Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The deceptive PR behind Apple’s “expanded protections for children”

piotr.is

Post reply on HN
Print view View original

311–320 of 595 posts

Re: The deceptive PR behind Apple’s “expanded protections for children”

#311

Post by vineyardmike »

slownews45 wrote: post #258
mdoms wrote: post #176

Earlier quoted context omitted.

Sorry under which of these other moderation regimes does the organisation in question transmit CSAM from a client device to their own servers? To my knowledge Apple is the only one doing so.

Almost every single one. Facebook checks for potential CSAM when you upload from your client device (sometimes an iphone) to their servers or after it's on their system and a user flags it. Instagram also check once you upload. These are all transmissions. Apple checks if you upload. If you don't upload or attempt to upload to their servers, no check. All these are to flag potential CSAM. Some do more - nudity in gen…

> Facebook checks for potential CSAM when you upload from your client device (sometimes an iphone) to their servers or after it's on their system and a user flags it.

Thats not the issue according to the linked source.

Instagram transmits all photos and assumes it's not CSAM until flagged - thats safe content. Apple transmits ONLY CSAM - thats a no-no content because they're assuming it is CSAM and you can't transmit CSAM.

You can't knowingly transmit CSAM. Transmitting a photo pre-scan is safe (if you assume any photo is not csam), transmitting post-scan is dangerous if you filter for csam.

Re: The deceptive PR behind Apple’s “expanded protections for children”

#312

Post by stetrain »

farmerstan wrote: post #241
fortenforge wrote: post #229

Earlier quoted context omitted.

There are numerous incorrect statements in your comment. First: Apple has disclosed who gets to curate the hash list. The answer is NCMEC and other child safety organizations. https://twitter.com/AlexMartin/status/1424703642913935374/ph... Apple states point-blank that they will refuse any demands to add non-CSAM content to the lists. Second: Why can't the FBI / CCCP inject a hash into the list. Here's a tweet thread…

How do you know there aren’t bad actors working at the NCMEC? If I know that adding a hash to a list will get it flagged, and I could conveniently arrest or discredit anyone I wanted, I would certainly send people to work there. How will Apple know whether a hash is for non-CSAM content? Spoiler alert: they won’t. And Apple claims it will be reviewed by a human. Sure, just like YouTube copyright claims? Or will it ge…

If you don’t trust what Apple says about this, why even argue?

Apple could be doing all of this and more without telling.

I agree with you on the point that the concern here is what various governments may mandate, but if we’re going to argue about Apple’s specific implementation you should probably understand it.

Re: The deceptive PR behind Apple’s “expanded protections for children”

#313

Post by cucumb3rrelish »

farmerstan wrote: post #241
fortenforge wrote: post #229

Earlier quoted context omitted.

There are numerous incorrect statements in your comment. First: Apple has disclosed who gets to curate the hash list. The answer is NCMEC and other child safety organizations. https://twitter.com/AlexMartin/status/1424703642913935374/ph... Apple states point-blank that they will refuse any demands to add non-CSAM content to the lists. Second: Why can't the FBI / CCCP inject a hash into the list. Here's a tweet thread…

How do you know there aren’t bad actors working at the NCMEC? If I know that adding a hash to a list will get it flagged, and I could conveniently arrest or discredit anyone I wanted, I would certainly send people to work there. How will Apple know whether a hash is for non-CSAM content? Spoiler alert: they won’t. And Apple claims it will be reviewed by a human. Sure, just like YouTube copyright claims? Or will it ge…

By the same logic, how do you know there aren't bad actors working at Apple's software teams? Or your insurance company or bank?

Re: The deceptive PR behind Apple’s “expanded protections for children”

#314

Post by FabHK »

lixtra wrote: post #231
FabHK wrote: post #159

Earlier quoted context omitted.

> Since it is illegal to share those hashes in any way or form Source? (The link you provide does not claim that, as far as I could see.)

The article claims that photoDNA is reversible to 26x26 images and claims that the hashes are therefore CP.

Ah, right. But Apple is using NeuralHash, not photoDNA, right? Does that suffer the same problem?

Re: The deceptive PR behind Apple’s “expanded protections for children”

#315

Post by FabHK »

From A Concrete-Security Analysis of the Apple PSI Protocol:

> Taking action to limit CSAM is a laudable step. But its implementation needs some care. Naively done, it requires scanning the photos of all iCloud users. But our photos are personal, recording events, moments and people in our lives. Users expect and desire that these remain private from Apple. Reciprocally, the database of CSAM photos should not be made public or become known to the user. Apple has found a way to detect and report CSAM offenders while respecting these privacy constraints. When the number of user photos that are in the CSAM database exceeds the threshold, the system is able to detect and report this. Yet a user photo that is not in the CSAM database remains invisible to the system, and users do not learn the contents of the CSAM database.

https://www.apple.com/child-safety/pdf/Alternative_Security_...

Re: The deceptive PR behind Apple’s “expanded protections for children”

#316

Post by windexh8er »

stickfigure wrote: post #213
fortenforge wrote: post #137

Earlier quoted context omitted.

Lots of people responding to this seem to not understand how perceptual hashing / PhotoDNA works. It's true that they're not cryptographic hashes, but the false positive rate is vanishingly small. Apple claims it's 1 in a trillion [1], but suppose that you don't believe them. Google and Facebook and Microsoft are all using PhotoDNA (or equivalent perceptual hashing schemes) right now. Have you heard of some massive i…

The false positive rate for any given image is not 1 in a trillion. Perceptual hashing just does not work like that. It also suffers from the birthday paradox problem - as the database expands, and the total number of pictures expands, collisions become more likely. The parent poster does make the mistake of assuming that other pictures of kids will likely cause false positives. Anything could trigger a false positiv…

> The false positive rate for any given image is not 1 in a trillion. Perceptual hashing just does not work like that. It also suffers from the birthday paradox problem - as the database expands, and the total number of pictures expands, collisions become more likely.

There was a good article [0] that was on HN a couple days ago that touches on the flat out lie regarding "one in a trillion" and how PhotoDNA sounds poorly thought out.

[0] https://www.hackerfactor.com/blog/index.php?/archives/929-On...

Re: The deceptive PR behind Apple’s “expanded protections for children”

#317

Post by nabakin »

lawkwok wrote: post #161
Dah00n wrote: post #109

Earlier quoted context omitted.

>The hashes are hard coded into each iOS release Do you have a source on that? Since it is illegal to share those hashes in any way or form. Even people working with photo forensic and big photo sharing sites cannot get access to them. I very much doubt Apple can incorporate them into the iOS release without breaking multiple laws. The hashes themselves can easily be reversed to (bad quality) pictures so having the h…

From the interview I linked, Apple Privacy head Erik Neuenschwander said, “The hash list is built into the operating system, we have one global operating system and don’t have the ability to target updates to individual users and so hash lists will be shared by all users when the system is enabled.” Where did you hear sharing hashes is illegal? How would anybody determine whether CASM at scale without those hashes? Y…

The important part about the hackerfactor link is that the author claims he was able to reverse PhotoDNA hashes into images. Of course Apple has their own, different perceptual hashing algorithm NeuralHash which they use, but if the hashes of a similar system can be reversed into images, maybe NeuralHash hashes can be reversed as well. Therein lies the problem.

Edit: i.e. OP isn't talking about MD5 hashes

Re: The deceptive PR behind Apple’s “expanded protections for children”

#318

Post by nicce »

farmerstan wrote: post #241
fortenforge wrote: post #229

Earlier quoted context omitted.

There are numerous incorrect statements in your comment. First: Apple has disclosed who gets to curate the hash list. The answer is NCMEC and other child safety organizations. https://twitter.com/AlexMartin/status/1424703642913935374/ph... Apple states point-blank that they will refuse any demands to add non-CSAM content to the lists. Second: Why can't the FBI / CCCP inject a hash into the list. Here's a tweet thread…

How do you know there aren’t bad actors working at the NCMEC? If I know that adding a hash to a list will get it flagged, and I could conveniently arrest or discredit anyone I wanted, I would certainly send people to work there. How will Apple know whether a hash is for non-CSAM content? Spoiler alert: they won’t. And Apple claims it will be reviewed by a human. Sure, just like YouTube copyright claims? Or will it ge…

> How will Apple know whether a hash is for non-CSAM content? Spoiler alert: they won’t

Spoiler alert: they are building the hashing algorithm, so there is at least someone to confirm everything in the beginning. They are not hashing hashes.

Stakes are so high in this game that they must be very careful in review. This is not about Youtube copyright claims.

> And what about in China?

I don’t think that China even cares a lot. It is mandatory to install some apps by law for some minorities. They have the surveillance already.

Re: The deceptive PR behind Apple’s “expanded protections for children”

#319

Post by treebot »

nicce wrote: post #256
ajsnigrutin wrote: post #226

Earlier quoted context omitted.

I hate ubuntu from the bottom of my heart, for breaking stuff and changing stuff that used to "just work" all the time, but 99.999% of the time, that means "background stuff", "normal users" never mess around with, and for normal users, a "usb key -> install -> next, next, next -> finish -> reboot" just works.

I used to use Ubuntu for many years, but it became a such bloatware. So many things what you don’t really need. Packages were sometimes also different compared to vanilla Debian. This caused issues in stability (talking more about feature set). Some advanced software just did not work, which worked on equivalent vanilla Debian. I might recommend Ubuntu for very beginner developer, but not to stick with it longer time…

Are Mac and Windows not also full of an enormous amount of crap that we don't need?

Re: The deceptive PR behind Apple’s “expanded protections for children”

#320

Post by nicce »

vineyardmike wrote: post #303
nicce wrote: post #188

Earlier quoted context omitted.

Actually, we don’t know yet whether you can access your photos from the web anymore after this update, because E2EE ”like” implementation. Protocol is rather device specific (while allowing multi-device), so it might not be enough to access or hack iCloud account to access the photos. So, things get complicated.

> because E2EE ”like” implementation. Did apple actually say photos would be e2ee or are we just assuming?

Did you read the spec? This is why the scanning happens on the device.
Post reply on HN