Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tainting the CSAM client-side scanning database

blog.xot.nl

Post reply on HN
Print view View original

31–40 of 276 posts

Re: Tainting the CSAM client-side scanning database

#31

Post by OfSanguineFire »

CuriousCosmic wrote: post #28
OfSanguineFire wrote: post #20

Earlier quoted context omitted.

Signal advises its users to install the app from the Play Store. While you can still get the .apk from Signal’s website, the developers warn against that. The EU can definitely exert pressure against what is hosted on the Play Store. Telegram famously lacks end-to-end encryption (unless you intentionally use its private-chat feature, which few people do) and shouldn’t be mentioned in the same context as Signal.

Molly is a just as good (if not better) fork of Signal that is distributed on FDroid. It's the same network and same chats/contacts, just a different front-end. And Signal avoids FDroid because they don't want someone else signing packages but they can always provide an FDroid repository like many others do and sign everything themselves. If push comes to shove they'll be fine and pressure to black box signal in the…

Signal being restricted to F-Droid would be the end of the app as any kind of mass phenomenon. Sure, like my fellow nerds here on HN, I use F-Droid. But none of the ordinary friends and relatives I managed to convince to install Signal, since it was free from the Play Store with just a few taps, would continue using the app if it were relegated to that repository they have never heard of.

Signal’s developers have spoken on a number of occasions about how their aim is to ensure encryption for the masses, not a techie elite.

Re: Tainting the CSAM client-side scanning database

#32

Post by chatmasta »

qingcharles wrote: post #24

How do these databases differentiate between AI generated CSAM and CSAM of real victims? (Since many jurisdictions only criminalize real CP) I know that 99% of people cannot tell an AI image from a real photo since that "Last giant irish greyhound 1902" photo has been going around on social media for weeks, and it is, to me, unbelievably obvious AI.

I assume the answer to that will be that there is no need to differentiate between them. And honestly, I agree with that argument. Possession of CSAM should be illegal regardless of whether it's "real" or not.

But the proposed scanning system is the wrong solution, regardless of any "real or AI" ambiguity, because it's possible to generate false positives with nonsense images that aren't even close to the expected CSAM, real or otherwise.

Re: Tainting the CSAM client-side scanning database

#33

Post by zolbrek »

OfSanguineFire wrote: post #31
CuriousCosmic wrote: post #28

Earlier quoted context omitted.

Molly is a just as good (if not better) fork of Signal that is distributed on FDroid. It's the same network and same chats/contacts, just a different front-end. And Signal avoids FDroid because they don't want someone else signing packages but they can always provide an FDroid repository like many others do and sign everything themselves. If push comes to shove they'll be fine and pressure to black box signal in the…

Signal being restricted to F-Droid would be the end of the app as any kind of mass phenomenon. Sure, like my fellow nerds here on HN, I use F-Droid. But none of the ordinary friends and relatives I managed to convince to install Signal, since it was free from the Play Store with just a few taps, would continue using the app if it were relegated to that repository they have never heard of. Signal’s developers have spo…

Yeah, I communicate with way too many people on iPhones who will simply not switch to Android. If it disappears from the Apple App Store we will have to use a different messenger.

Re: Tainting the CSAM client-side scanning database

#34

Post by seanhunter »

robertlagrant wrote: post #11
miohtama wrote: post #4

Earlier quoted context omitted.

Also do not miss the recent good article about the US software development companies who are behind the lobbying of client-side scanning, how is this madness is being funded and by whom. https://balkaninsight.com/2023/09/25/who-benefits-inside-the...

Thanks - interesting. Phrases like this are eternally surprising: > The same month, UK officials privately admitted to tech companies that there is no existing technology able to scan end-to-end encrypted messages without undermining users’ privacy It's as though this is a secret that UK officials knew. Everyone technically minded knows this; it's a battle between those who regulate (the difficulty of whose job gener…

Remember this is the same UK government that at one stage back in 2020 was proposing that there could be borderless customs enforcement between Ireland and Northern Ireland (part of the uk) "using drones". Because everyone knows drones do that.

I don't think they consider themselves limited by things technology is actually capable of when talking about what they are going to get technology to do.

Re: Tainting the CSAM client-side scanning database

#35

Post by pydry »

bastawhiz wrote: post #8
pydry wrote: post #6

Earlier quoted context omitted.

My understanding was that you generate a csam with a colliding fingerprint and put it online and trick somebody with an iPhone or whatever into clicking on it. Now they're on a watchlist and will get harassed by the police.

So you have to plant the manipulated csam somewhere that it'll be found by law enforcement and added to the database and just hope you did a good enough job to not be tracked?

>just hope you did a good enough job to not be tracked

Right. Your target uses e.g. an iPhone. You use Kali on clean hardware.

Re: Tainting the CSAM client-side scanning database

#36

Post by cabirum »

I think it's pretty clear this is not about "CSAM", we have to stop using the term. It's just censorship, plain and simple. Client side means you'll pay from your own pocket for this wrongthing detector to work. It can even be automated so as soon as the detector gets triggered by anything, you'll get locked out of your bank accounts, until further notice I guess.

If this thing gets a serious discussion in a parliament, get rid of the parliament.

Re: Tainting the CSAM client-side scanning database

#38

Post by whimsicalism »

chatmasta wrote: post #32
qingcharles wrote: post #24

How do these databases differentiate between AI generated CSAM and CSAM of real victims? (Since many jurisdictions only criminalize real CP) I know that 99% of people cannot tell an AI image from a real photo since that "Last giant irish greyhound 1902" photo has been going around on social media for weeks, and it is, to me, unbelievably obvious AI.

I assume the answer to that will be that there is no need to differentiate between them. And honestly, I agree with that argument. Possession of CSAM should be illegal regardless of whether it's "real" or not. But the proposed scanning system is the wrong solution, regardless of any "real or AI" ambiguity, because it's possible to generate false positives with nonsense images that aren't even close to the expected CS…

I am of the opinion that regardless of whether they are both illegal, the penalties for “AI” should be significantly less.

Re: Tainting the CSAM client-side scanning database

#39

Post by kzrdude »

CuriousCosmic wrote: post #29
kzrdude wrote: post #27

Earlier quoted context omitted.

If you enable private chat, you don't get notifications for new messages, that way the feature is self defeating, it seems to me at least. (Something could also have gone wrong?)

Notifications generally go through Google Firebase so by not running private messages through firebase they avoid potential leaks. At least that's my guess

That sounds pretty bad, a cloud service needs to see all notifications?

Re: Tainting the CSAM client-side scanning database

#40

Post by postalrat »

chatmasta wrote: post #32
qingcharles wrote: post #24

How do these databases differentiate between AI generated CSAM and CSAM of real victims? (Since many jurisdictions only criminalize real CP) I know that 99% of people cannot tell an AI image from a real photo since that "Last giant irish greyhound 1902" photo has been going around on social media for weeks, and it is, to me, unbelievably obvious AI.

I assume the answer to that will be that there is no need to differentiate between them. And honestly, I agree with that argument. Possession of CSAM should be illegal regardless of whether it's "real" or not. But the proposed scanning system is the wrong solution, regardless of any "real or AI" ambiguity, because it's possible to generate false positives with nonsense images that aren't even close to the expected CS…

Seems like you want to bring all the success of the war on drugs to the war on generated images.
Post reply on HN