3 ms·

How is matching images against known hashes of child porn enabling control, censorship, and data harvesting?

whatshisface 6mo ago
It is like letting a policeman into your house to make sure you are not committing crimes. The methods (installing an AI module behind your defenses against criminal hackers that is programmed to betray you) are too invasive.
- IncreasePosts 6mo ago
  Real world analogies to tech usually don't work(I would download a car), but I think in this case it would be more like you hire a servant, and that servant helps you out with whatever you ask, but if your servant sees something absolutely disgusting and illegal, they call the police and tattle on you. Or another analogy, back in the day, when nearly everyone was taking pictures with film cameras, the person doing the developing of your film would definitely call the cops on you if you had them develop child porn.
raverbashing 6mo ago
I'd give it that matching hashes is probably the least worse way of going about this Except for that pesky detail of hash collisions
eqvinox 6mo ago
> matching images against known hashes That's not how that works, last I checked. AIUI it's much more fuzzy. Has to be, being scum doesn't automatically make you an idiot, and a single bit change would make plain old hashes entirely useless. Insert your favourite dystopia to see where that ends up and how companies benefit from it.
- IncreasePosts 6mo ago
  Hash functions don't need to be bit-level sensitive. See: "perceptual hashing"
  - eqvinox 6mo ago
    I personally really prefer the "fingerprint" wording for those, but yes. The question is whether there is a workable area on the sliding scale between "too narrowly matching" and "too prone to malfunction/easy to manipulate/unpredictable". I think no, or rather, the point by which you "solve" this, it's not something you can call a "function" anymore. (e.g. heavier machine learning approaches)
exyi 6mo ago
Same tool is very handy if you hypothetically wanted to control spread of anything else, like anti ice apps for instance. Also hash matching is so easily bypassed you can be sure they really want to add some "AI" detector as well
- gruez 6mo ago
  >Same tool is very handy if you hypothetically wanted to control spread of anything else, like anti ice apps for instance. That's a weak argument because they can already do that today with google's play protect and apple's app notarization.
  - fc417fc802 6mo ago
    They already have one way of doing it therefore we should make a legal carve out to give them additional ways of doing it even though we don't want them to be able to in the first place. That doesn't make sense. It's a defeatist attitude that serves only to advantage the opponent.
- IncreasePosts 6mo ago
  How is scanning hashes of photos you upload to your cloud account going to give anyone the ability to stop you from downloading an app?
ceejayoz 6mo ago
Because at some point someone in power puts the JD Vance meme that was going around in as a hash.
- iamnothere 6mo ago
  Or leaks related to national security failures/coverups or exposing corruption. Or copyright infringement.
LunaSea 6mo ago
They are asking for the end of end-to-end encryption so client side image hashing comparison is clearly not what they want to do.
EmbarrassedHelp 6mo ago
In terms of censorship, it is impossible to confirm that every hash in the database is what the database owner claims it to be. Its also completely unacceptable for encrypted/private messages, according to some of the top experts on the subject, "Bugs in our Pockets: The Risks of Client-Side Scanning": https://arxiv.org/abs/2110.07450 https://arxiv.org/abs/2110.07450
bradley13 6mo ago
Consider false positives. Then consider that - once this technology is installed - it will be very easy to add other kinds of hashes. Add in the age verification. To make that reliable will require ID. Which can then easily be extended to provide more information than just age. Camel. Nose. Tent.

It is like letting a policeman into your house to make sure you are not committing crimes. The methods (installing an AI module behind your defenses against criminal hackers that is programmed to betray you) are too invasive.

IncreasePosts 6mo ago
Real world analogies to tech usually don't work(I would download a car), but I think in this case it would be more like you hire a servant, and that servant helps you out with whatever you ask, but if your servant sees something absolutely disgusting and illegal, they call the police and tattle on you. Or another analogy, back in the day, when nearly everyone was taking pictures with film cameras, the person doing the developing of your film would definitely call the cops on you if you had them develop child porn.

raverbashing 6mo ago

I'd give it that matching hashes is probably the least worse way of going about this Except for that pesky detail of hash collisions

eqvinox 6mo ago

> matching images against known hashes That's not how that works, last I checked. AIUI it's much more fuzzy. Has to be, being scum doesn't automatically make you an idiot, and a single bit change would make plain old hashes entirely useless. Insert your favourite dystopia to see where that ends up and how companies benefit from it.

IncreasePosts 6mo ago
Hash functions don't need to be bit-level sensitive. See: "perceptual hashing"
- eqvinox 6mo ago
  I personally really prefer the "fingerprint" wording for those, but yes. The question is whether there is a workable area on the sliding scale between "too narrowly matching" and "too prone to malfunction/easy to manipulate/unpredictable". I think no, or rather, the point by which you "solve" this, it's not something you can call a "function" anymore. (e.g. heavier machine learning approaches)

exyi 6mo ago

Same tool is very handy if you hypothetically wanted to control spread of anything else, like anti ice apps for instance. Also hash matching is so easily bypassed you can be sure they really want to add some "AI" detector as well

gruez 6mo ago
>Same tool is very handy if you hypothetically wanted to control spread of anything else, like anti ice apps for instance. That's a weak argument because they can already do that today with google's play protect and apple's app notarization.
- fc417fc802 6mo ago
  They already have one way of doing it therefore we should make a legal carve out to give them additional ways of doing it even though we don't want them to be able to in the first place. That doesn't make sense. It's a defeatist attitude that serves only to advantage the opponent.
IncreasePosts 6mo ago
How is scanning hashes of photos you upload to your cloud account going to give anyone the ability to stop you from downloading an app?

ceejayoz 6mo ago

Because at some point someone in power puts the JD Vance meme that was going around in as a hash.

iamnothere 6mo ago
Or leaks related to national security failures/coverups or exposing corruption. Or copyright infringement.

LunaSea 6mo ago

They are asking for the end of end-to-end encryption so client side image hashing comparison is clearly not what they want to do.

EmbarrassedHelp 6mo ago

In terms of censorship, it is impossible to confirm that every hash in the database is what the database owner claims it to be. Its also completely unacceptable for encrypted/private messages, according to some of the top experts on the subject, "Bugs in our Pockets: The Risks of Client-Side Scanning": https://arxiv.org/abs/2110.07450 https://arxiv.org/abs/2110.07450

bradley13 6mo ago

Consider false positives. Then consider that - once this technology is installed - it will be very easy to add other kinds of hashes. Add in the age verification. To make that reliable will require ID. Which can then easily be extended to provide more information than just age. Camel. Nose. Tent.