Apple Photos phones home on iOS 18 and macOS 15 • Hacker News Board

Re: Apple Photos phones home on iOS 18 and macOS 15

#401

Post by isodev » Sun, Dec 29, 2024, 6:09 AM UTC

kemayo wrote: post #154

Gabriel54 wrote: post #13

Earlier quoted context omitted.

I appreciate the explanation. However, I think you do not address the main problem, which is that my data is being sent off my device by default and without any (reasonable) notice. Many users may agree to such a feature (as you say, it may be very secure), but to assume that everyone ought to be opted in by default is the issue.

I'm not sure I agree -- asking users about every single minor feature is (a) incredibly annoying, and (b) quickly causes request-blindness in even reasonably security-conscious users. So restraining the nagging for only risky or particularly invasive things makes sense to me. Maybe they should lump its default state into something that already exists? E.g. assume that if you already have location access enabled for P…

> asking users about every single minor feature

Then perhaps the system is of poor design and needs further work before being unleashed on users…

Re: Apple Photos phones home on iOS 18 and macOS 15

#402

Post by supriyo-biswas » Sun, Dec 29, 2024, 6:10 AM UTC

sureIy wrote: post #392

MBCook wrote: post #384

Earlier quoted context omitted.

That was the CSAM thing that they have announced they gave up on. This is totally different.

Are you sure? Publicly yeah, but the same technology can easily be used for the same purpose.

As pointed out in a sibling comment, the result set is also encrypted, so matches with abuse images, even if there are some in Apple's POI database, can't be used to implement the scheme as you suggest.

Re: Apple Photos phones home on iOS 18 and macOS 15

#403

Post by sitkack » Sun, Dec 29, 2024, 6:11 AM UTC

I don't understand why this feature needs to exist at all. Ostensibly, if someone wanted to use this, they also have location data on, the phone not only knows its location but also which direction it is pointed via the magnetometer.

I understand it is doing feature matching on the image, but if you were taking a picture of the statue of liberty, the phone would already know that from existing signals.

Re: Apple Photos phones home on iOS 18 and macOS 15

#404

Post by isodev » Sun, Dec 29, 2024, 6:11 AM UTC

supriyo-biswas wrote: post #396

isodev wrote: post #391

Earlier quoted context omitted.

Encryption does not automatically mean secure. Encryptions can and will be broken. Any flaw in their implementation (which nobody can verify) would render encryption useless…

I wonder where you'd draw the line. Do you also distrust TLS for example, and therefore refuse to use the internet? What about AES/Chacha for full-disk encryption?

The line is very simple - my content stays on device, secured (locally) with the current modern and practical tools.

Re: Apple Photos phones home on iOS 18 and macOS 15

#405

Post by flik » Sun, Dec 29, 2024, 6:12 AM UTC

EagnaIonat wrote: post #355

mrshadowgoose wrote: post #306

Is this just a smokescreen around slowly sneaking CSAM scanning back in after the pushback last time? The "default on" behavior is suspect. [1] https://www.wired.com/story/apple-photo-scanning-csam-commun...

That whole incident was so misinformed. CSAM scanning takes place on the cloud with all the major players. It only has hashes for the worst of the worst stuff out there. What Apple (and others do) is allow the file to be scanned unencrypted on the server. What the feature Apple wanted to add was scan the files on the device and flag anything that gets a match. That file in question would be able to be decrypted on th…

Yes this is better than upload the entire photo. Just like virus scan can be done entirely on device, can flagging be local?. If homeomorphic encryption allows similarity matching, does not seem entirely private. Can people be matched?

Re: Apple Photos phones home on iOS 18 and macOS 15

#406

Post by warkdarrior » Sun, Dec 29, 2024, 6:13 AM UTC

1shooner wrote: post #234

nixpulvis wrote: post #229

I'm disappointed in the discourse around Homomorphic Encryption and Differential Privacy here. As someone who briefly studied adjacent subjects these tools excite me more than they scare me. We trust TLS with our SSNs and CC numbers, hopefully one day we can trust secure multiparty computation too.

>We trust TLS Is this really an apt comparison? I understood the trust in TLS to be built on open RFCs and implementation stacks. Even then, whenever I send private data, I take specific steps to verify I am using that trusted stack. That is not the experience described in the article.

> I take specific steps to verify I am using that trusted stack

I would be very interested to hear what these specific steps are. How do you make sure that this TLS stack really does implement the RFC? How do you know that each connection is indeed encrypted, and it doesn't start sending plaintext after, say 30 days of usage?

Re: Apple Photos phones home on iOS 18 and macOS 15

#407

Post by rzimmerman » Sun, Dec 29, 2024, 6:14 AM UTC

If your core concern is privacy, surely you'd be fine with "no bytes ever leave my device". But that's a big-hammer way to ensure no one sees your private data. What about external (iCloud/general cloud) storage? That's pretty useful, and if all your data is encrypted in such a way that only you can read it, would you consider that private? If done properly, I would say that meets the goal.

What if, in addition to storage, I'd like to use some form of cloud compute on my data? If my device preprocesses/anonymizes my data, and the server involved uses homomorphic encryption so that it also can't read my data, is that not also good enough? It's frustrating to see how much above and beyond Apple has taken this simple service to actually preserve user privacy.

I get that enabling things by default triggers some old wounds. But I can understand the argument that it's okay to enable off-device use of personal data IF it's completely anonymous and privacy preserving. That actually seems very reasonable. None of the other mega-tech companies come close to this standard.

Re: Apple Photos phones home on iOS 18 and macOS 15

#408

Post by Arn_Thor » Sun, Dec 29, 2024, 6:14 AM UTC

paxys wrote: post #183

So basically - You take a picture. Apple encrypts it and uploads it to their server. The server matches the (still encrypted) picture to a database and tells your device "this picture contains the Eiffel Tower". Later when you search for Eiffel Tower on your device the photo pops up. Is the complexity and security risk really worth it for such a niche feature? It's also funny that Apple is simultaneously saying "don'…

They don’t send the photo. They send some encrypted metadata to which some noise is added. The metadata can be loosely understood as “I have this photo that looks sort of like this”. Then the server takes that encrypted data from the anonymized device and responds something like “that looks like the Eiffel Tower” and sends it back to the device. The actual photo never goes to the server.

Re: Apple Photos phones home on iOS 18 and macOS 15

#409

Post by Thorrez » Sun, Dec 29, 2024, 6:16 AM UTC

isodev wrote: post #391

Thorrez wrote: post #381

Earlier quoted context omitted.

>regardless of “we promise we won’t look”. AIUI, even if Apple's servers tried to look, they cannot, because of the encryption.

Encryption does not automatically mean secure. Encryptions can and will be broken. Any flaw in their implementation (which nobody can verify) would render encryption useless…

Sure, but it's more than a promise that they won't look. Apple currently believes it's impossible to look.

Re: Apple Photos phones home on iOS 18 and macOS 15

#410

Post by throw10920 » Sun, Dec 29, 2024, 6:20 AM UTC

joe_the_user wrote: post #360

jchw wrote: post #292

What I want is very simple: I want software that doesn't send anything to the Internet without some explicit intent first . All of that work to try to make this feature plausibly private is cool engineering work, and there's absolutely nothing wrong with implementing a feature like this, but it should absolutely be opt-in. Trust in software will continue to erode until software stops treating end users and their data…

and there's absolutely nothing wrong with implementing a feature like this, but it should absolutely be opt-in This feature is intended to spy on the user. Those kinds of features can't be opt-in. (And yeah, holomorophic "privacy preserving" encryption song-and-dance, I read about that when it came out, etc).

This is an incredibly shallow dismissal that states the opposite of Apple's claim with zero evidence or reasoning and hand-waves away the very real and well-researched field of homomorphic encryption.