Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The deceptive PR behind Apple’s “expanded protections for children”

piotr.is

Post reply on HN
Print view View original

41–50 of 595 posts

Re: The deceptive PR behind Apple’s “expanded protections for children”

#41

Post by sa1 »

gonehome wrote: post #21
samename wrote: post #11

Earlier quoted context omitted.

John Gruber is biased because his brand is closely tied to Apple’s brand. Ben Thompson wrote a better review on the topic: https://stratechery.com/2021/apples-mistake/ There’s also the Op-Ed by Matthew Green and Alex Stamos, cyber security researchers: https://www.nytimes.com/2021/08/11/opinion/apple-iphones-pri...

They have a podcast together called Dithering which is pretty good (but not free) - they're friends. I think John's article is better than Ben's, but they're both worth reading. Ben takes the view that unencrypted cloud is the better tradeoff - I'm not sure I agree. I'd rather have my stuff e2ee in the cloud. If the legal requirements around CSAM are the blocker then Apple's approach may be a way to thread the needle…

For me it's the worst of both worlds - e2ee has no meaning if the ends are permanently compromised - and there's no local vs cloud separation anymore which you can use to delineate what is under your own control - nothing's under your control.

Re: The deceptive PR behind Apple’s “expanded protections for children”

#42

Post by pvarangot »

seph-reed wrote: post #9

I really don't see why the scanning would ever be done on the phone instead of on iCloud if it only affects iCloud images. But I do have guesses why.

This article speculates that that's because Apple is not scanning on iCloud to respect their privacy policy: https://www.hackerfactor.com/blog/index.php?/archives/929-On...

Apple's report count to the NCMEC is really low so it's probably true that they are not scanning on iCloud unless they receive a warrant.

Re: The deceptive PR behind Apple’s “expanded protections for children”

#43

Post by pvarangot »

spoonjim wrote: post #19

Any idea why Apple didn’t just implement server side scanning like everyone else?

This article speculates that that's because Apple is not scanning on iCloud to respect their privacy policy: https://www.hackerfactor.com/blog/index.php?/archives/929-On...

Apple's report count to the NCMEC is really low so it's probably true that they are not scanning on iCloud unless they receive a warrant.

Re: The deceptive PR behind Apple’s “expanded protections for children”

#44

Post by still_grokking »

slownews45 wrote: post #13
gonehome wrote: post #6

Earlier quoted context omitted.

It's worth reading this, which is basically the only good reporting I've seen on this topic: https://daringfireball.net/2021/08/apple_child_safety_initia... There are legitimate things to be concerned about, but 99% of internet discussion on this topic is junk.

Even HN reporting / article linking / comments have been surprisingly low quality and seem to fulminate and declaim with surprisingly little interesting conversation and tons of super big assertions. Linked articles and comments have said apple's brand is now destroyed, that apple is committing child porn felonies somehow with this (the logical jumps and twisting to get to these claims are very far from strong plausi…

From https://www.hackerfactor.com/blog/index.php?/archives/929-On...

> The laws related to CSAM are very explicit. 18 U.S. Code § 2252 states that knowingly transferring CSAM material is a felony. (The only exception, in 2258A, is when it is reported to NCMEC.) In this case, Apple has a very strong reason to believe they are transferring CSAM material, and they are sending it to Apple -- not NCMEC.

> It does not matter that Apple will then check it and forward it to NCMEC. 18 U.S.C. § 2258A is specific: the data can only be sent to NCMEC. (With 2258A, it is illegal for a service provider to turn over CP photos to the police or the FBI; you can only send it to NCMEC. Then NCMEC will contact the police or FBI.) What Apple has detailed is the intentional distribution (to Apple), collection (at Apple), and access (viewing at Apple) of material that they strongly have reason to believe is CSAM. As it was explained to me by my attorney, that is a felony.

Apple is going to commit child porn felonies according to US law this way. This claim seems actually quite irrefutable.

Re: The deceptive PR behind Apple’s “expanded protections for children”

#45

Post by zionic »

slownews45 wrote: post #13
gonehome wrote: post #6

Earlier quoted context omitted.

It's worth reading this, which is basically the only good reporting I've seen on this topic: https://daringfireball.net/2021/08/apple_child_safety_initia... There are legitimate things to be concerned about, but 99% of internet discussion on this topic is junk.

Even HN reporting / article linking / comments have been surprisingly low quality and seem to fulminate and declaim with surprisingly little interesting conversation and tons of super big assertions. Linked articles and comments have said apple's brand is now destroyed, that apple is committing child porn felonies somehow with this (the logical jumps and twisting to get to these claims are very far from strong plausi…

You don’t. That’s the entire point of E2EE, the data transferred is private between you and the recipient party.

Re: The deceptive PR behind Apple’s “expanded protections for children”

#46

Post by ursugardaddy »

gonehome wrote: post #6
querez wrote: post #2

I have a newborn at home, and like every other parent, we take thousands of pictures and videos of our newest family member. We took pictures of the very first baby-bath. So now I have pictures of a naked baby on my phone. Does that mean that pictures of my newborn baby will be uploaded to Apple for further analysis, potentially stored for indefinite time, shared with law enforcement?

It's worth reading this, which is basically the only good reporting I've seen on this topic: https://daringfireball.net/2021/08/apple_child_safety_initia... There are legitimate things to be concerned about, but 99% of internet discussion on this topic is junk.

It's still a non-zero chance it triggers a no-knock raid by the police that kills your family or pets.

it happens all the time

Re: The deceptive PR behind Apple’s “expanded protections for children”

#47

Post by lawkwok »

spoonjim wrote: post #19

Any idea why Apple didn’t just implement server side scanning like everyone else?

In this TechCrunch interview, Apple believes it is less invasive since no one can be individually targeted.

The hashes are hard coded into each iOS release which is the same for all iOS devices. The database is not vulnerable to server side changes.

Additionally, FWIW, they do not want to start analyzing entire iCloud photo libraries so this system only analyzes new uploads.

https://techcrunch.com/2021/08/10/interview-apples-head-of-p...

Re: The deceptive PR behind Apple’s “expanded protections for children”

#48

Post by rootusrootus »

mortenjorck wrote: post #35
spoonjim wrote: post #19

Any idea why Apple didn’t just implement server side scanning like everyone else?

As covered in other articles, that is exactly what they were doing previously.

I'm not so sure. John Gruber's write-up said that Apple has only sent over a couple hundred reports in the last year to the gov't, compared to over 20 million from Facebook. This suggests to me that Apple's scanning wasn't nearly so widespread.

Re: The deceptive PR behind Apple’s “expanded protections for children”

#49

Post by gonehome »

sa1 wrote: post #41
gonehome wrote: post #21

Earlier quoted context omitted.

They have a podcast together called Dithering which is pretty good (but not free) - they're friends. I think John's article is better than Ben's, but they're both worth reading. Ben takes the view that unencrypted cloud is the better tradeoff - I'm not sure I agree. I'd rather have my stuff e2ee in the cloud. If the legal requirements around CSAM are the blocker then Apple's approach may be a way to thread the needle…

For me it's the worst of both worlds - e2ee has no meaning if the ends are permanently compromised - and there's no local vs cloud separation anymore which you can use to delineate what is under your own control - nothing's under your control.

The end isn't really compromised with their described implementation.

The only thing sent is the hash and signature and that's only if there are enough matches to pass some threshold.

I don't really view that as 'permanently compromised' - at least not in any way more serious that Apple's current capabilities to compromise a device.

I think e2ee still has meaning here - it'd prevent Apple from being able to see your photo content on their servers.

This is a nuanced issue, I don't think there's an obviously better answer and both outcomes have different risks. [0]

[0]: https://www.lesswrong.com/posts/PeSzc9JTBxhaYRp9b/policy-deb...

Re: The deceptive PR behind Apple’s “expanded protections for children”

#50

Post by zionic »

slownews45 wrote: post #5
querez wrote: post #2

I have a newborn at home, and like every other parent, we take thousands of pictures and videos of our newest family member. We took pictures of the very first baby-bath. So now I have pictures of a naked baby on my phone. Does that mean that pictures of my newborn baby will be uploaded to Apple for further analysis, potentially stored for indefinite time, shared with law enforcement?

If you don't choose upload to icloud, no upload to apple at all. If you do choose icloud upload (most do), they were being uploaded already and stored and may be available to law enforcement. If you do upload to icloud, NOW they will be screened for matches with "known" images in a database, and if you have more than a threshold number of hits, you may be reported. This will happen on device. Apple will also scan pho…

Disabling iCloud does not remove the scanning system or it’s database from your phone.
Post reply on HN