EFF Joins Global Coalition Asking Apple CEO Tim Cook to Stop Phone-Scanning • Hacker News Board

Re: EFF Joins Global Coalition Asking Apple CEO Tim Cook to Stop Phone-Scanning

#41

Post by azinman2 » Sat, Aug 21, 2021, 8:20 PM UTC

relax88 wrote: post #23

azinman2 wrote: post #11

> As we’ve explained in Deeplinks blog posts, Apple’s planned phone-scanning system opens the door to broader abuses. It decreases privacy for all iCloud photo users, and the parental notification system is a shift away from strong end-to-end encryption. It will tempt liberal democratic regimes to increase surveillance, and likely bring even great pressures from regimes that already have online censorship ensconced i…

> It only weakens privacy for iCloud photos if you have CP or photos in a CP database Who controls what is in the database? What independent oversight ensures that it’s only CSAM images? The public certainly can’t audit it. What is stopping the CCP from putting pro-Uighur or Xi Winnie the Pooh images into the database? Or from the US using this to locate images that are interesting from an intelligence perspective (S…

National Center for Missing and Exploited Children intersected with a not yet determined db in another jurisdiction, and then human moderators at Apple.

So what you’re describing is something that is a concern for the future that could exist anyway (and maybe already does at places like Google that have _zero_ auditable processing of data that already scan for CP from the same database above). But let’s not pretend that’s today.

Re: EFF Joins Global Coalition Asking Apple CEO Tim Cook to Stop Phone-Scanning

#42

Post by lamontcg » Sat, Aug 21, 2021, 8:20 PM UTC

azinman2 wrote: post #11

> As we’ve explained in Deeplinks blog posts, Apple’s planned phone-scanning system opens the door to broader abuses. It decreases privacy for all iCloud photo users, and the parental notification system is a shift away from strong end-to-end encryption. It will tempt liberal democratic regimes to increase surveillance, and likely bring even great pressures from regimes that already have online censorship ensconced i…

> It only weakens privacy for iCloud photos if you have CP or photos in a CP database

Or if someone hacks your device and uploads one of those photos to your iCloud.

(I still have no idea why people aren't pointing this out more aggressively -- phones get hacked probably every minute of every day, and acquiring those actual photos isn't that difficult once you're willing to commit felonies -- hash collisions are a distraction)

Re: EFF Joins Global Coalition Asking Apple CEO Tim Cook to Stop Phone-Scanning

#43

Post by slownews45 » Sat, Aug 21, 2021, 8:21 PM UTC

stingraycharles wrote: post #27

slownews45 wrote: post #8

Earlier quoted context omitted.

I'm not trying to suppress news. There have been a ton of letters, calls to action, complaints and outrage about apple's actions. Many of the conversations are HIGHLY repetitive. I would strongly urge folks to review past discussions before re-hashing things (again) or focus on new elements. And these headlines "Global Coalition"? I hope folks realize there is also a "global coalition" of governments that are working…

I think it’s important to distinguish the comments from the submission. I agree the comments are mostly repetitive, but the submissions do, in fact, cover newsworthy facts that should not be dismissed.

This is the forth or more piece about the EFF objecting to Apple's work.

I was just mentioning - maybe it's worth reading the comments on the FOUR prior articles about this EXACT entity complaining about Apple (ignoring the other 30+ HN posts on this) for this specific issue.

This is not "suppressing the news".

Re: EFF Joins Global Coalition Asking Apple CEO Tim Cook to Stop Phone-Scanning

#44

Post by azinman2 » Sat, Aug 21, 2021, 8:21 PM UTC

sennight wrote: post #37

azinman2 wrote: post #29

Earlier quoted context omitted.

It’s an intersection between a US db and a not yet chosen non-US db, which then will have a human reviewer verify its CP before sending off to the authorities.

> What more could one ask for? An independent audit for both the secret secondary perceptual hashing algorithm and the chain of custody policies/compliance for the "US db" and the disconcertedly open ended "not yet chosen non-US db"?

Do you ask for the same audit at Facebook, Google, Microsoft, Dropbox, and countless others who are already doing this and have been for years?

I do not share your same concern of some abused db _today_.

Re: EFF Joins Global Coalition Asking Apple CEO Tim Cook to Stop Phone-Scanning

#45

Post by nullc » Sat, Aug 21, 2021, 8:22 PM UTC

azinman2 wrote: post #35

smoldesu wrote: post #22

Earlier quoted context omitted.

Or possess tampered photos that were engineered to be a hash collision.

You’d have to not only have over 30 hash collisions, but also have it collide with another secret hash function, and then also have a human look at it and agree it’s CP. So what’s the actual realistic issue here? This keeps getting thrown around as if it’s likely, yet not only are there numerous steps against this in the Apple chain, this would already be a huge issue with Dropbox, Facebook, Microsoft, Google, etc wh…

> You’d have to not only have over 30 hash collisions

That's trivial. If the attacker can get one image onto your device they can get several.

It's very easy to construct preimages for Apple's neural hash function, including fairly good looking ones (e.g. https://github.com/AsuharietYgvar/AppleNeuralHash2ONNX/issue... )

> collide with another secret hash function

The supposed other 'secret' hash function cannot be secret from the state actors generating the databases.

Also, if it has a similar structure/training, it's not that unlikely that the same images would collide by chance.

> also have a human look at it and agree it’s CP

That's straight-forward: simply use nude or pornographic images which looks like they could be children or ones where without context you can't tell. It's a felony for them to fail to report child porn if they see it in review, and the NCMEC guidance tells people when in doubt to report.

Besides, once someone else has looked at your pictures your privacy has been violated.

Re: EFF Joins Global Coalition Asking Apple CEO Tim Cook to Stop Phone-Scanning

#46

Post by slownews45 » Sat, Aug 21, 2021, 8:22 PM UTC

mlosgoodat wrote: post #28

slownews45 wrote: post #8

Earlier quoted context omitted.

I'm not trying to suppress news. There have been a ton of letters, calls to action, complaints and outrage about apple's actions. Many of the conversations are HIGHLY repetitive. I would strongly urge folks to review past discussions before re-hashing things (again) or focus on new elements. And these headlines "Global Coalition"? I hope folks realize there is also a "global coalition" of governments that are working…

If the human element to this story was “cat gifs”, you might have a point. The human element here is “world governments and multinational corps beholden to nobody want to insert the first of possibly many back doors into your emotional life” Sit down. You’re just looking for attention for your ability to notice a basic pattern.

I find it very ironic that the people complaining about "suppressing news" or "violation of rights" are writing comments along the lines of sit down and shut up.

Re: EFF Joins Global Coalition Asking Apple CEO Tim Cook to Stop Phone-Scanning

#47

Post by amadeuspagel » Sat, Aug 21, 2021, 8:23 PM UTC

azinman2 wrote: post #44

sennight wrote: post #37

Earlier quoted context omitted.

> What more could one ask for? An independent audit for both the secret secondary perceptual hashing algorithm and the chain of custody policies/compliance for the "US db" and the disconcertedly open ended "not yet chosen non-US db"?

Do you ask for the same audit at Facebook, Google, Microsoft, Dropbox, and countless others who are already doing this and have been for years? I do not share your same concern of some abused db _today_.

Neither Google nor Microsoft scan pictures people have on their devices running Android or Windows. I'm not sure how that's even applicable to Facebook and Dropbox.

Re: EFF Joins Global Coalition Asking Apple CEO Tim Cook to Stop Phone-Scanning

#48

Post by GuB-42 » Sat, Aug 21, 2021, 8:23 PM UTC

tpush wrote: post #18

> [...] and the parental notification system is a shift away from strong end-to-end encryption. That particular statement doesn't make much sense to me. The parental notification system is just a frontend action (one of many, like link previews and such). What does that have to do with iMessage's encryption? I can see an argument about a shift away from privacy (though it only pertains to minors under 13 receiving se…

It is not about the encryption, it is about what an "end" is.

Generally, we consider the "end" to be the end user. If someone else can see the message along the way, it is not end to end anymore from a user perspective, even if it is from a network perspective. And Apple has complete control over your device through software updates. So that the leak is from your device or from the network is a mostly meaningless technical detail.

Re: EFF Joins Global Coalition Asking Apple CEO Tim Cook to Stop Phone-Scanning

#49

Post by bequanna » Sat, Aug 21, 2021, 8:23 PM UTC

nullc wrote: post #36

bequanna wrote: post #15

Does Tim Cook have a choice here? I would be surprised to hear that the genesis of this idea was inside of Apple vs. one or more govts pressuring Apple to add this functionality for them. It is also likely they even suggested that Apple should market this as anti-pedo tech to receive the least pushback from users.

If Apple is performing the searching of user private data due to pressure or incentive from the government it would make apple an agent of the government from the perspective of the fourth amendment. As such, these warrantless searches would be unlawful. If what you suggest were true, we should be even more angry with Apple: it would mean that rather than just lawfully invading their users privacy, that they were a p…

Americans, Chinese, Europeans, everyone. This is an equal-opportunity privacy rights violation. Investigatory and spy agencies around the world must be thrilled that this is moving forward.

Of course, we’ll accept it and the dullest of us will even cheer it as “doing the right thing” while stating that they “have nothing to hide”.

Re: EFF Joins Global Coalition Asking Apple CEO Tim Cook to Stop Phone-Scanning

#50

Post by azinman2 » Sat, Aug 21, 2021, 8:24 PM UTC

lamontcg wrote: post #42

azinman2 wrote: post #11

> As we’ve explained in Deeplinks blog posts, Apple’s planned phone-scanning system opens the door to broader abuses. It decreases privacy for all iCloud photo users, and the parental notification system is a shift away from strong end-to-end encryption. It will tempt liberal democratic regimes to increase surveillance, and likely bring even great pressures from regimes that already have online censorship ensconced i…

> It only weakens privacy for iCloud photos if you have CP or photos in a CP database Or if someone hacks your device and uploads one of those photos to your iCloud. (I still have no idea why people aren't pointing this out more aggressively -- phones get hacked probably every minute of every day, and acquiring those actual photos isn't that difficult once you're willing to commit felonies -- hash collisions are a di…

Because that then would already be a problem for Facebook, Google, Microsoft, etc that host photos that hacked phones could be uploading today.

And we’re just not seeing that being the case. Because all these providers have been doing this for so many years, including the nearly 17 million photos identified by Facebook last year, you’d figure there would be a lot more noise if this was really going on.

In fact, I would venture to say it’s far easier to hack a Facebook account than it is iCloud that has many on-device-based security protections that a cloud login without mandatory 2FA (and often SMS when it is used).