4 ms·

The vast majority (99%+) of iCloud Photos are not e2ee and are readable to Apple. You can rest assured that they are scanning all of it serverside for illegal

by sneak 3y ago

The vast majority (99%+) of iCloud Photos are not e2ee and are readable to Apple. You can rest assured that they are scanning all of it serverside for illegal images presently. The kerfuffle was around clientside scanning, something that it has been reported that they dropped. I have thus far seen no statements from Apple that they actually intended to stop the deployment of clientside scanning. Serverside scanning has been possible (and likely) for a long time, which illuminates their "slippery slope" argument as farce (unless they intend to force migrate everyone to e2ee storage in the future).

h1fra 3y ago
Where do you get this number?
- sneak 3y ago
  e2ee for iCloud is currently opt-in, without prompts/nudging. Most power users don't even have it turned on or are aware of its existence. The setting is buried/hidden in submenus. Approximately no one uses it. Hopefully Apple will begin promoting users to migrate in future updates.
  - 0x000042 3y ago
    > The setting is buried/hidden in submenus. Mind sharing where it is on an iPhone and Mac? I have not been able to find it.
    - smilespray 3y ago
      How to turn on Advanced Data Protection for iCloud https://support.apple.com/en-gb/HT212520 https://support.apple.com/en-gb/HT212520
    - michaelt 3y ago
      It's called "Advanced Data Protection for iCloud" It's kinda complicated to turn on, as it disables most account recovery options.
    - JTyQZSnP3cQGa8B 3y ago
      It was announced some time ago, but remember that you need modern devices on both sides to enable that feature.
  - h1fra 3y ago
    Indeed. After looking at the documentation, photos are not e2ee by default. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
  - Gigachad 3y ago
    It only just came out this year and it comes with some pretty serious UX issues around potentially getting locked out of your data.
  - yreg 3y ago
    > Most power users […] or are [not] aware of its existence. Anyone who doesn't know about this feature is not a power user in my book.
maxhille 3y ago
Apple has full control over their customers devices, so they can access all encryption keys and device local files anyway. That e2ee setting seems pretty pointless to me...
- kylehotchkiss 3y ago
  You can enable device wipe after 10 wrong passcodes, and E2EE gives Apple pretty broad cover to deny government requests to your data. The appeal to that for me isn't US government (who have easy access to everything else about you), but other governments around the world with worse human rights records. It's terrifying that while traveling a policeman could make up something and get details about your home life they aren't entitled to.
deleted 3y ago
[deleted]
shuckles 3y ago
To be clear, they positively stated that they do not perform any server side scanning when this feature was first announced.
- sneak 3y ago
  Then how would they respond to warrants asking for all user identities that upload image x? "Sorry, no"? I don't think so. If they are served a valid warrant that isn't overbroad and they have the data, they are legally compelled to provide it. Whatever they said, it was probably worded to give you this impression, without actually saying that. Apple is extremely careful and goes to great pains to actively mislead and deceive whilst avoiding actual lies. Could you please link to or quote these statements from Apple? I would bet any money they say something different than what you claim, a "not wittingly"-style hedge.
  - shuckles 3y ago
    They confirmed here: https://9to5mac.com/2021/08/23/apple-scans-icloud-mail-for-csam/ https://9to5mac.com/2021/08/23/apple-scans-icloud-mail-for-c... Apple clearly has very limited ongoing scanning because they report on the order of hundreds of instances of CSAM to NCMEC every year whereas other services with pervasive scanning report on the order of tens of millions of instances. It’s ok, you are one of the vast majority of people commenting on this topic while reasoning from false premises. > Then how would they respond to warrants asking for all user identities that upload image x? Dragnet warrants like this aren’t even legally permissible in the United States, and if they were Apple would obviously reject them. They state that they only provide specific named user account information in response to warrants.
    - sneak 3y ago
      Nothing in this article from Apple says that they don't scan iCloud Photos, and many things strongly suggest that they do. The headline says they don't scan iCloud Photos, but I don't see the statements from Apple saying that. The media often misreports on Apple's comments because Apple's expert at inducing the media to misreport in ways that are favorable to Apple.

by sneak 3y ago

h1fra 3y ago

Where do you get this number?

sneak 3y ago
e2ee for iCloud is currently opt-in, without prompts/nudging. Most power users don't even have it turned on or are aware of its existence. The setting is buried/hidden in submenus. Approximately no one uses it. Hopefully Apple will begin promoting users to migrate in future updates.
- 0x000042 3y ago
  > The setting is buried/hidden in submenus. Mind sharing where it is on an iPhone and Mac? I have not been able to find it.
  - smilespray 3y ago
    How to turn on Advanced Data Protection for iCloud https://support.apple.com/en-gb/HT212520 https://support.apple.com/en-gb/HT212520
  - michaelt 3y ago
    It's called "Advanced Data Protection for iCloud" It's kinda complicated to turn on, as it disables most account recovery options.
  - JTyQZSnP3cQGa8B 3y ago
    It was announced some time ago, but remember that you need modern devices on both sides to enable that feature.
- h1fra 3y ago
  Indeed. After looking at the documentation, photos are not e2ee by default. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- Gigachad 3y ago
  It only just came out this year and it comes with some pretty serious UX issues around potentially getting locked out of your data.
- yreg 3y ago
  > Most power users […] or are [not] aware of its existence. Anyone who doesn't know about this feature is not a power user in my book.

maxhille 3y ago

Apple has full control over their customers devices, so they can access all encryption keys and device local files anyway. That e2ee setting seems pretty pointless to me...

kylehotchkiss 3y ago
You can enable device wipe after 10 wrong passcodes, and E2EE gives Apple pretty broad cover to deny government requests to your data. The appeal to that for me isn't US government (who have easy access to everything else about you), but other governments around the world with worse human rights records. It's terrifying that while traveling a policeman could make up something and get details about your home life they aren't entitled to.

deleted 3y ago

[deleted]

shuckles 3y ago

To be clear, they positively stated that they do not perform any server side scanning when this feature was first announced.

sneak 3y ago
Then how would they respond to warrants asking for all user identities that upload image x? "Sorry, no"? I don't think so. If they are served a valid warrant that isn't overbroad and they have the data, they are legally compelled to provide it. Whatever they said, it was probably worded to give you this impression, without actually saying that. Apple is extremely careful and goes to great pains to actively mislead and deceive whilst avoiding actual lies. Could you please link to or quote these statements from Apple? I would bet any money they say something different than what you claim, a "not wittingly"-style hedge.
- shuckles 3y ago
  They confirmed here: https://9to5mac.com/2021/08/23/apple-scans-icloud-mail-for-csam/ https://9to5mac.com/2021/08/23/apple-scans-icloud-mail-for-c... Apple clearly has very limited ongoing scanning because they report on the order of hundreds of instances of CSAM to NCMEC every year whereas other services with pervasive scanning report on the order of tens of millions of instances. It’s ok, you are one of the vast majority of people commenting on this topic while reasoning from false premises. > Then how would they respond to warrants asking for all user identities that upload image x? Dragnet warrants like this aren’t even legally permissible in the United States, and if they were Apple would obviously reject them. They state that they only provide specific named user account information in response to warrants.
  - sneak 3y ago
    Nothing in this article from Apple says that they don't scan iCloud Photos, and many things strongly suggest that they do. The headline says they don't scan iCloud Photos, but I don't see the statements from Apple saying that. The media often misreports on Apple's comments because Apple's expert at inducing the media to misreport in ways that are favorable to Apple.