Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple plans to scan US iPhones for child abuse imagery

ft.com

Post reply on HN
Print view View original

281–290 of 390 posts

Re: Apple plans to scan US iPhones for child abuse imagery

#281

Post by sandworm101 »

Retric wrote: post #280
sandworm101 wrote: post #276

Earlier quoted context omitted.

Ok. Hashed-based image rec. Where are the hashes? Is the comparison done in my phone against a downloaded database, or is a hash of every image on my phone uploaded for comparison on a server? Could this program then be expanded to other classes of images? Animal abuse imagery? Terrorism? Hashes of known bomb-making instructions? How about people sharing illegal pdfs and text files? Will the MPAA be allowed to submit…

It’s done on Apple’s servers using your iCloud backups. For good or ill this lets people opt out by disabling iCloud. I would hope most privacy conscious people disable iCloud, but that’s another story.

If apple really cares about security then those images in iCloud should be stored in an encrypted form that makes hash comparisons impossible. If they are hashing them then they have access to them in plaintext. If I used iCloud I would be more worried about the wider implications that creates.

Re: Apple plans to scan US iPhones for child abuse imagery

#282

Post by diebeforei485 »

smnrchrds wrote: post #245
macintux wrote: post #142

Earlier quoted context omitted.

Apple cares about #1 when they feel the requests are not legal. https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute Apple has to comply with the law, however.

What law prompted this new feature we are discussing here?

I assume 18 USC 2258A, but they seem to be going above and beyond. Under current law, they are only required to report, they are not required to prevent[1].

Presumably, they are doing this voluntarily now to stave off future legislation around this that might require more invasive scanning.

1. 18 USC 2258C(c)

Re: Apple plans to scan US iPhones for child abuse imagery

#283

Post by PenguinCoder »

itake wrote: post #31
partiallypro wrote: post #14

I really don't see how this is going to end well, there could be perfectly innocent photos on someone's phone of their own children doing perfectly normal things that kids do. Like a kid running butt naked around the house, or a photo of something like a rash that is sent to a nurse friend for advice on what it is etc. I'm all for protecting children from being abused, but how are they going to filter what is normal…

> perfectly innocent photos on someone's phone of their own children They are using a library of human verified images to compare the hashes. Probably similar to PhotoDNA[0]. There can be false positives, but AFAIK the algorithms are not trying to identify naked children, but comparing 2 similar image hashes. [0] - https://en.wikipedia.org/wiki/PhotoDNA

Changing the size or file type of the image would easily change the hash.

Re: Apple plans to scan US iPhones for child abuse imagery

#284

Post by res0nat0r »

shuckles wrote: post #194
res0nat0r wrote: post #171

Earlier quoted context omitted.

AWS doesn't do any automatic fingerprinting of files being uploaded to S3 and never has. The only time I've heard of anything like this was briefly when Microsoft was doing it, and I don't know if that was shutdown long ago due to outrage or not.

AWS doesn’t have to because the entity which writes those files is obligated to do this scanning if there is reason to believe the files contain CSAM.

I guess I should clear up: Amazon isn't doing any type of automatic file-scanning for anything being uploaded to S3, or feeding md5/sha1/sha256sums to some 3rd party service automatically for everything that touches S3.

If they get a subpoena and then maybe send some kind of file list/checksums they've been required to hand over to some 3rd party / government? That's possible, but an entirely different situation.

Re: Apple plans to scan US iPhones for child abuse imagery

#285

Post by Retric »

sandworm101 wrote: post #281
Retric wrote: post #280

Earlier quoted context omitted.

It’s done on Apple’s servers using your iCloud backups. For good or ill this lets people opt out by disabling iCloud. I would hope most privacy conscious people disable iCloud, but that’s another story.

If apple really cares about security then those images in iCloud should be stored in an encrypted form that makes hash comparisons impossible. If they are hashing them then they have access to them in plaintext. If I used iCloud I would be more worried about the wider implications that creates.

iCloud needs to allow people to restore backups on a new iPhone after losing their old one.

You can setup secure encrypted backups, but the customer losing the key means losing the back so that’s not what consumer focused companies are going to do. In other words any backup service that doesn’t have big warnings that losing your key loses your backup means they can read your data.

Re: Apple plans to scan US iPhones for child abuse imagery

#286

Post by diebeforei485 »

macintux wrote: post #267
smnrchrds wrote: post #245

Earlier quoted context omitted.

What law prompted this new feature we are discussing here?

I don’t know, and I’m certainly troubled by the story. There is a federal law requiring electronic service providers to notify if they spot such material. Apple may be subject to that. See the “Federal CSAM Law” section here: https://cyberlaw.stanford.edu/blog/2020/01/earn-it-act-how-b...

Wow. Okay, so my theory about them trying to stave off future legislation is likely correct.

Re: Apple plans to scan US iPhones for child abuse imagery

#287

Post by trasz »

ggreer wrote: post #258
trasz wrote: post #203

Earlier quoted context omitted.

Never ceases to amaze how people believe that China is somehow more oppressive than the the country with world highest incarceration rate.

The US has a high incarceration rate because it has a high crime rate. If EU countries had US levels of crime, they'd have US levels of incarceration. Also China doesn't count Uyghurs as incarcerated despite the fact that the PRC is committing genocide against them.[1] The PRC imprisons almost 2 million of Uyghurs a year. Of those, around a quarter million die. Oh and there's the forced sterilizations, destruction of…

US has a high crime rate, because it has laws introduced specifically to increase the crime rate in specific racial groups; that’s where the War on Drugs came from.

China doesn’t count Uyghur extremists as incarcerated for the same reason the US doesn’t count their brethren it kills en masse in Middle East as death sentences. It’s just a different thing.

As for the rest of the list - most of it is just US state propaganda calling resocialization programs “brainwashing”, or leveling commercial buildings built without building permit “destruction of churches”. Some of that works exactly the same in US (forced labor), or is just entirely made up (“quarter million die”).

Now, some of the stuff is a real problem of course - death sentences and organ harvesting - but throwing it together with the usual US propaganda doesn’t help the cause.

Re: Apple plans to scan US iPhones for child abuse imagery

#288

Post by yellow_lead »

heavyset_go wrote: post #265
yellow_lead wrote: post #247

Earlier quoted context omitted.

Yep, Google can break SHA1, so what hash are they using? Proprietary information I assume.

They aren't using file hashes like SHA1, but perceptual hashes and then a fuzzy metric like hamming distance to make a fuzzy match. It's entirely possible for two images that have nothing to do with each other to have similar hashes.

Wow. That's much worse.

Re: Apple plans to scan US iPhones for child abuse imagery

#289

Post by partiallypro »

GeekyBear wrote: post #77
partiallypro wrote: post #14

I really don't see how this is going to end well, there could be perfectly innocent photos on someone's phone of their own children doing perfectly normal things that kids do. Like a kid running butt naked around the house, or a photo of something like a rash that is sent to a nurse friend for advice on what it is etc. I'm all for protecting children from being abused, but how are they going to filter what is normal…

Microsoft implemented this a decade ago. >The system that scans cloud drives for illegal images was created by Microsoft and Dartmouth College and donated to NCMEC. The organization creates signatures of the worst known images of child pornography, approximately 16,000 files at present. These file signatures are given to service providers who then try to match them to user files in order to prevent further distributi…

Again, that is not the same as scanning a local machine for it. That is all things that are on Microsoft's own servers or in their search results. Microsoft, Google, Cloudflare all have features like this. It's not the same as scanning local machines.

Re: Apple plans to scan US iPhones for child abuse imagery

#290

Post by heavyset_go »

mkoryak wrote: post #19

Hopefully they are using phash to match the phone's images to known child abuse image hashes, because if they are using ML, I can only imagine what a false positive will do to someone's life.

Phashes can have collisions, and the false positive rate increases exponentially when you use a fuzzy metric like hamming distance to find derivatives of a source image.
Post reply on HN