4 ms·

Essentially exactly why Apple didn't add CSAM scanning to the iPhone. They start with something everyone agrees on like protecting children until they totally

Essentially exactly why Apple didn't add CSAM scanning to the iPhone. They start with something everyone agrees on like protecting children until they totally control your device and block whatever they want.

thih9 3y ago
> until they totally control your device and block whatever they want We don’t know for sure that they would do that. We know they would like to, i.e.: that there are people that would like to use a precedent of CSAM scanning for their purposes and who count that the general public would not resist much. Perhaps that lack of resistance is part of the issue.
- candiodari 3y ago
  > We don’t know for sure that they would do that. No, they very much did that and were caught: https://www.theguardian.com/football/2019/jun/12/la-liga-fined-over-app-that-spied-on-illegal-bar-screenings-of-matches https://www.theguardian.com/football/2019/jun/12/la-liga-fin... I'm pretty sure everyone would agree this is over the line.
- vb-8448 3y ago
  > We don’t know for sure that they would do that. If they get the chance to do it, they'll do it. 100%. Guaranteed.
- daft_pink 3y ago
  most big tech companies comply with all local laws.
sneak 3y ago
> Essentially exactly why Apple didn't add CSAM scanning to the iPhone. They don't need to. iCloud uploads plaintext content hashes of all files even when e2ee is turned on. They know all of the users that have certain files, even if each and every one of those users is using the opt-in e2ee of iCloud. Normal iCloud allows Apple to scan everything serverside, natch. This is 99%+ of all iCloud users today.
- est31 3y ago
  > iCloud uploads plaintext content hashes of all files even when e2ee is turned on. Do you have a source for that claim? This is interesting.
  - rglullis 3y ago
    FYI: sneak is a security researcher himself.
  - selsta 3y ago
    Apple has a list of all metadata that uses regular encryption instead of E2EE: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
    - est31 3y ago
      I confirm there is entries mentioning "raw byte checksums". Thanks!
- nicce 3y ago
  > They don't need to. iCloud uploads plaintext content hashes of all files even when e2ee is turned on. However, regular hashes (SHA256 et al.) are too strict, and these hashes are mostly useless for this use case. The don't take variance in account what CSAM did. CSAM would have detected the image with different resolutions or slight modifications. And your Mac sends all the hashes as well, whether they are in iCloud or not.
  - akyuu 3y ago
    > And your Mac sends all the hashes as well, whether they are in iCloud or not. Could you elaborate? I didn't know Macs send local file hashes to Apple even if you don't use iCloud.
    - nicce 3y ago
      It is used to identify malicious files, in their words, on some scenarios. Gatekeeper sends all hashes of the opened executables/files. https://lapcatsoftware.com/articles/catalina-executables.html https://lapcatsoftware.com/articles/catalina-executables.htm... Also, the anti-virus sends, like Windows Defender et. all. They all do it to expand the storage of known files. > macOS includes built-in antivirus technology called XProtect for the signature-based detection and removal of malware https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web https://support.apple.com/guide/security/protecting-against-...
thefz 3y ago
> They start with something everyone agrees on like protecting children until they totally control your device and block whatever they want. https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalypse https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp... In Italy, we are pending systemic changes in work, education and health, while the government forgetful of all this is bending over backwards accommodate football clubs in finding a solution for illegal streaming of soccer matches https://www.dday.it/redazione/46954/esclusivo-come-funzionera-la-piattaforma-antipirateria-di-agcom-impossibile-sia-pronta-per-ottobre https://www.dday.it/redazione/46954/esclusivo-come-funzioner...

thih9 3y ago

> until they totally control your device and block whatever they want We don’t know for sure that they would do that. We know they would like to, i.e.: that there are people that would like to use a precedent of CSAM scanning for their purposes and who count that the general public would not resist much. Perhaps that lack of resistance is part of the issue.

candiodari 3y ago
> We don’t know for sure that they would do that. No, they very much did that and were caught: https://www.theguardian.com/football/2019/jun/12/la-liga-fined-over-app-that-spied-on-illegal-bar-screenings-of-matches https://www.theguardian.com/football/2019/jun/12/la-liga-fin... I'm pretty sure everyone would agree this is over the line.
vb-8448 3y ago
> We don’t know for sure that they would do that. If they get the chance to do it, they'll do it. 100%. Guaranteed.
daft_pink 3y ago
most big tech companies comply with all local laws.

sneak 3y ago

> Essentially exactly why Apple didn't add CSAM scanning to the iPhone. They don't need to. iCloud uploads plaintext content hashes of all files even when e2ee is turned on. They know all of the users that have certain files, even if each and every one of those users is using the opt-in e2ee of iCloud. Normal iCloud allows Apple to scan everything serverside, natch. This is 99%+ of all iCloud users today.

est31 3y ago
> iCloud uploads plaintext content hashes of all files even when e2ee is turned on. Do you have a source for that claim? This is interesting.
- rglullis 3y ago
  FYI: sneak is a security researcher himself.
- selsta 3y ago
  Apple has a list of all metadata that uses regular encryption instead of E2EE: https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
  - est31 3y ago
    I confirm there is entries mentioning "raw byte checksums". Thanks!
nicce 3y ago
> They don't need to. iCloud uploads plaintext content hashes of all files even when e2ee is turned on. However, regular hashes (SHA256 et al.) are too strict, and these hashes are mostly useless for this use case. The don't take variance in account what CSAM did. CSAM would have detected the image with different resolutions or slight modifications. And your Mac sends all the hashes as well, whether they are in iCloud or not.
- akyuu 3y ago
  > And your Mac sends all the hashes as well, whether they are in iCloud or not. Could you elaborate? I didn't know Macs send local file hashes to Apple even if you don't use iCloud.
  - nicce 3y ago
    It is used to identify malicious files, in their words, on some scenarios. Gatekeeper sends all hashes of the opened executables/files. https://lapcatsoftware.com/articles/catalina-executables.html https://lapcatsoftware.com/articles/catalina-executables.htm... Also, the anti-virus sends, like Windows Defender et. all. They all do it to expand the storage of known files. > macOS includes built-in antivirus technology called XProtect for the signature-based detection and removal of malware https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web https://support.apple.com/guide/security/protecting-against-...

thefz 3y ago

> They start with something everyone agrees on like protecting children until they totally control your device and block whatever they want. https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalypse https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp... In Italy, we are pending systemic changes in work, education and health, while the government forgetful of all this is bending over backwards accommodate football clubs in finding a solution for illegal streaming of soccer matches https://www.dday.it/redazione/46954/esclusivo-come-funzionera-la-piattaforma-antipirateria-di-agcom-impossibile-sia-pronta-per-ottobre https://www.dday.it/redazione/46954/esclusivo-come-funzioner...