Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

crypto.stackexchange.com

Post reply on HN
Print view View original

31–40 of 86 posts

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#31

Post by foerbert »

jl6 wrote: post #27

For some reason, after reading the initial reporting on this system, I thought it was running against any photos on your iPhone, but now I read the actual paper, it seems like it only applies to photos destined to be uploaded to iCloud? So users can opt out by not using iCloud?

Much of the discussion is about how trivial it would be for Apple to start scanning any photos on the phone at a later date.

Right now they are able to bill this as doing what they currently do server side, but client side. Later, they can say they are simply applying the same "protections" to all photos instead of merely the ones being uploaded to iCloud.

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#32

Post by myspy »

dannyw wrote: post #20
starwatch wrote: post #19

Earlier quoted context omitted.

Last year Sam Harris interviewed Gabriel J.X. Dance, the deputy investigations editor at The New York Times [0]. They speak to this. It's a tough episode to listen to - they cover many uncomfortable topics along this theme. From what I recall of the episode, porn (rightly or wrongly) is seen as opt-in for the participants. But if children are involved it cannot be opt-in and is more appropriately described as rape or…

Depends on age and context doesn't it? Is a 17 year old snapchatting their private parts to her 17 year old boyfriend CSAM? Should both parties be imprisoned and go on sex offenders registries for life?

According to Grubers analysis it compares the csam pictures against the library. Your 17 year old is not part of that database. Hence no hash matches.

CSAM provides a library with hashes that are compared against the photos on the phone.

The real problem comes when governments make laws that open the mechanism to different libraries of photos.

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#33

Post by jobigoud »

shakna wrote: post #10
Teever wrote: post #7

Earlier quoted context omitted.

What is the difference between CP and CSAM and why is everyone suddenly using the term CSAM instead of CP?

CSAM is not necessarily pornographic material, but merely material that becomes objectionable within context. For example, parents' photos of kids in the bath isn't CP. However _someone else_ having a _quantity_ of bath photos is CSAM, if they have no reasonable reason for possessing them.

In this case the change of acronym to stress the abuse vs pornography part is completely backward.

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#34

Post by tandav »

jl6 wrote: post #27

For some reason, after reading the initial reporting on this system, I thought it was running against any photos on your iPhone, but now I read the actual paper, it seems like it only applies to photos destined to be uploaded to iCloud? So users can opt out by not using iCloud?

Friendly reminder: until ios source code is closed all privacy claims is only backed by trust. They easily can do whatever they want if you're not compiling from source.

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#35

Post by [deleted] »

shakna wrote: post #10
Teever wrote: post #7

Earlier quoted context omitted.

What is the difference between CP and CSAM and why is everyone suddenly using the term CSAM instead of CP?

CSAM is not necessarily pornographic material, but merely material that becomes objectionable within context. For example, parents' photos of kids in the bath isn't CP. However _someone else_ having a _quantity_ of bath photos is CSAM, if they have no reasonable reason for possessing them.

[deleted]

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#36

Post by dannyw »

myspy wrote: post #32
dannyw wrote: post #20

Earlier quoted context omitted.

Depends on age and context doesn't it? Is a 17 year old snapchatting their private parts to her 17 year old boyfriend CSAM? Should both parties be imprisoned and go on sex offenders registries for life?

According to Grubers analysis it compares the csam pictures against the library. Your 17 year old is not part of that database. Hence no hash matches. CSAM provides a library with hashes that are compared against the photos on the phone. The real problem comes when governments make laws that open the mechanism to different libraries of photos.

That's the CSAM part. The iMessages part uses a neural network to detect explicit photos through machine learning.

What happens when Apple, or the government, mandate an expansion of CSAM into detecting new material? Apple already has built a neural network to detect new explicit material...

Also, what happens when the USG mandates that Top Secret classified material must also be added to the database? Or when Russia mandates that homosexual pornography must be added to the database?

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#37

Post by jobigoud »

jonathanmayer wrote: post #23

(Context: I teach computer security at Princeton and have a paper at this week's Usenix Security Symposium describing and analyzing a protocol that is similar to Apple's: https://www.usenix.org/conference/usenixsecurity21/presentat... .) The proposed attack on Apple's protocol doesn't work. The user's device adds randomness when generating an outer encryption key for the voucher. Even if an adversary obtains both the…

> only able to decrypt if there's a hash match

This is one of the concerns in the OP, have an AI generate millions of variations of a certain kind of images and check the hashes. In this case it boils down to how common false positives neural hashes are.

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#38

Post by x2r »

myspy wrote: post #32
dannyw wrote: post #20

Earlier quoted context omitted.

Depends on age and context doesn't it? Is a 17 year old snapchatting their private parts to her 17 year old boyfriend CSAM? Should both parties be imprisoned and go on sex offenders registries for life?

According to Grubers analysis it compares the csam pictures against the library. Your 17 year old is not part of that database. Hence no hash matches. CSAM provides a library with hashes that are compared against the photos on the phone. The real problem comes when governments make laws that open the mechanism to different libraries of photos.

They might be. Willing to bet that NCMEC db mostly contains selfies.

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#39

Post by headmelted »

Teever wrote: post #11
function_seven wrote: post #9

Earlier quoted context omitted.

Good link to explain why "CSAM" is being used in lieu of "CP" https://www.adfsolutions.com/news/what-is-csam > However, the phrase “child pornography” is almost too sterile and generic to properly exemplify the horrors of what is being created. That is why many advocates, including the National Center for Missing and Exploited Children (NCMEC), believe this phrase to be outdated. > NCMEC refers to these kinds of mate…

What terrible reasoning. 'Child pornography' is already too long to say repeatedly in a sentence so it is often shortened to "child porn." CSAM has far too many syllables so it too is shortened to two syllables in the form of the spoken acronym "CSAM" and so we're back to square one. With that said this is a fascinating display someone pressing the reverse button on the euphemism treadmill. I don't think I've ever se…

The logic seems backwards here.

I think saying “child porn” is clearer. That term is horrific as it is. If anyone sees that in a sentence they’ll be rightly revulsed and know what’s being talked about right away.

I had to have someone explain the CSAM acronym. How many people are going to skip over that because they assume its something benign and unrelated?

Re: Apple's New CSAM Protections May Make iCloud Photos Bruteforceable

#40

Post by laurent92 »

whatever1 wrote: post #24

Why does Apple even bother with encryption? They should just skip all of the warrant requirements etc and use their iCloud keys to unlock our content and store it unencrypted at rest. Maybe they can also build an api so that governments can search easily for dissidents without the delays that the due process of law causes.

Funny. The way I imagine NSA’s and FBI’s secret cooperation with Google is exactly this: Provide a search API that gives access to anything.
Post reply on HN