cyanite

6 ms·

31.
by cyanite 5y ago
The problem is that you’d need the original NeuralHash, which isn’t stored on the device. The device only has a blinded version.
32.
by cyanite 5y ago
He is not right, though. The system used will not reveal matches to the device, only to the server and only if the threshold is reached.
33.
by cyanite 5y ago
> That's not what Apple's plans state. The comparisons are done on phone Yes but as stated in the technical description, this match is against a blinded table, so the device doesn’t learn if it’s a match or not.
34.
by cyanite 5y ago
This also means that the device doesn’t know if a given image is a match.
35.
by cyanite 5y ago
Well, the actual hash table on the device is blinded so the device doesn’t know if an image is a match or not. The server doesn’t learn the actual hash either, unless the threshold of 30 images is reached.
36.
by cyanite 5y ago
> Through iMessage, this should be possible in an unsolicited fashion Sure, but those don’t go into your photo library, so it won’t trigger any scanning. Presumably people wouldn’t actively save CSAM into their library.
37.
by cyanite 5y ago
It’s misleading to say that they scan your “drive”. They scan pictures as they are uploaded to iCloud Photo Library. Also, most other major cloud photo providers scan images server side, leading to the same effect (but with them accessing
38.
by cyanite 5y ago
> Because it's on their SERVICES, not on their user's DEVICES, for one. Effectively the same for Apple. It’s only when uploading the photo. Doing it on device means the server side gets less information.
39.
by cyanite 5y ago
But how will you do that without access to the non-blinded hash table? Then you need access to that first. Also, “sending” them to a user isn’t enough; they need to be stored in the photo library, and iCloud Photo Library needs to be enable
40.
by cyanite 5y ago
> Just insert a known CSAM image on target's device. Done. What do you mean “just”? That’s not usually very simple. It needs to go into the actual photo library. Also, you need like 30 of them inserted. > I presume this could be
41.
by cyanite 5y ago
No it’s not. The client hashes against a blinded set, and doesn’t know whether or not the hash is a hit or miss.