Apple enabling client-side CSAM scanning on iPhone tomorrow • Hacker News Board

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#671

Post by GaryTang » Thu, Aug 05, 2021, 7:52 PM UTC

bississippi wrote: post #179

SilverRed wrote: post #105

Earlier quoted context omitted.

No one here has a problem with the worst criminals being taken out. The problem is the scope creep that always comes after. In 2021 and 2020 we saw people being arrested for planning/promoting anti lockdown protests. Not for actually participating but for simply posting about it. The scope of what "harmful content" is is infinite. You might agree that police do need to take action against these people but surely you…

We also saw HN shadow banning entire IP CIDR blocks because they didn’t like argument against fleeting CDC guidance that was put forth or the Chinese lab origin theory in 2020. You can’t register from these CIDR blocks. If you had an account before the comments would just end up in a black hole. Dang can explain.

@dang why?

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#672

Post by GaryTang » Thu, Aug 05, 2021, 7:53 PM UTC

ChrisKnott wrote: post #140

secondo wrote: post #53

It's quite easy to extrapolate this and in a few steps end up in a boring dystopia. First it's iPhone photos, then it's all iCloud files, that spills into Macs using iCloud, then it's client side reporting of local Mac files, and somewhere along all other Apple hardware I've filled my home with have received equivalent updates and are phoning home to verify that I don't have files or whatever data they can see or hea…

> "What is the utopian perspective of this which counterbalances the risks for this to be a path worth taking?" Basically victims of rape don't want imagery of their rape freely distributed as pornography. They consider that a violation of their rights. It's interesting how many users in this thread are instinctively siding with the offenders in this, and not the victims. Presumably because they made it through their…

What about the victims of the apple employees and government officials that exploit this?

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#673

Post by tristor » Thu, Aug 05, 2021, 8:10 PM UTC

gjulianm wrote: post #458

deathhand wrote: post #421

Earlier quoted context omitted.

Not GP but... >99% of the population will delegate the decision of what code is allowed to run to someone, be it the manufacturer, the government, some guy on the Internet or whatever. For that 99% of the population, by the way, it's actually more beneficial to have restrictions on what software can be installed to avoid malware I do not agree with this. You are saying people are too stupid to make decisions and that…

> I do not agree with this. You are saying people are too stupid to make decisions and that is amoral in my opinion. I'm not saying that at all. I'm saying that it's impossible for all people to make informed decisions on all the issues that surround them, because of both knowledge and time. And it doesn't just happen with computer and privacy, see food, for example. Do you make all decisions about what's allowed or…

> Most people have other things to do instead of learning to ensure that their devices are secure and private and then checking that for everything they get their hands on. You need regulations so that there's a consensus on what can you expect, and then enforcement so that the products you get actually comply with those regulations.

I pretty much agree with you. That said, the position that this particular issue is one in which regulations can save us is naive. The basic political reality is that the very people/organizations which are pushing for further encroachments on our rights and destruction of our privacy as people are the same people and organizations responsible for regulating the companies which offer us these services, software, and devices. When you live in a world with blatantly malicious state actors (the US Government) pressuring and demanding these encroachments as an end-run around existing regulations (the Fourth Amendment of the US Constitution), whom exactly is supposed to create and enforce these privacy regulations?

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#674

Post by James-Livesey » Thu, Aug 05, 2021, 8:20 PM UTC

LinuxBender wrote: post #548

Does this not encourage spawning a new arms race? New or modified apps that randomly change hashes of multimedia files as they are stored? If the CSAM DB is just simple hashes like sha256, md5/md4, etc.. then evading detection would be trivial. Or would Apple block applications that could rewrite randomized data into files? People don't have to be against CSAM to dislike something scanning their devices and many deve…

The hash is a pictorial representation of the image, and not quite a checksum of the raw file data (like MD5 etc.). I would expect that even photos of printed photos would still have the same pictorial hash (if the photos are properly aligned), where obviously the cryptographic hash would be much different (since it's not an exact replica of the original image) but in the ML's eyes (bearing in mind the pictorial hash is generated through machine learning afaik), there would be a very strong match between visually similar images.

I suppose that it's a bit like when you do a reverse image search on your favourite search engine. When you upload an image, the engine will try and find images that the ML thinks look the same, even if the bits and bytes that make up the file are different. From what I can see, the similarity detection will be much more specific so as to not generate false positives. As you theorise though, it might be possible to modify images to evade detection if the hash's match specificity is high enough.

All bearing in mind that the pictorial hash also is supposedly designed to be a one-way function to ensure that those who know file hashes don't know what the original contents of the file are.

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#675

Post by therealjumbo » Thu, Aug 05, 2021, 8:23 PM UTC

JKCalhoun wrote: post #580

nitrogen wrote: post #256

Earlier quoted context omitted.

Is there some way of verifying that the fingerprints in this database will never match sensitive documents on their way from a whistleblower to journalists, or anything else that isn't strictly illegal? How will this tech be repurposed over time once it's in place?

You seem to be suggesting that the AI will go directly from scanning your photos for incriminating fingerprints to reporting you to journalists. I have to assume humans are involved at some point before journalists are notified. The false-positive will be cleared up and no reputations sullied (except perhaps the reputation of using AI to scan for digital fingerprints).

>The false-positive will be cleared up and no reputations sullied...

This is dangerously naive. The US justice system alone will hound people on goosed up charges and try to get people to accept a plea deal and write a bogus confession. Parallel construction. Additionally if you can't audit the database (I'd bet very few people can, including your senator) how do you know a hash of something not CP wasn't inserted into the database. This entire system screams ready for govt overreach. It's worse than normal since there'll be no public evidence when it's abused.

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#676

Post by lijogdfljk » Thu, Aug 05, 2021, 8:29 PM UTC

wobbly_bush wrote: post #662

lijogdfljk wrote: post #551

Earlier quoted context omitted.

Fwiw, Apple's incentive seems to be hardware from the outside more than Software, imo. They tend to sell the hardware by the software for a lot of people, but given that they're so concerned with keeping their software on their hardware i suspect they don't have much reason to push their software over your software. What would concern me is if we see a big revenue stream from their software. Then i'd question them no…

This is a 2017 article[1] about how Tim Cook pushed Apple to get more revenue from software services. Recent articles this year add to say that Apple has been successful in this area. So perhaps the image of Apple being mainly a hardware company is outdated. [1] https://www.applemust.com/apples-50b-services-target-just-is...

Even more reason to avoid them i guess, if there hardware is as closed ecosystem and useless to those outside it. At least before they shipped good hardware for multiple contexts, but perhaps those days are gone.

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#677

Post by jaywalk » Thu, Aug 05, 2021, 8:51 PM UTC

oauea wrote: post #645

jaywalk wrote: post #550

Earlier quoted context omitted.

The NCMEC, who manages the CSAM database, is a private organization.

Wait, so two American companies, Apple and NCMEC, are working together to install spyware on all Apple devices world-wide, with no government involvement?

I'm sure they'd argue until they're blue in the face about how it's not spyware, but... yes.

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#678

Post by [deleted] » Thu, Aug 05, 2021, 8:57 PM UTC

atty wrote: post #619

Nullabillity wrote: post #606

Earlier quoted context omitted.

The iPhone came out 14 years ago, and still doesn't allow switching OS. What more do you need?

The iPhone and the Mac are different platforms, developed at different times, for different purposes and different markets with different design philosophies. I don’t see a logical connection between the iPhone being bootlocked and the Mac necessarily following suite.

[deleted]

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#679

Post by amelius » Thu, Aug 05, 2021, 9:02 PM UTC

williamscales wrote: post #552

hprotagonist wrote: post #549

Earlier quoted context omitted.

> Perhaps heed the warnings? And then take what actions, exactly? “Guys this is trouble” is …fine, but without “and we should therefore do”, it’s just kind of spitting into the wind.

> And then take what actions, exactly? Don’t buy or use their products.

And perhaps more importantly: don't develop for their products.

Re: Apple enabling client-side CSAM scanning on iPhone tomorrow

#680

Post by chobytes » Thu, Aug 05, 2021, 9:02 PM UTC

majjam wrote: post #232

chobytes wrote: post #157

Ive already been itching to de-cloud, and de-tech my life. If were already getting to this stage of surveillance I guess thats just another sign I should be getting on top of it. Today its csam. Tomorrow "misleading information". etc.

Im looking to do the same - this pandemic has made me feel quite claustrophobic about the encroachment of tech, and work into my personal life. Im planning on getting a dumb-ish nokia phone and leaving my smartphone at home to try and wean myself off it. What are your plans?

Similar. Ive been looking into "dumb phone" options, and moving many tasks to old school solutions. Eg desk calendars, notepads, physical books, etc.

For tech stuff I do need Id like to pick dedicated "appliance like" tools, but each of those requires some research.