Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple already scans iCloud Mail for CSAM, but not iCloud Photos

9to5mac.com

Post reply on HN
Print view View original

131–140 of 142 posts

Re: Apple already scans iCloud Mail for CSAM, but not iCloud Photos

#131

Post by Retric »

brokenmachine wrote: post #129
Retric wrote: post #126

Earlier quoted context omitted.

Ok, so you are largely misunderstanding the details. > Creating a novel on-device scanning mechanism and claiming that is somehow more privacy is a lie, and therefore shady. Would you rather Apple actually directly look at your images? If not then it is a privacy improvement. Because they are legally required to search their servers for this stuff when directed to by the FBI. > Using that novel on-device scanning cap…

>Would you rather Apple actually directly look at your images? No. Why would that be necessary? I would expect to be reported if I willingly uploaded images matching exact hashes of CSAM to Apple servers. I don't understand why Apple employees would ever be able to, or need to, view my images, and I would expect Apple if it were really a privacy-focused company to never let that happen. >Except they don’t actually do…

> It's client side, that's why we're having this discussion.

> This is all a secret process.

Those are in contradiction a client side process is inspectable.

Re: Apple already scans iCloud Mail for CSAM, but not iCloud Photos

#132

Post by Terretta »

nitrogen wrote: post #97
YPPH wrote: post #9

The clear distinction being that iCloud Mail scanning doesn't happen on device. For my part, all Apple needs to do is move CSAM scanning to the cloud. No service provider can be expected to keep images of child abuse on their servers. Apple would join myriad cloud service providers in scanning for and reporting such material. My problem is the use of my own device to run the scan. It's a waste of system resources. Pr…

My problem is the use of my own device to run the scan. It's a waste of system resources. I'll restate what I posted on another thread about this [0]. There should be a clear, bright line here. ---- In all these threads everyone is coming close to the crux of the issue, but I want to restate it in clearer terms: There is a sacrosanct line between "public" and "private," "mine" and "yours." That line cannot be crossed…

Framing as “on device scanning” is contrary to facts. It’s the client SDK operating the same algo on an upload event image at the client end of the upload API as it would run at the server end, just not having to decrypt it to do it.

But to your theme — there’s no clear bright line in client SDKs.

Devs do not think of these or handle these as if they belong to the user.

If you study the cesspool of user tracking and other privacy violations on iOS devices, it’s mostly developers using the same client-side SDKs across their apps, and users none the wiser.

Sometimes devs also have no idea. At least, they profess surprise and drop these SDKs when the user behavior harvesting is pointed out to them.

For whatever reason, everyone’s OK with this.

Perhaps the line is too blurred between client and server, thanks to emergence of concepts like node.js (“run same code on client or server”) that make this sound like a feature.

Or maybe it really shouldn’t matter where the code runs provided it respects boundaries, or better, those boundaries of intentionality and access are technically guaranteed inviolate.

Re: Apple already scans iCloud Mail for CSAM, but not iCloud Photos

#133

Post by Terretta »

JKCalhoun wrote: post #40
gonn wrote: post #16

Correct me if I'm wrong, but I find the idea of people sending this kind of materials via email to be asking for trouble, to put it mildly.

While I agree, law enforcement in the U.S. is supposedly bound by the "expectation of privacy" where, I think we can all agree, we ought to have an expectation of privacy when we send an email directly to one of our contacts. Of course Google and Gmail (as an obvious example) are not law enforcement so they can specify the terms of privacy when you sign up, scan your email if they wish, etc.

Regular mail to a contact has circumstances where it can be searched:

The expectation that personal correspondence should remain private is centuries old. In the 1750s, for example, Postmaster Benjamin Franklin instituted a policy forbidding postmasters from reading individuals’ letters.

So it is dismaying that the Postal Service, the Inspection Service and the DOJ are not upfront with the public as to when they feel fit to open private mail.

https://www.rstreet.org/2014/11/19/yes-the-government-can-op...

Electronic mail does not enjoy enhanced protections over regular mail. Arguably, as electronic mail is sent through a chain of third parties without an envelope, the expectation of privacy is less.

Email is like postcards: “privacy” depends on being one in a sea of items, and a postal worker averting their eyes.

Re: Apple already scans iCloud Mail for CSAM, but not iCloud Photos

#134

Post by Terretta »

xunn0026 wrote: post #56
JKCalhoun wrote: post #40

Earlier quoted context omitted.

While I agree, law enforcement in the U.S. is supposedly bound by the "expectation of privacy" where, I think we can all agree, we ought to have an expectation of privacy when we send an email directly to one of our contacts. Of course Google and Gmail (as an obvious example) are not law enforcement so they can specify the terms of privacy when you sign up, scan your email if they wish, etc.

> I think we can all agree, we ought to have an expectation of privacy when we send an email directly to one of our contacts. We ought. But in my country I once received a piece of physical mail from a more important institution in a more special (but not shady) country and the mail literally arrived open. I realised this is how people under communist regimes must have felt.

In the U.S., “the Fourth Amendment permits the warrantless searching of mail entering or leaving the United States…. Congress specifically has authorized the warrantless search of mail at the border, although some of those provisions place restrictions on the reading of correspondence. See, e.g., 19 U.S.C. § 1583(a)(l) (permitting warrantless search of mail of domestic origin transmitted for export … and foreign mail transiting the United States”)…”

Re: Apple already scans iCloud Mail for CSAM, but not iCloud Photos

#135

Post by brokenmachine »

Retric wrote: post #131
brokenmachine wrote: post #129

Earlier quoted context omitted.

>Would you rather Apple actually directly look at your images? No. Why would that be necessary? I would expect to be reported if I willingly uploaded images matching exact hashes of CSAM to Apple servers. I don't understand why Apple employees would ever be able to, or need to, view my images, and I would expect Apple if it were really a privacy-focused company to never let that happen. >Except they don’t actually do…

> It's client side, that's why we're having this discussion. > This is all a secret process. Those are in contradiction a client side process is inspectable.

This is disingenuous and you know it.

As you know, there is a server-side element, the crypto mumbo jumbo makes it impossible to audit which images will trigger the automated snitching mechanism from the secret list of hashes. So it is both a secret process and doing scanning client-side.

Also Apple is busily suing companies who dare to make client-side inspection feasible, as I noted.

Re: Apple already scans iCloud Mail for CSAM, but not iCloud Photos

#136

Post by wayneftw »

YPPH wrote: post #9

The clear distinction being that iCloud Mail scanning doesn't happen on device. For my part, all Apple needs to do is move CSAM scanning to the cloud. No service provider can be expected to keep images of child abuse on their servers. Apple would join myriad cloud service providers in scanning for and reporting such material. My problem is the use of my own device to run the scan. It's a waste of system resources. Pr…

This is exactly what I complained about in past threads and nearly nobody agreed with me there. Seems like the tide has changed!

This is my only complaint. I don't care what you do on your own cloud, don't try and force my device to do the heavy lifting especially when the activity is not in my own interest.

Re: Apple already scans iCloud Mail for CSAM, but not iCloud Photos

#137

Post by jnwatson »

anonuser123456 wrote: post #43
jnwatson wrote: post #11

Earlier quoted context omitted.

The point was so they wouldn't need to see the plaintext of the photos on their servers. Somebody needs to invent a FHE (fully homomorphic encryption) CSAM algorithm, so that Apple could scan encrypted photos for badness on the cloud.

FHE doesn't let the other party access the results of algorithms run on your data. Other parties can run an algorithm on your encrypted data, but only you can interpret the results.

That's a good point. The device with the key would still have to forward the results.

Re: Apple already scans iCloud Mail for CSAM, but not iCloud Photos

#138

Post by shuckles »

matthewdgreen wrote: post #122
shuckles wrote: post #80

Earlier quoted context omitted.

A third party could implement the PHAsset abstraction over their own implementation of a photo library action sheet and the file provider APIs. It wouldn’t get you to feature parity, but the major differences are but minor frictions if your privacy threat model involves nation state adversaries. It is not possible to write an app on iOS that has permanent, transparent background network and runtime access, and it’s a…

I’m unclear if you’re saying that one can implement a new access mechanism to Apple’s default photo library (the one managed by the Photos app and that the camera saves to by default) or if you’re suggesting that I need to design my own alternative photo album. If the latter, then “but minor frictions” seems… unreasonable. Not sure what nation state adversaries have to do with a simple question about photo library ac…

If your argument is that Apple should be forced to give everyone access to the proprietary abstractions it builds on its own operating systems, like PHAssets, then we are no longer in the world of privacy and now in the world of “when is it ok to force companies to build features the public [HN posters] wants?” There are many answers to this, but it seems like the current legal regime in most places says: “Very rarely.”

My argument is that nothing stops a photo sync solution from building much of the relevant stack themselves: you can build MGAssets and get apps to adopt your photo library view controller as an action sheet or use File Provider abstractions to build the same in file pickers. 1Password, eg, offers a direct to 1P button as an SDK for 3rd parties to use. Once you separate out what you can’t do easily because it would take a lot of investment to build yourself versus what actual platform features you’d like to force Apple to build, I think your argument that the latter should be done is even less compelling.

Re: Apple already scans iCloud Mail for CSAM, but not iCloud Photos

#139

Post by shuckles »

matthewdgreen wrote: post #120
shuckles wrote: post #92

Earlier quoted context omitted.

The user to whom Apple’s offer is a false choice is one that assumed they would always be able to update to the latest iOS while uploading whatever photos they wanted into iCloud Photo Library without any kind of content scanning. Turning private API into public API is a huge investment, and I’ll be honest: this hypothetical user seems quite far-fetched, and I don’t see how this investment is worthwhile for Apple to…

You seem to be conflating a number of very different issues. It would be a lot simpler if you didn’t do that. There are several separate questions. 1) Should users have the right to opt out of scanning. Apple have answered (1) in the affirmative: yes, they understand that some users want this option and have designed their system with explicit guarantees that users can do this. This is not an accident or a miscalcula…

I agree with your framing except that in 2 and 3, the matter is already settled. The status quo is Apple gets to build what it wants. It’s on you and others to do an immense amount of work to prove that Apple should be forced into building features you want and not what they deem best. I’m generally happy with what they’ve made, and I think the power to compel them to make changes is more likely to be wielded by dumb and possibly malevolent people than altruistic, privacy-focused computer experts.

I’m not sure why the burden to do user surveys is on me. Presumably the first order user survey is, “Will our customers abandon us?” which Apple must have done and everything past that is on you to conduct to justify your ask of them.

Re: Apple already scans iCloud Mail for CSAM, but not iCloud Photos

#140

Post by diebeforei485 »

skoskie wrote: post #90
diebeforei485 wrote: post #70

It definitely makes sense to scan things that are passed around - mail is an example of that, and Gmail [and also Facebook, Twitter] scan for this, along with scanning for computer viruses, and in some cases (public posts) copyrighted content. It makes absolutely no sense to scan people's photos that they aren't sharing with anyone else. Why are they bothering with scanning people's photo backups at all? With the exc…

If I were permitted to put something on your server that could put you in legal jeopardy, wouldn't you want to know what I'm putting on your server?

I'm not sure it would put me (as a provider) in legal jeopardy. You'll need a cite for that, and you don't have one. Providers only need to take action if they have been made aware about it, and are not required to proactively scan.

See [1] 18 USC 2258A, relevant part below.

(f) Protection of Privacy. Nothing in this section shall be construed to require a provider to— (1) monitor any user, subscriber, or customer of that provider; (2) monitor the content of any communication of any person described in paragraph (1); or (3) affirmatively search, screen, or scan for facts or circumstances described in sections (a) and (b).

Or here's another cite in plain English-

... for CSAM, to hold platforms liable, the government would have to prove that they did not take action when they knew federally illegal content was on their sites. The law doesn’t create an obligation for platforms to go out and proactively monitor... [2]

[1] https://www.law.cornell.edu/uscode/text/18/2258A [2] https://freedomhouse.org/article/qa-social-media-regulation-...

Post reply on HN