick in when it’s rolled out to non-iCloud photos is incoherent. If Apple were designing it for that purpose they would have picked a design that actually worked in those circumstances.
    - hamandcheese 4y ago
      What about the design makes this only possible for iCloud? The scanning occurs on device. What limits it to only iCloud photos?

acchow 4y ago

The announcement was a little confusing, but Apple said they would scan photos being sent to iCloud but the scanning would occur on device (I suppose right before uploading).