6 ms·

No, it was opt-in not required by law. The system was designed to work only with images as they were being uploaded to iCloud; it didn’t work with just any imag

No, it was opt-in not required by law. The system was designed to work only with images as they were being uploaded to iCloud; it didn’t work with just any images on device. The receipt used for processing was generated as part of the upload process and neither the device nor backend could independently determine any useful information without coöperating with each other. It was a really interesting scheme that Apple clearly put a huge amount of thought into in order to maximise privacy. But people didn’t read the details and instead imagined it worked in a much simpler way, drowning out any useful conversation about what it was actually doing. The UK approach should be opposed, but I wouldn’t be opposed to the scheme Apple wanted to implement.

kevin_thibedeau 3y ago
> it didn’t work with just any images on device. Only a matter of time before an authoritarian regime forced them to expand its scope. Create a Pandora's box and it will be opened.
- JimDabell 3y ago
  An authoritarian regime can require spying regardless. This is the exact topic we are currently discussing.
  - gambiting 3y ago
    Yes, and companies like Apple(and many others) have been successful - or at least appeared to be - at denying such requests by saying that there is no technical way to break the encryption built into their devices and communication. Now, there would be a way - once it's built it's built, there is no going back.
    - JimDabell 3y ago
      > companies like Apple(and many others) have been successful - or at least appeared to be - at denying such requests by saying that there is no technical way to break the encryption built into their devices and communication. This is incorrect. Last time it went to court, Apple used very different arguments. > Now, there would be a way - once it's built it's built, there is no going back. Then why is the British government not asking for the system Apple designed? They are asking for something far more intrusive. Apple’s system is irrelevant to that.
  - smoldesu 3y ago
    You can also meaningfully resist spying by reducing the amount of sensitive user info you hold or building a transparent system. Apple has not done that, so they are now in a position where they have to reconcile what "fair data collection" even means. If you're just asking me, they bungled it. MacOS shouldn't have ever gotten stuck in the Windows 8 Software as a Service trap, because it radically redirected their trajectory from "well-made personal devices" to "golden handcuffs". Don't believe me? Just try to install a freedom-respecting OS on your iPhone. You can't. It's a goose-chase, because Apple insists they don't even make computers in the first place. It's an iPhone, running a very special superior version of UNIX you're not entirely allowed to look at, but you can trust is secure. So of course an authoritarian regime can compel spying regardless. They've probably been doing it for the past decade, given what we know about FIVE EYES and PRISM. When you're a company like Apple or Microsoft, they just update the software with the requested backdoor/vulnerability installed and push it to the closed codebase. Even Apple's proposed E2E encryption could be backdoored. Nobody would ever know the wiser. If you want the reason I'm mad, it's because it echoes the reasons I left the ecosystem with MacOS Catalina. The idea of Apple defaulting to you trusting them on so many things is kinda sickening. They've had the opportunity to build groundbreaking trustless systems with unparalleled openness and plausible deniability for all user data. Now the users are bartering for a better (but also closed) E2E system with a company that doesn't want to hear them out. It's not my jam, I'm not going to be held hostage by my computer because Apple has a fetish for making extreme decisions on the behalf of their users.
  - lost_tourist 3y ago
    Absolutely, but by normalizing scanning on local computers it takes you one step closer to authoritarianism. Every time politicians get a little more power, it only accelerates their desire for more control and inflates their sense of elitism that much more into thinking they're special and above us peasants.
- matwood 3y ago
  Don't need an authoritarian regime, just the UK government. This is exactly what Apple attempted to head off in a privacy preserving manner. At the time it was speculated (I agreed) that it was part of the lead in to full E2EE - which has happened since.
  - deleted 3y ago
    [deleted]
matthewdgreen 3y ago
It was designed to scan photos on device and upload reports as a condition of having iCloud Photos turned on. Since iCloud Photos is turned on by default on iPhones (and more or less has to be turned on if you have a photo library that’s larger than your local storage) it would have applied to the vast majority of users, even those that didn’t even realize “iCloud Photos” was a thing they cared about. Fortunately Apple has abandoned that plan and now supports full end-to-end encryption for iCloud Photos. It’s still opt-in, but hopefully that will get easier in the future.
- judge2020 3y ago
  > it would have applied to the vast majority of users, even those that didn’t even realize “iCloud Photos” was a thing they cared about. I don't buy this because everyone I know turns off iCloud Photos when it causes you to run out of your measly 5GB of free storage space, which makes the OS insistent about you fixing it to fix backups not uploading. For the people that do pay more, they keep iCloud Photos on specifically for the photo syncing aspect.
- detourdog 3y ago
  I backup my photos to my desktop computer. I would have never experienced the scanning.
  - matthewdgreen 3y ago
    I think it is fine that you opt out. But if society as a whole doesn't opt out of a surveillance regime, it still affects you as a member of society. And eventually your ability to opt out will probably be removed: after all, once you've acquiesced to the idea that private, unshared, possibly encrypted photos still need to be scanned for criminal activity -- then why should there be an exception for criminals who back up to a local computer.
    - detourdog 3y ago
      Because in the USA if we keep our secrets in our house we are protected from unreasonable search an seizure. If we share our secrets with a third party the third party is free to share them. This seems like such a clear line of distinction that a layperson could understand.
jchw 3y ago
No thank you. A lot of professionals perfectly understood the idea. What Apple came up with was essentially a "privacy preserving" backdoor; the behavior is still fully opaque to the user and acts against their interests. In the event of a false positive, we fall all the way back to "just trust us bro" territory, which basically destroys the strong guarantees that E2EE is supposed to provide when you use it correctly. The way I see it, you either offer E2EE or you don't: if you can't accept the potential consequences, simply don't play. That having been said, given how they paraded their backdoor approach as a way to eat their cake and have it too, it's unsurprising that it attracted the attention of governments. They perhaps thought that implementing a scheme like this would put them ahead of the game, showing legislators they're self-regulating to work on these problems. In actuality, they're really just putting the future of digital privacy in dire straits. Play stupid games, win stupid prizes.
- TheNewsIsHere 3y ago
  > No thank you. A lot of professionals perfectly understood the idea. Fucking thank you. I have spent a lot of time in security. I spend a lot of effort on privacy. I keep abreast of the state of the art, I donate to the EFF. I spent a year auditing security at one of the largest cybersecurity firms in the Western world. I’ve read the texts, I’ve taken the classes. I’m not saying I can just do bitwise AES over plaintext in my head. But I had no issue understanding the white papers Apple released that described the feature. That didn’t convince me one iota that it was either a good nor necessary idea. It simply served to highlight the things Apple was being fairly arrogant about. And I say that as someone who daily-drives multiple Apple devices and am highly bought into the ecosystem. They built a large part of their trust model with that effort upon the idea that two governments either wouldn’t or couldn’t collude to inject non-CSAM hashes into their database. It’s like they’ve never heard the term “Five Eyes” despite harboring serious credentials and contracts in _all_ the right spaces to know exactly how possible that would be. It was a technologically clever idea, and if we lived in a “it’s this or that” world where we had to choose which technologies would be used to surveil our devices, it would be one of the best options developed to date. However I don’t accept that premise because it’s not true. Edit: typographical cleanup.
gambiting 3y ago
>>It was a really interesting scheme that Apple clearly put a huge amount of thought into in order to maximise privacy. No. They appeared to put in this effort, but at the end of the day they built a system which could be used for scanning any file on your device for any reason, saying "oh it's only for files uploaded to icloud" was obviously the first step. And then of course the fact that if anything was deemed innapropriate it would have been submitted to their own verification centre where someone would actually physically look at your pictures and then forward them to law enforcement, without you being notified that this has happened in any way - that doesn't sound like maximising privacy to me. >>but I wouldn’t be opposed to the scheme Apple wanted to implement. I would. It was a horrendous implementation and any on-device scanning should always be opposed to the maximum extent that you can bare.
- zimpenfish 3y ago
  > at the end of the day they built a system which could be used for scanning any file on your device They could already be doing this though, right? Unless some trustworthy external auditor has gone through the iOS/macOS/iPadOS source and audited that they don't (good luck with that.)
  - gambiting 3y ago
    Of course - but Apple isn't going to produce a custom iOS build to find pictures of dissidents for a dictator(at least I find that unlikely), but if it's a system that everyone knows exists but verifies your pictures against some closed, uninspectable and constantly updated database of hashes......what's the harm of sneaking few more hashes in, right?
- JimDabell 3y ago
  > No. They appeared to put in this effort To be clear – you are saying this was an easy thing for Apple to construct? > but at the end of the day they built a system which could be used for scanning any file on your device for any reason This is factually untrue and also not in contrast to the amount of effort they put in. > And then of course the fact that if anything was deemed innapropriate it would have been submitted to their own verification centre where someone would actually physically look at your pictures and then forward them to law enforcement This is also factually incorrect. Did you read the technical documentation Apple published?
JohnFen 3y ago
> But people didn’t read the details and instead imagined it worked in a much simpler way, drowning out any useful conversation about what it was actually doing. I read the details. I think I understood it perfectly well. I found it very objectionable.
- JimDabell 3y ago
  Great! It’s a shame voices of people like you were next to impossible to find amongst the ignorance. I think there’s a strong argument for and a strong argument against the system Apple designed. I wanted that discussion to be had instead of it all being washed away with knee-jerk ignorance.
  - JohnFen 3y ago
    I found quite a lot of intelligent debate about this. Not in the popular media, of course, but that's to be expected.
  - lost_tourist 3y ago
    I was here for the discussions on hacker news, and it seemed to me like most people knew basically how it worked. A lot of people on here defending the authorities and clutching pearls about “think of the children” telling us we didn't understand and when we presented them with evidence that we did in fact know how it worked they would go radio silent.
refulgentis 3y ago
> "Didn't Apple recommend on-device scanning recently?" > "No, it was opt-in not required by law." Your comment indicates the answer is yes. Trying to figure out where the gap may be...my guess is the view objections come from "people [who] didn’t read." I found the other replies powerful evidence that other people did read, and had nuanced thoughts on this matter.
- JimDabell 3y ago
  The delta is that the “on-device scanning” proposed by the British government and the “on-device scanning” proposed by Apple are very different in meaningful ways.
GeekyBear 3y ago
> The system was designed to work only with images as they were being uploaded to iCloud Not iCloud, since that would imply it was scanning entire device backups stored in iCloud. It was intended to scan just the photos that you uploaded to their publicly accessible Photo sharing website, iCloud Photos, in a way that even Apple wouldn't have access to the results unless you uploaded more than 100 photos that matched known kiddie porn.
- pseudalopex 3y ago
  iCloud Photos is part of iCloud. iCloud backups are not end to end encrypted by default. The option did not exist then. They claimed 30 not 100 photos. It could change at any time. The claim could not be audited. The databases are known to contain false positives. They could not be audited.
  - GeekyBear 3y ago
    > iCloud Photos is part of iCloud iCloud Photos is a photo sharing website accessible to the public, like Flickr. It has nothing to do with device backup.
    - pseudalopex 3y ago
      iCloud Photos includes syncing between your own devices and sharing with others. iCloud Backup is a separate feature. Both are parts of iCloud.
      - GeekyBear 3y ago
        Apple only discussed scanning images that would be uploaded to the photo sharing website.
        pseudalopex 3y ago
        Apple documentation said photos stored in iCloud. Synced photos are stored in iCloud. And they told people to turn off iCloud Photos to avoid it. Not not share.
lost_tourist 3y ago
I read the details. It normalized letting corporations scan and police my computer without a search warrant. I didn't like that and I complained. If they want to scan my data on iCloud, then fine, and good luck since there is a layer of heavy encryption there before it's backed up there. Normalizing scanning of local devices is a big no-no in my opinion and the opinions of lots of others. Yeah we read the white papers and know exactly how it works, if not how every bit and byte is juggled.

kevin_thibedeau 3y ago

> it didn’t work with just any images on device. Only a matter of time before an authoritarian regime forced them to expand its scope. Create a Pandora's box and it will be opened.

JimDabell 3y ago
An authoritarian regime can require spying regardless. This is the exact topic we are currently discussing.
- gambiting 3y ago
  Yes, and companies like Apple(and many others) have been successful - or at least appeared to be - at denying such requests by saying that there is no technical way to break the encryption built into their devices and communication. Now, there would be a way - once it's built it's built, there is no going back.
  - JimDabell 3y ago
    > companies like Apple(and many others) have been successful - or at least appeared to be - at denying such requests by saying that there is no technical way to break the encryption built into their devices and communication. This is incorrect. Last time it went to court, Apple used very different arguments. > Now, there would be a way - once it's built it's built, there is no going back. Then why is the British government not asking for the system Apple designed? They are asking for something far more intrusive. Apple’s system is irrelevant to that.
- smoldesu 3y ago
  You can also meaningfully resist spying by reducing the amount of sensitive user info you hold or building a transparent system. Apple has not done that, so they are now in a position where they have to reconcile what "fair data collection" even means. If you're just asking me, they bungled it. MacOS shouldn't have ever gotten stuck in the Windows 8 Software as a Service trap, because it radically redirected their trajectory from "well-made personal devices" to "golden handcuffs". Don't believe me? Just try to install a freedom-respecting OS on your iPhone. You can't. It's a goose-chase, because Apple insists they don't even make computers in the first place. It's an iPhone, running a very special superior version of UNIX you're not entirely allowed to look at, but you can trust is secure. So of course an authoritarian regime can compel spying regardless. They've probably been doing it for the past decade, given what we know about FIVE EYES and PRISM. When you're a company like Apple or Microsoft, they just update the software with the requested backdoor/vulnerability installed and push it to the closed codebase. Even Apple's proposed E2E encryption could be backdoored. Nobody would ever know the wiser. If you want the reason I'm mad, it's because it echoes the reasons I left the ecosystem with MacOS Catalina. The idea of Apple defaulting to you trusting them on so many things is kinda sickening. They've had the opportunity to build groundbreaking trustless systems with unparalleled openness and plausible deniability for all user data. Now the users are bartering for a better (but also closed) E2E system with a company that doesn't want to hear them out. It's not my jam, I'm not going to be held hostage by my computer because Apple has a fetish for making extreme decisions on the behalf of their users.
- lost_tourist 3y ago
  Absolutely, but by normalizing scanning on local computers it takes you one step closer to authoritarianism. Every time politicians get a little more power, it only accelerates their desire for more control and inflates their sense of elitism that much more into thinking they're special and above us peasants.
matwood 3y ago
Don't need an authoritarian regime, just the UK government. This is exactly what Apple attempted to head off in a privacy preserving manner. At the time it was speculated (I agreed) that it was part of the lead in to full E2EE - which has happened since.
- deleted 3y ago
  [deleted]

matthewdgreen 3y ago

It was designed to scan photos on device and upload reports as a condition of having iCloud Photos turned on. Since iCloud Photos is turned on by default on iPhones (and more or less has to be turned on if you have a photo library that’s larger than your local storage) it would have applied to the vast majority of users, even those that didn’t even realize “iCloud Photos” was a thing they cared about. Fortunately Apple has abandoned that plan and now supports full end-to-end encryption for iCloud Photos. It’s still opt-in, but hopefully that will get easier in the future.

judge2020 3y ago
> it would have applied to the vast majority of users, even those that didn’t even realize “iCloud Photos” was a thing they cared about. I don't buy this because everyone I know turns off iCloud Photos when it causes you to run out of your measly 5GB of free storage space, which makes the OS insistent about you fixing it to fix backups not uploading. For the people that do pay more, they keep iCloud Photos on specifically for the photo syncing aspect.
detourdog 3y ago
I backup my photos to my desktop computer. I would have never experienced the scanning.
- matthewdgreen 3y ago
  I think it is fine that you opt out. But if society as a whole doesn't opt out of a surveillance regime, it still affects you as a member of society. And eventually your ability to opt out will probably be removed: after all, once you've acquiesced to the idea that private, unshared, possibly encrypted photos still need to be scanned for criminal activity -- then why should there be an exception for criminals who back up to a local computer.
  - detourdog 3y ago
    Because in the USA if we keep our secrets in our house we are protected from unreasonable search an seizure. If we share our secrets with a third party the third party is free to share them. This seems like such a clear line of distinction that a layperson could understand.

jchw 3y ago

No thank you. A lot of professionals perfectly understood the idea. What Apple came up with was essentially a "privacy preserving" backdoor; the behavior is still fully opaque to the user and acts against their interests. In the event of a false positive, we fall all the way back to "just trust us bro" territory, which basically destroys the strong guarantees that E2EE is supposed to provide when you use it correctly. The way I see it, you either offer E2EE or you don't: if you can't accept the potential consequences, simply don't play. That having been said, given how they paraded their backdoor approach as a way to eat their cake and have it too, it's unsurprising that it attracted the attention of governments. They perhaps thought that implementing a scheme like this would put them ahead of the game, showing legislators they're self-regulating to work on these problems. In actuality, they're really just putting the future of digital privacy in dire straits. Play stupid games, win stupid prizes.

TheNewsIsHere 3y ago
> No thank you. A lot of professionals perfectly understood the idea. Fucking thank you. I have spent a lot of time in security. I spend a lot of effort on privacy. I keep abreast of the state of the art, I donate to the EFF. I spent a year auditing security at one of the largest cybersecurity firms in the Western world. I’ve read the texts, I’ve taken the classes. I’m not saying I can just do bitwise AES over plaintext in my head. But I had no issue understanding the white papers Apple released that described the feature. That didn’t convince me one iota that it was either a good nor necessary idea. It simply served to highlight the things Apple was being fairly arrogant about. And I say that as someone who daily-drives multiple Apple devices and am highly bought into the ecosystem. They built a large part of their trust model with that effort upon the idea that two governments either wouldn’t or couldn’t collude to inject non-CSAM hashes into their database. It’s like they’ve never heard the term “Five Eyes” despite harboring serious credentials and contracts in _all_ the right spaces to know exactly how possible that would be. It was a technologically clever idea, and if we lived in a “it’s this or that” world where we had to choose which technologies would be used to surveil our devices, it would be one of the best options developed to date. However I don’t accept that premise because it’s not true. Edit: typographical cleanup.

gambiting 3y ago

>>It was a really interesting scheme that Apple clearly put a huge amount of thought into in order to maximise privacy. No. They appeared to put in this effort, but at the end of the day they built a system which could be used for scanning any file on your device for any reason, saying "oh it's only for files uploaded to icloud" was obviously the first step. And then of course the fact that if anything was deemed innapropriate it would have been submitted to their own verification centre where someone would actually physically look at your pictures and then forward them to law enforcement, without you being notified that this has happened in any way - that doesn't sound like maximising privacy to me. >>but I wouldn’t be opposed to the scheme Apple wanted to implement. I would. It was a horrendous implementation and any on-device scanning should always be opposed to the maximum extent that you can bare.

zimpenfish 3y ago
> at the end of the day they built a system which could be used for scanning any file on your device They could already be doing this though, right? Unless some trustworthy external auditor has gone through the iOS/macOS/iPadOS source and audited that they don't (good luck with that.)
- gambiting 3y ago
  Of course - but Apple isn't going to produce a custom iOS build to find pictures of dissidents for a dictator(at least I find that unlikely), but if it's a system that everyone knows exists but verifies your pictures against some closed, uninspectable and constantly updated database of hashes......what's the harm of sneaking few more hashes in, right?
JimDabell 3y ago
> No. They appeared to put in this effort To be clear – you are saying this was an easy thing for Apple to construct? > but at the end of the day they built a system which could be used for scanning any file on your device for any reason This is factually untrue and also not in contrast to the amount of effort they put in. > And then of course the fact that if anything was deemed innapropriate it would have been submitted to their own verification centre where someone would actually physically look at your pictures and then forward them to law enforcement This is also factually incorrect. Did you read the technical documentation Apple published?

JohnFen 3y ago

> But people didn’t read the details and instead imagined it worked in a much simpler way, drowning out any useful conversation about what it was actually doing. I read the details. I think I understood it perfectly well. I found it very objectionable.

JimDabell 3y ago
Great! It’s a shame voices of people like you were next to impossible to find amongst the ignorance. I think there’s a strong argument for and a strong argument against the system Apple designed. I wanted that discussion to be had instead of it all being washed away with knee-jerk ignorance.
- JohnFen 3y ago
  I found quite a lot of intelligent debate about this. Not in the popular media, of course, but that's to be expected.
- lost_tourist 3y ago
  I was here for the discussions on hacker news, and it seemed to me like most people knew basically how it worked. A lot of people on here defending the authorities and clutching pearls about “think of the children” telling us we didn't understand and when we presented them with evidence that we did in fact know how it worked they would go radio silent.

refulgentis 3y ago

> "Didn't Apple recommend on-device scanning recently?" > "No, it was opt-in not required by law." Your comment indicates the answer is yes. Trying to figure out where the gap may be...my guess is the view objections come from "people [who] didn’t read." I found the other replies powerful evidence that other people did read, and had nuanced thoughts on this matter.

JimDabell 3y ago
The delta is that the “on-device scanning” proposed by the British government and the “on-device scanning” proposed by Apple are very different in meaningful ways.

GeekyBear 3y ago

> The system was designed to work only with images as they were being uploaded to iCloud Not iCloud, since that would imply it was scanning entire device backups stored in iCloud. It was intended to scan just the photos that you uploaded to their publicly accessible Photo sharing website, iCloud Photos, in a way that even Apple wouldn't have access to the results unless you uploaded more than 100 photos that matched known kiddie porn.

pseudalopex 3y ago
iCloud Photos is part of iCloud. iCloud backups are not end to end encrypted by default. The option did not exist then. They claimed 30 not 100 photos. It could change at any time. The claim could not be audited. The databases are known to contain false positives. They could not be audited.
- GeekyBear 3y ago
  > iCloud Photos is part of iCloud iCloud Photos is a photo sharing website accessible to the public, like Flickr. It has nothing to do with device backup.
  - pseudalopex 3y ago
    iCloud Photos includes syncing between your own devices and sharing with others. iCloud Backup is a separate feature. Both are parts of iCloud.
    - GeekyBear 3y ago
      Apple only discussed scanning images that would be uploaded to the photo sharing website.
      - pseudalopex 3y ago
        Apple documentation said photos stored in iCloud. Synced photos are stored in iCloud. And they told people to turn off iCloud Photos to avoid it. Not not share.

lost_tourist 3y ago

I read the details. It normalized letting corporations scan and police my computer without a search warrant. I didn't like that and I complained. If they want to scan my data on iCloud, then fine, and good luck since there is a layer of heavy encryption there before it's backed up there. Normalizing scanning of local devices is a big no-no in my opinion and the opinions of lots of others. Yeah we read the white papers and know exactly how it works, if not how every bit and byte is juggled.