Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple enabling client-side CSAM scanning on iPhone tomorrow

twitter.com

Post reply on HN
Print view View original

201–210 of 757 posts

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#201

Post by ChrisKnott »

furi wrote: post #188
ChrisKnott wrote: post #178

Earlier quoted context omitted.

I didn't do that...? There's a small number of victims, a small number of offenders (but much more than "a handful"), and hundreds of millions of other users. This change is in the direct interest of victims, direct opposition to offenders. Most normal people probably support the measures in solidarity with group 1, HN generally doesn't.

...And direct opposition to those hundreds of millions of other users. Trying to fit this to a victims vs. offenders model is a deliberate attempt to turn those hundreds of millions of other users into uninvolved bystanders. They have been pushed out by the lack of space in the model for them and their right to not have their door kicked down based on the results of an algorithm and database they can't audit, which a…

It's in "direct" opposition to them in the same way drink driving laws are in "direct" opposition to people who have no intention of driving drunk.

It's a restriction on their liberty and privacy that they willingly support because of the overall positive effects.

Anyway I'll duck out of this now the driveby downvotes annoy me.

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#202

Post by yosito »

What happens when a theocracy demands that Apple check for hashes of images that disrespect their prophet? To me this sounds potentially more scary and distopian than surveillance in China. But if I'm honest, I don't know that China isn't scanning citizens' devices for illegal hashes.

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#203

Post by sdoering »

ChrisKnott wrote: post #140
secondo wrote: post #53

It's quite easy to extrapolate this and in a few steps end up in a boring dystopia. First it's iPhone photos, then it's all iCloud files, that spills into Macs using iCloud, then it's client side reporting of local Mac files, and somewhere along all other Apple hardware I've filled my home with have received equivalent updates and are phoning home to verify that I don't have files or whatever data they can see or hea…

> "What is the utopian perspective of this which counterbalances the risks for this to be a path worth taking?" Basically victims of rape don't want imagery of their rape freely distributed as pornography. They consider that a violation of their rights. It's interesting how many users in this thread are instinctively siding with the offenders in this, and not the victims. Presumably because they made it through their…

You are actually creating a false dichotomy here. There are more sides to this. And you are creating (as said a false) black and white image here.

I strongly believe that nobody wants to further victimize people by publicly showing images of their abuse.

And I believe very strongly that putting hundreds of millions of people under blanket general suspicion is a dangerous first step.

Imagine if every bank had to search all documents in safe deposit boxes to see if people had committed tax evasion (or stored other illegal things like blood diamonds obtained with child labor). That would be an equivalent in the physical world.

Now add to this, as discussed elsewhere here, that the database in question contains not only BIlder of victims, but also perfectly legal images. This can lead to people "winning" a house search because they have perfectly legal data stored in their cloud.

Furthermore, this means that a single country's understanding of the law is applied to a global user community. From a purely legal point of view, this is an interesting problem.

And yes: I would like to see effective measures to make the dissemination of such material more difficult. At the same time, however, I see it as difficult to use a tool for this purpose that is not subject to any control by the rule of law and cannot be checked if the worst comes to the worst.

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#204

Post by zepto »

SilverRed wrote: post #112
zepto wrote: post #99

Earlier quoted context omitted.

False positives are clearly astronomically unlikely. Not a real issue. Engineered collisions seem unlikely too. Not impossible. Unless there is a straight up cryptographic defect in the hash algorithm, it seems hard to see how engineered collisions could be made to happen at any scale.

At Apple scale, a once in a million issue is going to ruin the lives of 2000 people. A false positive here is not a mild inconvenience. It means police raiding their house, potentially damaging it, seizing all of their technology for months while it is analyzed, and leaving these people highly stressed while they try to put their lives back together. This isn't some web tech startup where a mistake means someones tsh…

> once in a million issue

Is it a once in a million issue? The collision rate matters. It could easily be much higher and then it wouldn’t matter that it was being used at Apple’s scale.

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#205

Post by aemreunal »

vincnetas wrote: post #199

This might be unpopular opinion but catching people sharing CP images is like catching end users of drugs. Yes it's illegal but the real criminals are the ones producing drugs. But it's very difficult to get to them, so you just arrest end users. Another side note is about near future when someone comes up with synthetic CP images, will they also be criminalised?

It's not just unpopular, it's also wrong: when you use drugs, you are almost entirely harming yourself (leaving aside funding all sorts of illegal activities, just focusing on the act itself). When you propagate CSAM material, you are causing psychological harm to the victims, plus can cause them to physically harm themselves or get harmed by others. So you are a criminal, harming a victim as well.

You can read about this directly from a victim via this NYT article: https://www.nytimes.com/2020/12/04/opinion/sunday/pornhub-ra...

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#206

Post by TeMPOraL »

bigiain wrote: post #30
ajsnigrutin wrote: post #20

Earlier quoted context omitted.

Or regulation saying that this is illegal, because it invades users privacy too much.

Which'd be fine if we had one global government with world wide jurisdiction. Or technology choices from companies which couldn't be pressured by governments outside your personal regulation jurisdiction. I wouldn't hold your breath waiting for those regulations to become law in, say, Chine or Turkey or Saudi Arabia. I'd bet even Israel won't pass them, surely NSO have enough political lobbying swing (and probably al…

But we don't have a global government, so the next best thing is for individual countries to pass such regulation, which would prevent products violating privacy like this from being offered and sold in those countries.

Think of GDPR, which is essentially each member of the EU saying in unison, "your product/service must comply with these data protection laws, or you can't legally do business with any of our citizens".

Come to think of it, I wonder if this Apple thing would even fly under GDPR?

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#207

Post by zepto »

pseudalopex wrote: post #128
zepto wrote: post #99

Earlier quoted context omitted.

False positives are clearly astronomically unlikely. Not a real issue. Engineered collisions seem unlikely too. Not impossible. Unless there is a straight up cryptographic defect in the hash algorithm, it seems hard to see how engineered collisions could be made to happen at any scale.

Perceptual hashes aren't cryptographic. The Twitter thread has examples of engineered collisions for a simpler perceptual hash.

So we know they are using perceptual hashing and what kind?

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#208

Post by zepto »

google234123 wrote: post #125
zepto wrote: post #21

Earlier quoted context omitted.

No, your hashes are not uploaded to the cloud, yes, hashes are downloaded to your phone. Yes, it will be interesting to see if it gets spammed with false positives, although it seems as though that can easily be identified silently to the user.

How hard would it be to create a valid image that matches some 128bit hahs

If it’s a cryptographic hash - very hard.

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#209

Post by pseudalopex »

zepto wrote: post #207
pseudalopex wrote: post #128

Earlier quoted context omitted.

Perceptual hashes aren't cryptographic. The Twitter thread has examples of engineered collisions for a simpler perceptual hash.

So we know they are using perceptual hashing and what kind?

"Hashes using a new and proprietary neural hashing algorithm Apple has developed, and gotten NCMEC to agree to use."

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#210

Post by furi »

ChrisKnott wrote: post #201
furi wrote: post #188

Earlier quoted context omitted.

...And direct opposition to those hundreds of millions of other users. Trying to fit this to a victims vs. offenders model is a deliberate attempt to turn those hundreds of millions of other users into uninvolved bystanders. They have been pushed out by the lack of space in the model for them and their right to not have their door kicked down based on the results of an algorithm and database they can't audit, which a…

It's in "direct" opposition to them in the same way drink driving laws are in "direct" opposition to people who have no intention of driving drunk. It's a restriction on their liberty and privacy that they willingly support because of the overall positive effects. Anyway I'll duck out of this now the driveby downvotes annoy me.

If drunk driving laws were enforced by mandating a breathalyzer in every car and nobody really knew how the breathalyzer worked and also it maybe doubled as an instrument for the government to catch you doing fifteen other things then I might consider that a fair comparison.

But yes, there's a lot of drive-by engagement in this thread, thank you for at least engaging with it directly.

Post reply on HN