4 ms·

> No thank you. A lot of professionals perfectly understood the idea. Fucking thank you. I have spent a lot of time in security. I spend a lot of effort on pr

> No thank you. A lot of professionals perfectly understood the idea. Fucking thank you. I have spent a lot of time in security. I spend a lot of effort on privacy. I keep abreast of the state of the art, I donate to the EFF. I spent a year auditing security at one of the largest cybersecurity firms in the Western world. I’ve read the texts, I’ve taken the classes. I’m not saying I can just do bitwise AES over plaintext in my head. But I had no issue understanding the white papers Apple released that described the feature. That didn’t convince me one iota that it was either a good nor necessary idea. It simply served to highlight the things Apple was being fairly arrogant about. And I say that as someone who daily-drives multiple Apple devices and am highly bought into the ecosystem. They built a large part of their trust model with that effort upon the idea that two governments either wouldn’t or couldn’t collude to inject non-CSAM hashes into their database. It’s like they’ve never heard the term “Five Eyes” despite harboring serious credentials and contracts in _all_ the right spaces to know exactly how possible that would be. It was a technologically clever idea, and if we lived in a “it’s this or that” world where we had to choose which technologies would be used to surveil our devices, it would be one of the best options developed to date. However I don’t accept that premise because it’s not true. Edit: typographical cleanup.

JimDabell 3y ago
> They built a large part of their trust model with that effort upon the idea that two governments either wouldn’t or couldn’t collude to inject non-CSAM hashes into their database. This is not correct. In the event that this happened, there would still be oversight at Apple before reporting to authorities.
- TheNewsIsHere 3y ago
  Can you elaborate how that worked? Apple only said contemporaneously that they would refuse to include hashes that aren’t CSAM, but never went into detail on how they could actually prevent that, or refuse an order to do so. But those hashes are produced and provided to Apple (edit: well, to any consumer of the hashes) by government backed actors. (Edited to replace “government agencies” with “government backed actors”.)
  - TheNewsIsHere 3y ago
    I misread your reply, and I cannot edit the above. My misreading was that (paraphrased) “Apple could ensure the hashes they received were only for CSAM.” That isn’t what you said. You noted that (paraphrasing) “internally Apple would have some validation functionality to ensure they were not reporting non-CSAM content.” I was going to say I think your point is orthogonal, but I understand how it’s a response to what I wrote. I think we could rely on a reasonable set of people differentiating a perceptual hash of CSAM from non-CSAM content. That is no guarantee, but if their system worked as described then at some point they would be able to validate the actual stored images uploaded and know whether or not it was CSAM in an account. Just leaving here that I would counter to others that make your original point constrained to CSAM flagged content only, that: 1. Given the fact that collisions were demonstrated in public before the system was fully implemented, this failure mode had the potential to create an unknown volume of false positives that Apple would have to deal with (which would unnecessarily expose user data to Apple contractors or employees). 2. We probably don’t want to enable corporations to have this kind of power (see recent stories regarding similar false positives at Google). 3. There was proposed no detailed plans for any sort of procedures about what happened next. What happens when Apple makes a report that was “close to the line” and later found not to be CSAM? The perceptual hash concept was not without vectors for human failures. What recourse would there have been if Apple closed an account due to a false positive?

JimDabell 3y ago

> They built a large part of their trust model with that effort upon the idea that two governments either wouldn’t or couldn’t collude to inject non-CSAM hashes into their database. This is not correct. In the event that this happened, there would still be oversight at Apple before reporting to authorities.

TheNewsIsHere 3y ago
Can you elaborate how that worked? Apple only said contemporaneously that they would refuse to include hashes that aren’t CSAM, but never went into detail on how they could actually prevent that, or refuse an order to do so. But those hashes are produced and provided to Apple (edit: well, to any consumer of the hashes) by government backed actors. (Edited to replace “government agencies” with “government backed actors”.)
- TheNewsIsHere 3y ago
  I misread your reply, and I cannot edit the above. My misreading was that (paraphrased) “Apple could ensure the hashes they received were only for CSAM.” That isn’t what you said. You noted that (paraphrasing) “internally Apple would have some validation functionality to ensure they were not reporting non-CSAM content.” I was going to say I think your point is orthogonal, but I understand how it’s a response to what I wrote. I think we could rely on a reasonable set of people differentiating a perceptual hash of CSAM from non-CSAM content. That is no guarantee, but if their system worked as described then at some point they would be able to validate the actual stored images uploaded and know whether or not it was CSAM in an account. Just leaving here that I would counter to others that make your original point constrained to CSAM flagged content only, that: 1. Given the fact that collisions were demonstrated in public before the system was fully implemented, this failure mode had the potential to create an unknown volume of false positives that Apple would have to deal with (which would unnecessarily expose user data to Apple contractors or employees). 2. We probably don’t want to enable corporations to have this kind of power (see recent stories regarding similar false positives at Google). 3. There was proposed no detailed plans for any sort of procedures about what happened next. What happens when Apple makes a report that was “close to the line” and later found not to be CSAM? The perceptual hash concept was not without vectors for human failures. What recourse would there have been if Apple closed an account due to a false positive?