3 ms·

It's interesting that this announcement was being predicted after Apple unveiled their on-device CSAM scanning feature. Perhaps this was indeed the plan all alo

It's interesting that this announcement was being predicted after Apple unveiled their on-device CSAM scanning feature. Perhaps this was indeed the plan all along, but they lost control of the narrative. Whatever did happen to the on-device CSAM scanning? Is it still coming to iOS?

loaph 4y ago
According to https://arstechnica.com/gadgets/2022/12/apple-adds-end-to-end-encryption-to-icloud-device-backups-and-more/ https://arstechnica.com/gadgets/2022/12/apple-adds-end-to-en... the CSAM scanning plans have been abandoned.
- AlexandrB 4y ago
  Another interesting tidbit from that article: > First, iCloud users may now take advantage of hardware security keys like YubiKeys. Both NFC keys and plug-in keys are supported. This is great news! I wonder if this is able to replace Apple's bespoke 2FA system or it's strictly in addition to that. Edit: From Apple's announcement: > Now with Security Keys, users will have the choice to make use of third-party hardware security keys to enhance this protection. This feature is designed for users who, often due to their public profile, face concerted threats to their online accounts, such as celebrities, journalists, and members of government. For users who opt in, Security Keys strengthens Apple’s two-factor authentication by requiring a hardware security key as one of the two factors. If I read that right, it sounds like it's in addition to Apple's 2FA? I'd love to replace Apple's weird 2FA mechanisms, but this is still nice.
  - drak0n1c 4y ago
    Here’s more info directly from Apple on their hardware key plans: https://www.apple.com/newsroom/2022/12/apple-advances-user-security-with-powerful-new-data-protections/ https://www.apple.com/newsroom/2022/12/apple-advances-user-s...
- sneak 4y ago
  Nothing Apple has ever said has indicated that they reversed position on their announced plan to roll out clientside scanning. Read the Apple statements carefully. On macOS photoanalysisd phones home even when not using iCloud at all, fwiw. Who knows what it is doing?
  - jaywalk 4y ago
    This is correct. Apple said they've abandoned CSAM scanning for iCloud Photos, but they haven't said anything about on-device scanning as far as I've seen.
deleted 4y ago
[deleted]
yamtaddle 4y ago
That always made the most sense as the reason for attempting that. I agree with some concerns about it surely being abused (especially in some jurisdictions) but on the other hand they can ship whatever software they want to the devices anyway so the idea that this was some sly way to sneak in spying that they couldn't otherwise get away with made no sense. Doing it out of a desire to enable more encryption without instantly becoming the overwhelmingly-preferred platform for child porn enthusiasts was a far more likely explanation. Curious what they're going to do to mitigate that repetitional risk now. Possibly they'll just eat it and say, "look, this is what you fuckers wanted, we tried to solve the problem but you said no." Not thrilled to see what the next showdown between them and e.g. the FBI is gonna look like. I expect it's not gonna look good in the court of public opinion and that might have unfortunate legislative consequences. [EDIT] Actually, wouldn't be surprised if they wait until the first high-profile case involving their inability to deliver data on someone who probably is a disgusting scumbag, and use that as cover to go ahead with the local-CSAM-scanning-for-iCloud-uploads, once it's 100% clear what'll happen if they don't and the no-scanning crowd isn't the loudest set of voices anymore.
yreg 4y ago
When they announced the on-device CSAM, I was absolutely sure that they want to do this. Lawfully nothing is stopping them, but since pretty much all US cloud services scan files it's clear there are some forces making them to do so. I thought that Apple was able to negotiate a compromise where they scan locally and then they are "allowed" to to E2EE. Interesting that they proceeding with the encryption regardless.

loaph 4y ago

According to https://arstechnica.com/gadgets/2022/12/apple-adds-end-to-end-encryption-to-icloud-device-backups-and-more/ https://arstechnica.com/gadgets/2022/12/apple-adds-end-to-en... the CSAM scanning plans have been abandoned.

AlexandrB 4y ago
Another interesting tidbit from that article: > First, iCloud users may now take advantage of hardware security keys like YubiKeys. Both NFC keys and plug-in keys are supported. This is great news! I wonder if this is able to replace Apple's bespoke 2FA system or it's strictly in addition to that. Edit: From Apple's announcement: > Now with Security Keys, users will have the choice to make use of third-party hardware security keys to enhance this protection. This feature is designed for users who, often due to their public profile, face concerted threats to their online accounts, such as celebrities, journalists, and members of government. For users who opt in, Security Keys strengthens Apple’s two-factor authentication by requiring a hardware security key as one of the two factors. If I read that right, it sounds like it's in addition to Apple's 2FA? I'd love to replace Apple's weird 2FA mechanisms, but this is still nice.
- drak0n1c 4y ago
  Here’s more info directly from Apple on their hardware key plans: https://www.apple.com/newsroom/2022/12/apple-advances-user-security-with-powerful-new-data-protections/ https://www.apple.com/newsroom/2022/12/apple-advances-user-s...
sneak 4y ago
Nothing Apple has ever said has indicated that they reversed position on their announced plan to roll out clientside scanning. Read the Apple statements carefully. On macOS photoanalysisd phones home even when not using iCloud at all, fwiw. Who knows what it is doing?
- jaywalk 4y ago
  This is correct. Apple said they've abandoned CSAM scanning for iCloud Photos, but they haven't said anything about on-device scanning as far as I've seen.

deleted 4y ago

[deleted]

yamtaddle 4y ago

That always made the most sense as the reason for attempting that. I agree with some concerns about it surely being abused (especially in some jurisdictions) but on the other hand they can ship whatever software they want to the devices anyway so the idea that this was some sly way to sneak in spying that they couldn't otherwise get away with made no sense. Doing it out of a desire to enable more encryption without instantly becoming the overwhelmingly-preferred platform for child porn enthusiasts was a far more likely explanation. Curious what they're going to do to mitigate that repetitional risk now. Possibly they'll just eat it and say, "look, this is what you fuckers wanted, we tried to solve the problem but you said no." Not thrilled to see what the next showdown between them and e.g. the FBI is gonna look like. I expect it's not gonna look good in the court of public opinion and that might have unfortunate legislative consequences. [EDIT] Actually, wouldn't be surprised if they wait until the first high-profile case involving their inability to deliver data on someone who probably is a disgusting scumbag, and use that as cover to go ahead with the local-CSAM-scanning-for-iCloud-uploads, once it's 100% clear what'll happen if they don't and the no-scanning crowd isn't the loudest set of voices anymore.

yreg 4y ago

When they announced the on-device CSAM, I was absolutely sure that they want to do this. Lawfully nothing is stopping them, but since pretty much all US cloud services scan files it's clear there are some forces making them to do so. I thought that Apple was able to negotiate a compromise where they scan locally and then they are "allowed" to to E2EE. Interesting that they proceeding with the encryption regardless.