4 ms·

No thank you. A lot of professionals perfectly understood the idea. What Apple came up with was essentially a "privacy preserving" backdoor; the behavior is sti

by jchw 3y ago

No thank you. A lot of professionals perfectly understood the idea. What Apple came up with was essentially a "privacy preserving" backdoor; the behavior is still fully opaque to the user and acts against their interests. In the event of a false positive, we fall all the way back to "just trust us bro" territory, which basically destroys the strong guarantees that E2EE is supposed to provide when you use it correctly. The way I see it, you either offer E2EE or you don't: if you can't accept the potential consequences, simply don't play. That having been said, given how they paraded their backdoor approach as a way to eat their cake and have it too, it's unsurprising that it attracted the attention of governments. They perhaps thought that implementing a scheme like this would put them ahead of the game, showing legislators they're self-regulating to work on these problems. In actuality, they're really just putting the future of digital privacy in dire straits. Play stupid games, win stupid prizes.

TheNewsIsHere 3y ago
> No thank you. A lot of professionals perfectly understood the idea. Fucking thank you. I have spent a lot of time in security. I spend a lot of effort on privacy. I keep abreast of the state of the art, I donate to the EFF. I spent a year auditing security at one of the largest cybersecurity firms in the Western world. I’ve read the texts, I’ve taken the classes. I’m not saying I can just do bitwise AES over plaintext in my head. But I had no issue understanding the white papers Apple released that described the feature. That didn’t convince me one iota that it was either a good nor necessary idea. It simply served to highlight the things Apple was being fairly arrogant about. And I say that as someone who daily-drives multiple Apple devices and am highly bought into the ecosystem. They built a large part of their trust model with that effort upon the idea that two governments either wouldn’t or couldn’t collude to inject non-CSAM hashes into their database. It’s like they’ve never heard the term “Five Eyes” despite harboring serious credentials and contracts in _all_ the right spaces to know exactly how possible that would be. It was a technologically clever idea, and if we lived in a “it’s this or that” world where we had to choose which technologies would be used to surveil our devices, it would be one of the best options developed to date. However I don’t accept that premise because it’s not true. Edit: typographical cleanup.
- JimDabell 3y ago
  > They built a large part of their trust model with that effort upon the idea that two governments either wouldn’t or couldn’t collude to inject non-CSAM hashes into their database. This is not correct. In the event that this happened, there would still be oversight at Apple before reporting to authorities.
  - TheNewsIsHere 3y ago
    Can you elaborate how that worked? Apple only said contemporaneously that they would refuse to include hashes that aren’t CSAM, but never went into detail on how they could actually prevent that, or refuse an order to do so. But those hashes are produced and provided to Apple (edit: well, to any consumer of the hashes) by government backed actors. (Edited to replace “government agencies” with “government backed actors”.)
    - TheNewsIsHere 3y ago
      I misread your reply, and I cannot edit the above. My misreading was that (paraphrased) “Apple could ensure the hashes they received were only for CSAM.” That isn’t what you said. You noted that (paraphrasing) “internally Apple would have some validation functionality to ensure they were not reporting non-CSAM content.” I was going to say I think your point is orthogonal, but I understand how it’s a response to what I wrote. I think we could rely on a reasonable set of people differentiating a perceptual hash of CSAM from non-CSAM content. That is no guarantee, but if their system worked as described then at some point they would be able to validate the actual stored images uploaded and know whether or not it was CSAM in an account. Just leaving here that I would counter to others that make your original point constrained to CSAM flagged content only, that: 1. Given the fact that collisions were demonstrated in public before the system was fully implemented, this failure mode had the potential to create an unknown volume of false positives that Apple would have to deal with (which would unnecessarily expose user data to Apple contractors or employees). 2. We probably don’t want to enable corporations to have this kind of power (see recent stories regarding similar false positives at Google). 3. There was proposed no detailed plans for any sort of procedures about what happened next. What happens when Apple makes a report that was “close to the line” and later found not to be CSAM? The perceptual hash concept was not without vectors for human failures. What recourse would there have been if Apple closed an account due to a false positive?
alwaysbeconsing 3y ago
iCloud storage was never E2EE; the iMessage system was, but not iCloud. As of late last year iCloud can optionally be E2EE, with the "Advanced Data Protection" feature, which is off by default (https://support.apple.com/en-us/HT212520 https://support.apple.com/en-us/HT212520).
- jchw 3y ago
  I'm pretty sure the point of the concept was to enable E2EE for iCloud storage; that's the narrative I've heard. If it's wrong, well, then it's even stranger if you ask me.
  - ls612 3y ago
    Well they went ahead and shelved the idea and then implemented E2EE for iCloud anyways with advanced data protection so idk how well that idea holds up.
JimDabell 3y ago
> A lot of professionals perfectly understood the idea. I saw very little evidence of that. Practically everybody against the idea thought the device determined what was a match and uploaded evidence to Apple. Practically everybody against the idea thought “the” hash was broken. Practically everybody against the idea confused a hash false positive with the system’s false positive. Yes, there were a few thoughtful criticisms and I would have liked to have seen more of them. But they were drowned out by abject nonsense. > given how they paraded their backdoor approach as a way to eat their cake and have it too, it's unsurprising that it attracted the attention of governments. It didn’t though? Has there been any government who wanted to take that system up? They all want something a lot more intrusive; the same kinds of things they have been asking for a long time before Apple’s proposal.
- wasimanitoba 3y ago
  > Practically everybody against the idea confused a hash false positive with the system’s false positive. Doesn't the system output the result of the hash? What is the difference?
GeekyBear 3y ago
> What Apple came up with was essentially a "privacy preserving" backdoor As opposed to Google trying to have parents arrested for seeking medical care for their children during the pandemic lockdown? > His wife called an advice nurse at their health care provider to schedule an emergency consultation for the next morning, by video because it was a Saturday and there was a pandemic going on. The nurse said to send photos so the doctor could review them in advance. With help from the photos, the doctor diagnosed the issue and prescribed antibiotics, which quickly cleared it up. Because technology companies routinely capture so much data, they have been pressured to act as sentinels, examining what passes through their servers to detect and prevent criminal behavior. Child advocates say the companies’ cooperation is essential to combat the rampant online spread of sexual abuse imagery. But it can entail peering into private archives, such as digital photo albums — an intrusion users may not expect — that has cast innocent behavior in a sinister light in at least two cases The Times has unearthed. “I knew that these companies were watching and that privacy is not what we would hope it to be,” Mark said. “But I haven’t done anything wrong.” The police agreed. Google did not. https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html https://www.nytimes.com/2022/08/21/technology/google-surveil... That's not just scanning things you upload to a public facing website, that's scanning everything on the device.
- jchw 3y ago
  > As opposed to Google... Bad start. I never mentioned Google. > ... [the remainder of the message] ... I do not understand how this is meant to weaken the case against what Apple did at all. If anything, it strengthens my resolve that tech companies should not be at liberty to even make these decisions.
  - GeekyBear 3y ago
    I do not understand how anyone can go on a rant about a system Apple discussed but never implemented while trying to handwave away the fact that Google is scanning everyone's device and turning in parents to the police over a single false positive.

by jchw 3y ago

TheNewsIsHere 3y ago

> No thank you. A lot of professionals perfectly understood the idea. Fucking thank you. I have spent a lot of time in security. I spend a lot of effort on privacy. I keep abreast of the state of the art, I donate to the EFF. I spent a year auditing security at one of the largest cybersecurity firms in the Western world. I’ve read the texts, I’ve taken the classes. I’m not saying I can just do bitwise AES over plaintext in my head. But I had no issue understanding the white papers Apple released that described the feature. That didn’t convince me one iota that it was either a good nor necessary idea. It simply served to highlight the things Apple was being fairly arrogant about. And I say that as someone who daily-drives multiple Apple devices and am highly bought into the ecosystem. They built a large part of their trust model with that effort upon the idea that two governments either wouldn’t or couldn’t collude to inject non-CSAM hashes into their database. It’s like they’ve never heard the term “Five Eyes” despite harboring serious credentials and contracts in _all_ the right spaces to know exactly how possible that would be. It was a technologically clever idea, and if we lived in a “it’s this or that” world where we had to choose which technologies would be used to surveil our devices, it would be one of the best options developed to date. However I don’t accept that premise because it’s not true. Edit: typographical cleanup.

JimDabell 3y ago
> They built a large part of their trust model with that effort upon the idea that two governments either wouldn’t or couldn’t collude to inject non-CSAM hashes into their database. This is not correct. In the event that this happened, there would still be oversight at Apple before reporting to authorities.
- TheNewsIsHere 3y ago
  Can you elaborate how that worked? Apple only said contemporaneously that they would refuse to include hashes that aren’t CSAM, but never went into detail on how they could actually prevent that, or refuse an order to do so. But those hashes are produced and provided to Apple (edit: well, to any consumer of the hashes) by government backed actors. (Edited to replace “government agencies” with “government backed actors”.)
  - TheNewsIsHere 3y ago
    I misread your reply, and I cannot edit the above. My misreading was that (paraphrased) “Apple could ensure the hashes they received were only for CSAM.” That isn’t what you said. You noted that (paraphrasing) “internally Apple would have some validation functionality to ensure they were not reporting non-CSAM content.” I was going to say I think your point is orthogonal, but I understand how it’s a response to what I wrote. I think we could rely on a reasonable set of people differentiating a perceptual hash of CSAM from non-CSAM content. That is no guarantee, but if their system worked as described then at some point they would be able to validate the actual stored images uploaded and know whether or not it was CSAM in an account. Just leaving here that I would counter to others that make your original point constrained to CSAM flagged content only, that: 1. Given the fact that collisions were demonstrated in public before the system was fully implemented, this failure mode had the potential to create an unknown volume of false positives that Apple would have to deal with (which would unnecessarily expose user data to Apple contractors or employees). 2. We probably don’t want to enable corporations to have this kind of power (see recent stories regarding similar false positives at Google). 3. There was proposed no detailed plans for any sort of procedures about what happened next. What happens when Apple makes a report that was “close to the line” and later found not to be CSAM? The perceptual hash concept was not without vectors for human failures. What recourse would there have been if Apple closed an account due to a false positive?

alwaysbeconsing 3y ago

iCloud storage was never E2EE; the iMessage system was, but not iCloud. As of late last year iCloud can optionally be E2EE, with the "Advanced Data Protection" feature, which is off by default (https://support.apple.com/en-us/HT212520 https://support.apple.com/en-us/HT212520).

jchw 3y ago
I'm pretty sure the point of the concept was to enable E2EE for iCloud storage; that's the narrative I've heard. If it's wrong, well, then it's even stranger if you ask me.
- ls612 3y ago
  Well they went ahead and shelved the idea and then implemented E2EE for iCloud anyways with advanced data protection so idk how well that idea holds up.

JimDabell 3y ago

> A lot of professionals perfectly understood the idea. I saw very little evidence of that. Practically everybody against the idea thought the device determined what was a match and uploaded evidence to Apple. Practically everybody against the idea thought “the” hash was broken. Practically everybody against the idea confused a hash false positive with the system’s false positive. Yes, there were a few thoughtful criticisms and I would have liked to have seen more of them. But they were drowned out by abject nonsense. > given how they paraded their backdoor approach as a way to eat their cake and have it too, it's unsurprising that it attracted the attention of governments. It didn’t though? Has there been any government who wanted to take that system up? They all want something a lot more intrusive; the same kinds of things they have been asking for a long time before Apple’s proposal.

wasimanitoba 3y ago
> Practically everybody against the idea confused a hash false positive with the system’s false positive. Doesn't the system output the result of the hash? What is the difference?

GeekyBear 3y ago

> What Apple came up with was essentially a "privacy preserving" backdoor As opposed to Google trying to have parents arrested for seeking medical care for their children during the pandemic lockdown? > His wife called an advice nurse at their health care provider to schedule an emergency consultation for the next morning, by video because it was a Saturday and there was a pandemic going on. The nurse said to send photos so the doctor could review them in advance. With help from the photos, the doctor diagnosed the issue and prescribed antibiotics, which quickly cleared it up. Because technology companies routinely capture so much data, they have been pressured to act as sentinels, examining what passes through their servers to detect and prevent criminal behavior. Child advocates say the companies’ cooperation is essential to combat the rampant online spread of sexual abuse imagery. But it can entail peering into private archives, such as digital photo albums — an intrusion users may not expect — that has cast innocent behavior in a sinister light in at least two cases The Times has unearthed. “I knew that these companies were watching and that privacy is not what we would hope it to be,” Mark said. “But I haven’t done anything wrong.” The police agreed. Google did not. https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html https://www.nytimes.com/2022/08/21/technology/google-surveil... That's not just scanning things you upload to a public facing website, that's scanning everything on the device.

jchw 3y ago
> As opposed to Google... Bad start. I never mentioned Google. > ... [the remainder of the message] ... I do not understand how this is meant to weaken the case against what Apple did at all. If anything, it strengthens my resolve that tech companies should not be at liberty to even make these decisions.
- GeekyBear 3y ago
  I do not understand how anyone can go on a rant about a system Apple discussed but never implemented while trying to handwave away the fact that Google is scanning everyone's device and turning in parents to the police over a single false positive.