Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The deceptive PR behind Apple’s “expanded protections for children”

piotr.is

Post reply on HN
Print view View original

181–190 of 595 posts

Re: The deceptive PR behind Apple’s “expanded protections for children”

#181

Post by shapefrog »

EugeneOZ wrote: post #129
shapefrog wrote: post #114

Earlier quoted context omitted.

It turns out people liked it when their phone scanned their photos for 'selfie' or 'beach' for them. Apparently tagging 'child porn' on your photos for searching isnt the killer feature someone thought it might be.

Yeah :) Also, it's funny that Apple here goes for bigger risks: reputation, trust, all of that noise, then risks of false accusations. And for what? To help with stopping the pedophile networks. “But no, wait, they want to use algorithms to scan my photos, it’s a privacy violation...” Just wake up.

They can have a full resolution copy of my photo, all 12 million pixels, along with the exact time, location and direction I was facing when I took it... but I draw the line firmly at a hash of it being taken.

Re: The deceptive PR behind Apple’s “expanded protections for children”

#182

Post by throwaway212135 »

dev_tty01 wrote: post #134
querez wrote: post #2

I have a newborn at home, and like every other parent, we take thousands of pictures and videos of our newest family member. We took pictures of the very first baby-bath. So now I have pictures of a naked baby on my phone. Does that mean that pictures of my newborn baby will be uploaded to Apple for further analysis, potentially stored for indefinite time, shared with law enforcement?

No. The CSAM (Child Sexual Abuse Material) scanning is comparing hashes of photos about to be uploaded to iCloud against a specific set of images at NCMEC (National Center for Missing and Exploited Children) which are specific to missing and exploited children. It is not machine learning models looking for nudes or similar. It is not a generalized screening. If enough matched images are found, the images are flagged…

I am not sure the right questions are being asked.

1. Who is adding these photos to NCMEC? 2. How often are these photos added? 3. How many people have access to these photos - both adding and viewing?

Everyone is focused on Apple and no one is looking at MCMEC. If I wanted to plant a Trojan horse, I would point everyone towards Apple and perform all of the dirty work on the NCMEC end of things.

Re: The deceptive PR behind Apple’s “expanded protections for children”

#183

Post by Engineering-MD »

Dah00n wrote: post #109
lawkwok wrote: post #47

Earlier quoted context omitted.

In this TechCrunch interview, Apple believes it is less invasive since no one can be individually targeted. The hashes are hard coded into each iOS release which is the same for all iOS devices. The database is not vulnerable to server side changes. Additionally, FWIW, they do not want to start analyzing entire iCloud photo libraries so this system only analyzes new uploads. https://techcrunch.com/2021/08/10/intervie…

>The hashes are hard coded into each iOS release Do you have a source on that? Since it is illegal to share those hashes in any way or form. Even people working with photo forensic and big photo sharing sites cannot get access to them. I very much doubt Apple can incorporate them into the iOS release without breaking multiple laws. The hashes themselves can easily be reversed to (bad quality) pictures so having the h…

That was very insightful article from a legal aspect. Strongly recommend others read this to understand more nuanced opinion.

Re: The deceptive PR behind Apple’s “expanded protections for children”

#184

Post by shapefrog »

shuckles wrote: post #156
shapefrog wrote: post #114

Earlier quoted context omitted.

It turns out people liked it when their phone scanned their photos for 'selfie' or 'beach' for them. Apparently tagging 'child porn' on your photos for searching isnt the killer feature someone thought it might be.

So what you’re saying is if Apple had a 5 year plan to help China disappear minorities, they should’ve just kept improving photos search? Maybe this child safety effort isn’t aimed at satisfying some authoritarian wet dream after all!

Given that they classified a photo I took at a pool as 'beach', they have an awfully long way to go. If their disappearing algorithm doesnt improve they will be disappearing chinese majorities instead of minorities.

Re: The deceptive PR behind Apple’s “expanded protections for children”

#185

Post by mdoms »

laserlight wrote: post #97
still_grokking wrote: post #44

Earlier quoted context omitted.

From https://www.hackerfactor.com/blog/index.php?/archives/929-On... > The laws related to CSAM are very explicit. 18 U.S. Code § 2252 states that knowingly transferring CSAM material is a felony. (The only exception, in 2258A, is when it is reported to NCMEC.) In this case, Apple has a very strong reason to believe they are transferring CSAM material, and they are sending it to Apple -- not NCMEC. > It does not matt…

IMHO, what Apple is doing is not _knowingly_ transferring CSAM material. Very strong reason to believe is not the same as knowing. Of course it's up to courts to decide and IANAL.

Go ahead and click on some google results after searching for child porn and see if that defence holds up.

Re: The deceptive PR behind Apple’s “expanded protections for children”

#186

Post by hypothesis »

psyc wrote: post #142
Componica wrote: post #135

Imagine taking a photo or have in your gallery a photo a dear leader doesn't want to spread. Ten minutes later you heard a knocking at your door. That's what I'm most worried about, how is this not creating the infrastructure to ensnare political dissidents.

I am profoundly disappointed that almost all of the discussion is about the minutiae of the implementation, and "Hmm.. Am I ok with the minutiae of Apple's specific implementation at rollout?" And almost nobody is discussing the basic general principle of whether they want their own device to scan itself for contraband, on society's behalf.

Maybe people realize that’s not a winning strategy and thus keep going back to technical details…

Re: The deceptive PR behind Apple’s “expanded protections for children”

#187

Post by matwood »

amelius wrote: post #80
gonehome wrote: post #73

Earlier quoted context omitted.

I think the one thumbnail of the matching hash? Just to make sure there isn't a (they argue one in a trillion, but I don't know if I buy that) false positive. That's if there is enough matches to trigger the threshold in the first place, otherwise nothing is sent (even if there are matches below that threshold). Alternatively this is running on all unencrypted photos you have in iCloud and all matches are known immed…

> I think the one thumbnail of the matching hash? So it is sending pictures? That makes your argument quite a bit weaker. > Is that preferable? Nope, E2EE without compromises is preferable.

> So it is sending pictures? That makes your argument quite a bit weaker.

Important to note this is only ran on images going to iCloud so they are already sent.

Re: The deceptive PR behind Apple’s “expanded protections for children”

#188

Post by nicce »

sandworm101 wrote: post #136
querez wrote: post #2

I have a newborn at home, and like every other parent, we take thousands of pictures and videos of our newest family member. We took pictures of the very first baby-bath. So now I have pictures of a naked baby on my phone. Does that mean that pictures of my newborn baby will be uploaded to Apple for further analysis, potentially stored for indefinite time, shared with law enforcement?

Yes, if they wind up part of a child porn investigation. Your cloud account gets hacked. Some perv gets your images. He is then arrested and his "collection" added to the hash database... including your family photos. Context often matters more than the nature of the actual content. Police aquire thousands of images with little hope of ever knowing where they originated. If they are collected by pervs, and could be c…

Actually, we don’t know yet whether you can access your photos from the web anymore after this update, because E2EE ”like” implementation.

Protocol is rather device specific (while allowing multi-device), so it might not be enough to access or hack iCloud account to access the photos. So, things get complicated.

Re: The deceptive PR behind Apple’s “expanded protections for children”

#189

Post by FabHK »

908B64B197 wrote: post #170
querez wrote: post #2

I have a newborn at home, and like every other parent, we take thousands of pictures and videos of our newest family member. We took pictures of the very first baby-bath. So now I have pictures of a naked baby on my phone. Does that mean that pictures of my newborn baby will be uploaded to Apple for further analysis, potentially stored for indefinite time, shared with law enforcement?

Wait until someone manages to create an image (white noise) that's a hash collision for anything in that database. And then starts spamming random strangers via airdrop. Enjoy explaining why your mugshot and arrest record had these charges attached to it! (Actually, in this case the prosecution would probably use the other pictures on the phone that were not detected by the scanning tool as a way to get a guilty plea…

It would have to be a number of pictures that are flagged, and after that threshold is exceeded, they (more precisely, their "visual derivative") are reviewed by a human. So, no mugshot and no arrest record, even if you choose to accept any number of pictures sent from random strangers via airdrop.

Re: The deceptive PR behind Apple’s “expanded protections for children”

#190

Post by gonehome »

matwood wrote: post #177
gonehome wrote: post #71

Earlier quoted context omitted.

Yes - and I agree that that's where the risk lies. Though I'd argue the risk has kind of always lied there given companies can ship updates to phones. You could maybe argue it'd be harder to legally compel them to do so, but I'm not sure there's much to that. The modern 'megacorp' centralized software and distribution we have is dependent on policy for the most part.

That's the problem I had with Ben's post - it's always been policy since Apple controls and distributes iOS.

Yeah - the sense I got was he just liked the cleaner cut policy of a hard stop at the phone itself (and he was cool with the tradeoff of unencrypted content on the server).

It does have some advantages - it's easier to argue (see: the disaster that is most of the commentary on this issue).

It also could in theory be easier to argue in court. In the San Bernardino case - it's easier for Apple to decline to assist if assisting requires them to build functionality rather than just grant access.

If the hash detection functionality already exists and a government demands Apple use it for something other than CSAM it may be harder for them to refuse since they can no longer make the argument that they can't currently do it (and can't be compelled to build it).

That said - I think this is mostly just policy all the way down.

Post reply on HN