Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Problem with Perceptual Hashes

rentafounder.com

Post reply on HN
Print view View original

111–120 of 440 posts

Re: The Problem with Perceptual Hashes

#111

Post by runlevel1 »

emodendroket wrote: post #43
toxik wrote: post #33

Earlier quoted context omitted.

This is really a difficult problem to solve I think. However, I think most people who are prosecuted for CP distribution are hoarding it by the terabyte. It’s hard to claim that you were unaware of that. A couple of gigabytes though? Plausible. And that’s what this CSAM scanner thing is going to find on phones.

A couple gigabytes is a lot of photos... and they'd all be showing up in your camera roll. Maybe possible but stretching the bounds of plausibility.

Gigs of software updates and podcast episodes are regularly downloaded to phones without being noticed.

How frequently do most people look at their camera roll? I'd be surprised if it's more than a few times a week on average.

Does an attacker even need access to the phone? If iCloud is syncing your photos, your phone will eventually see all your pictures. Unless I've misunderstood how this works, the attacker only needs access to your iCloud account.

Re: The Problem with Perceptual Hashes

#112

Post by NoNotTheDuo »

KarlKemp wrote: post #82
yellow_lead wrote: post #61

Regarding false positives re:Apple, the Ars Technica article claims > Apple offers technical details, claims 1-in-1 trillion chance of false positives. There are two ways to read this, but I'm assuming it means, for each scan, there is a 1-in-1 trillion chance of a false positive. Apple has over 1 billion devices. Assuming ten scans per device per day, you would reach one trillion scans in ~100 days. Okay, but not al…

Do you really believe that if they scan your photo library at 10am and don't get any false positives, another scan five hours later, with no changes to the library, has the same chance of getting false positives as the first one, independent of that result?

Even if the library doesn’t change, doesn’t the possibility of the list of “bad” hashes changing exist? I.e., in your example, a new hash is added to by Apple to the list at 11:30am, and then checked against your unchanged library.

Re: The Problem with Perceptual Hashes

#113

Post by emodendroket »

mattnewton wrote: post #94
emodendroket wrote: post #34

Earlier quoted context omitted.

And what do you think the content moderation teams employed by Facebook, YouTube, et al. do all day?

There's a big difference in the expectation of privacy between what someone posts on "Facebook, Youtube, et al" and what someone takes a picture of but doesn't share.

A fair point but, again, quite aside from the concern being raised about moderators having to view potentially illegal content.

Re: The Problem with Perceptual Hashes

#114

Post by Klonoar »

mrtksn wrote: post #72

The technical challenges aside, I’m very disturbed that my device will be reporting me to the authorities. That’s very different from authorities taking a sneak peek into my stuff. That’s like the theological concept of always being watched. It starts with child pornography but the technology is indifferent towards it, it can be anything. It’s always about the children because we all want to save the children. Soon t…

I would really like people to start answering this: what exactly do you think has changed? e.g,

>That’s very different from authorities taking a sneak peek into my stuff.

To be very blunt:

- The opt out of this is to not use iCloud Photos.

- If you _currently_ use iCloud Photos, your photos are _already_ hash compared.

- Thus the existing opt out is to... not use iCloud Photos.

The exact same outcome can happen regardless of whether it's done on or off device. iCloud has _always_ been a known vector for authorities to peek.

>I’m big Apple fanboy, but I’m not going to carry a snitch in my pocket.

If you use iCloud, you arguably already do.

Re: The Problem with Perceptual Hashes

#115

Post by giantrobot »

emodendroket wrote: post #43
toxik wrote: post #33

Earlier quoted context omitted.

This is really a difficult problem to solve I think. However, I think most people who are prosecuted for CP distribution are hoarding it by the terabyte. It’s hard to claim that you were unaware of that. A couple of gigabytes though? Plausible. And that’s what this CSAM scanner thing is going to find on phones.

A couple gigabytes is a lot of photos... and they'd all be showing up in your camera roll. Maybe possible but stretching the bounds of plausibility.

The camera roll's defaults display images chronologically based on the image's timestamp. I've got thousands of photos on my phone going back years.

If you hack my phone and plant some photos with a sufficiently old timestamp I'd never notice them. I can't imagine my situation is all that uncommon either.

Re: The Problem with Perceptual Hashes

#116

Post by judge2020 »

abawany wrote: post #48
version_five wrote: post #32

Earlier quoted context omitted.

I'm not familiar with iPhone picture storage. Are the pictures automatically sync'ed with cloud storage? I would assume (even if I don't like it) that cloud providers may be scanning my data. But I would not expect anyone to be able to see or scan what is stored on my phone. Incidentally, I work in computer vision and handle proprietary images. I would be violating client agreements if I let anyone else have access t…

By default it is enabled. One has to go through Settings to turn off the default iCloud upload, afaik.

I would imagine most people do with the abysmal 5GB of storage they offer for free and how backups take up all of it.

Re: The Problem with Perceptual Hashes

#117

Post by xuki »

Klonoar wrote: post #114
mrtksn wrote: post #72

The technical challenges aside, I’m very disturbed that my device will be reporting me to the authorities. That’s very different from authorities taking a sneak peek into my stuff. That’s like the theological concept of always being watched. It starts with child pornography but the technology is indifferent towards it, it can be anything. It’s always about the children because we all want to save the children. Soon t…

I would really like people to start answering this: what exactly do you think has changed? e.g, >That’s very different from authorities taking a sneak peek into my stuff. To be very blunt: - The opt out of this is to not use iCloud Photos. - If you _currently_ use iCloud Photos, your photos are _already_ hash compared. - Thus the existing opt out is to... not use iCloud Photos. The exact same outcome can happen regar…

It makes even less sense, given that they are currently doing this with your iCloud photos. Now they have this tool that can match to a database of photos, how do we know they wouldn't use this to identify non-sexual photos? Maybe Tim Cook wouldn't, what about the next CEO? And the one after that?

Re: The Problem with Perceptual Hashes

#118

Post by pdpi »

jjtheblunt wrote: post #50
stickfigure wrote: post #10

I've also implemented perceptual hashing algorithms for use in the real world. Article is correct, there really is no way to eliminate false positives while still catching minor changes (say, resizing, cropping, or watermarking). I'm sure I'm not the only person with naked pictures of my wife. Do you really want a false positive to result in your intimate moments getting shared around some outsourced boiler room for…

Why would other people have a naked picture of your wife?

GP’s wife presumably had a personal life before being in a relationship with GP. It’s just as reasonable that her prior partners have her photos as it is for GP to have them.

Re: The Problem with Perceptual Hashes

#119

Post by coldtea »

Klonoar wrote: post #114
mrtksn wrote: post #72

The technical challenges aside, I’m very disturbed that my device will be reporting me to the authorities. That’s very different from authorities taking a sneak peek into my stuff. That’s like the theological concept of always being watched. It starts with child pornography but the technology is indifferent towards it, it can be anything. It’s always about the children because we all want to save the children. Soon t…

I would really like people to start answering this: what exactly do you think has changed? e.g, >That’s very different from authorities taking a sneak peek into my stuff. To be very blunt: - The opt out of this is to not use iCloud Photos. - If you _currently_ use iCloud Photos, your photos are _already_ hash compared. - Thus the existing opt out is to... not use iCloud Photos. The exact same outcome can happen regar…

>I would really like people to start answering this: what exactly do you think has changed? e.g,

Apple has announced they'll be doing this check?

What exactly do you think is the same as before?

>The exact same outcome can happen regardless of whether it's done on or off device. iCloud has _always_ been a known vector for authorities to peek.

That's neither here, nor there. It's another thing to peak selectively with a warrant of sorts, than to (a) peak automatically in everybody, (b) with a false-positive-prone technique, especially since the mere accusation on a false match can be disastrous for a person, even if they eventually are proven innocent...

Re: The Problem with Perceptual Hashes

#120

Post by Klonoar »

coldtea wrote: post #119
Klonoar wrote: post #114

Earlier quoted context omitted.

I would really like people to start answering this: what exactly do you think has changed? e.g, >That’s very different from authorities taking a sneak peek into my stuff. To be very blunt: - The opt out of this is to not use iCloud Photos. - If you _currently_ use iCloud Photos, your photos are _already_ hash compared. - Thus the existing opt out is to... not use iCloud Photos. The exact same outcome can happen regar…

> I would really like people to start answering this: what exactly do you think has changed? e.g, Apple has announced they'll be doing this check? What exactly do you think is the same as before? > The exact same outcome can happen regardless of whether it's done on or off device. iCloud has _always_ been a known vector for authorities to peek. That's neither here, nor there. It's another thing to peak selectively wi…

>What exactly do you think is the same as before?

The same checking when you synced things to iCloud. As has been repeated over and over again, this check happens for iCloud Photos. It's not running arbitrarily.

Your photos were compared before and they're being compared now... if you're using iCloud Photos.

Post reply on HN