Apple enabling client-side CSAM scanning on iPhone tomorrow

Post by gjulianm » Thu, Aug 05, 2021, 3:09 PM UTC

emptysongglass wrote: post #575

snarf21 wrote: post #500

Earlier quoted context omitted.

Great, so what's the solution? What are you doing to fix it? Do you roll your own silicon? Do you grow your own food (we have no idea what someone could be putting in it)? Are you completely off-grid? Or are you as completely dependent on society writ large as everyone else? Making holier than thou comments about everyone else being sheep isn't helpful or thought provoking. Offer an alternative if it is a bad one (lo…

Dumping Facebook and its products as I and others have done is one strong step forward but people can't even manage this. It's deeply disappointing. Techno bears its seeds in rebellion but everybody throwing techno parties is coordinating on what is essentially an Orwellian state. Punks too, they're cozied up to this framework of oppression and can't see it for what it is. I think people have a hard time seeing the e…

Post by shuckles » Thu, Aug 05, 2021, 3:11 PM UTC

AlexandrB wrote: post #493

neycoda wrote: post #486

Earlier quoted context omitted.

I'm OK with software generating signatures from cloud drive images to eliminate child porn pictures and catch pedophiles.

You should read the rest of the linked Twitter thread, because the issue is that if the hash algorithm has a collision vulnerability, any image could be manipulated to show up as "child porn" to the scanner.

Post by hda2 » Thu, Aug 05, 2021, 3:12 PM UTC

bigiain wrote: post #27

ajsnigrutin wrote: post #3

So if I understand correctly, they want to scan all your photos, stored on your private phone, that you paid for, and they want to check if any of the hashes are the same as hashes of child porn? So... all your hashes will be uploaded to the cloud? How do you prevent them from scanning other stuff (memes, leaked documents, trump-fights-cnn-gif,... to profile the users)? Or will a huge hash database of child porn hash…

> and they want to check if any of the hashes are the same as hashes of child porn? ... without any technical guarantee or auditability that any of the hashes they're alerting on are actually of child porn. How much would you bet against law enforcement to abuse their ability to use this, and add hashes to find out who's got anti government memes or police committing murder images on their phones? And that's just in…

Post by zepto » Thu, Aug 05, 2021, 3:16 PM UTC

saagarjha wrote: post #541

toxik wrote: post #275

Earlier quoted context omitted.

If the details of the "hashing" scheme used is publicized, I imagine it will be near trivial. It's a long-standing problem in computer vision, to find a digital description of an image such that two similar images compare equal or at least similar. State-of-the-art for this field is deep learning, and a /huge/ problem with the DL approach is that you can generate adversarial examples. So for example, a picture of a t…

Since this algorithm presumably runs on-device, I am sure it won’t be long before someone has reverse engineered it…

Post by shuckles » Thu, Aug 05, 2021, 3:19 PM UTC

SilverRed wrote: post #106

onetimeusename wrote: post #71

Earlier quoted context omitted.

I agree, I would add that people have generated legal images that match the hashes. So I want to ask what happens if you have a photo that is falsely identified as one in question and then an automated mechanism flags you and reports you to the FBI without you even knowing. Can they access your phone at that point to investigate? Would they come to your office and ask about it? Would that be enough evidence to reques…

>I would add that people have generated legal images that match the hashes. That seems like a realistic attack. Since the hash list is public (has to be for client side scanning), you could likely set your computer to grind out a matching image hash but of some meme which you then distribute.