Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's child protection features spark concern within its own ranks: sources

reuters.com

Post reply on HN
Print view View original

671–680 of 860 posts

Re: Apple's child protection features spark concern within its own ranks: sources

#671

Post by fsflover »

zepto wrote: post #198
jmull wrote: post #167

I just do not want Apple scanning my phone for the purpose of finding something they can send to the police. I’m not even talking about any “slippery slope” scenarios and I’ll never have any of the material they are looking for. And right or wrong, I don’t really fear a false identification, so this isn’t about a worry that they will actually turn me in. I just don’t want them scanning my phone for the purpose of tur…

This is the most honest take on this that I’ve seen. The slippery slope arguments don’t make sense, nor does the risk of false positives. But the idea of being suspected even in this abstract way, because of something other people do , is at the very least distasteful, bordering on offensive.

> The slippery slope arguments don’t make sense

Yes, they do: https://news.ycombinator.com/item?id=28160092

Re: Apple's child protection features spark concern within its own ranks: sources

#672

Post by vimacs2 »

new_realist wrote: post #462
hn_throwaway_99 wrote: post #337

Earlier quoted context omitted.

I disagree, strongly. Let's say you're authoritarian government EvilGov. Before this announcement, if you went to Apple and said "we want you to push this spyware to your iPhones", Apple would and could have easily pushed back both in the court of public opinion and the court of law. Now though, Apple is already saying "We'll take this database of illegal image hashes provided by the government and use it to scan you…

Authoritarian governments have never needed preexisting technical gizmos in order to abuse their citizens. Look at what Russia and the Nazis did with no magic tech at all. Privacy stems from valuing human rights, not easily disproven lies about it being difficult to actually implement the spying.

"easily disproven lies", what lies exactly?

Even a Jew stuck in a ghetto in Nazi Germany enjoyed significantly better privacy at home from both the state and capital than a wealthy citizen in a typical western liberal nation today.

Soviet Russia and Nazi Germany in fact prove the exact opposite of what point you think you're making. They were foremost in using the "magic tech" of their day - telecommunications and motorised vehicles.

Even then, they had several rebellions and uprisings that were able to develop thanks to lacking the degree of surveillance tech found today.

Re: Apple's child protection features spark concern within its own ranks: sources

#673

Post by spuz »

glogla wrote: post #560
spuz wrote: post #546

Earlier quoted context omitted.

The point is that with this technology, Apple can now please both the government and Apple users that want their data in the cloud to be fully encrypted. First they enable this technology to prove to the government that they can still scan for bad stuff, then they enable true E2E. I don't know if this is really their motivation but it sounds plausible to me.

If they scan on device unencrypted and report what they found (even if it's child porn now, we know that is not going to last), they made the e2e effectivelly useless. The point of end to end enceyption is to make the data accessible to just one or two people - and that is not fulfilled here. EDIT: though you are right - they can please governments by making encryption useless while lying to people they still have it…

The difference between Apple being able to scan data on your phone vs on their servers comes down to who is able to access your data. In both cases, Apple has access. But by storing both your data and your keys somewhere in their cloud servers, that data becomes available to governments with the appropriate subpoena, rogue Apple employees and hackers. None of that would be possible with true E2E encryption.

It seems plausible to me that Apple might believe some of their privacy conscious users would prefer this situation and hence "privacy" can be considered a plausible explanation for their actions here.

Re: Apple's child protection features spark concern within its own ranks: sources

#674

Post by sneak »

unityByFreedom wrote: post #439

Good. I would be furious if I worked there. After the San Bernardino case, I viewed them as the paragon of privacy and security, to the extent I ignored most criticisms, including their lack of support for right-to-repair and concerns over App Store rejections. All of that is back on the table for me after this decision. It is out-of-step with everything they've been doing up to this point, and it makes me wonder who…

Apple turned over all of the San Bernardino iPhone data, as iCloud Backup information is not e2e encrypted and is readable in full by Apple without ever touching or decrypting the phone.

The Apple vs FBI narrative was a coordinated marketing move (coordinated between the FBI and Apple) to push that "paragon of privacy and security" brand message. It's false.

Apple explicitly preserves a non-e2e backdoor in their cryptography for the FBI:

https://mobile.reuters.com/article/amp/idUSKBN1ZK1CT

It's not out of step at all. Apple actively cooperates with the FBI, both operationally and in product planning/design phases.

Re: Apple's child protection features spark concern within its own ranks: sources

#675

Post by burkaman »

argvargc wrote: post #634
jmull wrote: post #167

I just do not want Apple scanning my phone for the purpose of finding something they can send to the police. I’m not even talking about any “slippery slope” scenarios and I’ll never have any of the material they are looking for. And right or wrong, I don’t really fear a false identification, so this isn’t about a worry that they will actually turn me in. I just don’t want them scanning my phone for the purpose of tur…

Who wants their printer to scan every document they print, and if it sees something the printer manufacturer thinks is illegal it's reported to the police? Or their TV scans every frame displayed and every word said if it sees anything the TV manufacturer thinks is illegal it's reported to the police? Or their blender has an array of chemical sensors in it, and if it detects a substance the manufacturer thinks is ill…

> Who wants their printer to scan every document they print, and if it sees something the printer manufacturer thinks is illegal it's reported to the police?

FYI most (all?) modern printers will refuse to print anything they think is counterfeit money, and will include a unique code traceable back to you in every printed document. - https://en.wikipedia.org/wiki/Machine_Identification_Code

Re: Apple's child protection features spark concern within its own ranks: sources

#676

Post by pdabbadabba »

hypothesis wrote: post #597
M4v3R wrote: post #574

Earlier quoted context omitted.

Please do not spread misinformation. The system DOES scan your local device for photos that match CSAM hashes that are downloaded to the device. What you probably meant is that currently it is only enabled if you have iCloud Photos enabled (which almost everyone has), but now that the mechanism for client-side scanning is in place there’s nothing preventing them to turn it on later regardless of your user settings.

I don’t like that system, but according to their summary document, CSAM detection system is only (as described today) processing images that are uploaded to iCloud. [1] https://www.apple.com/child-safety/pdf/Expanded_Protections_...

Please look more carefully at that document. It says, on page 5: "Instead of scanning images in the cloud, the system performs on-device matching using a database of known CSAM image hashes provided by NCMEC and other child safety organizations."

And look at the diagram. The matching of image hashes with user photos occurs "on device."

Re: Apple's child protection features spark concern within its own ranks: sources

#677

Post by spuz »

pseudalopex wrote: post #568
spuz wrote: post #546

Earlier quoted context omitted.

The point is that with this technology, Apple can now please both the government and Apple users that want their data in the cloud to be fully encrypted. First they enable this technology to prove to the government that they can still scan for bad stuff, then they enable true E2E. I don't know if this is really their motivation but it sounds plausible to me.

True E2E means the middle can't decrypt anything. You meant false E2E.

No, I meant true E2E encryption. Unless I'm missing something in your comment.

Re: Apple's child protection features spark concern within its own ranks: sources

#678

Post by rootusrootus »

farmerstan wrote: post #156
jonplackett wrote: post #5

In their attempt to make this extra private by scanning 'on device', I think they've managed to make it feel worse. If they scan my iCloud photos in iCloud, well lots of companies scan stuff when you upload it. It's on their servers, they're responsible for it. They don't want to be hosting CSAM. It feels much worse them turning your own, trusty iPhone against you. I know that isn't how you should look at it, but tha…

In a few years, all the pedophiles will stop using iPhone, and then only innocent people will be scanned in perpetuity. Remember, if someone makes new CSAM, it won't match any hashes so even "new" pedophiles won't get caught by this. So really, the steady state is just us regular folks getting scanned. As the years go on, what is defined as CSAM will morph into "objectionable material", and will then include "misinfo…

> if someone makes new CSAM, it won't match any hashes so even "new" pedophiles won't get caught by this.

That assumes the hashes aren't recorded permanently.

Re: Apple's child protection features spark concern within its own ranks: sources

#679

Post by m4rtink »

least wrote: post #131
totetsu wrote: post #110

Earlier quoted context omitted.

But with a debian package you can choose not to accept the upgrade and see any funny business in the release source code..

That is technically true but in a real very practical sense everyone here using OSS absolutely is trusting a third party because they are not auditing every bit of code they run. For less technical people there is effectively zero difference between open and closed software. It’s really disingenuous to suggest that open source isn’t dependent on trust, you just change who you are trusting. Even if the case is someone…

Maybe if you drink from the NPM PyPI firehouse without checking (as too many do unfortunately).

For regular Linux distribution there are maintainers updating packages from upstream source that can spot malicious changes slipped in upstream. And if maintainers in one district don't notice, it is likely some in onether distro will.

And there are LTS/enterprise distros where upstream changes take much longer to get in and the distro does not change much after release. Making it even less likely a sudden malicious change will get in unnoticed.

Re: Apple's child protection features spark concern within its own ranks: sources

#680

Post by cucumb3rrelish »

pdabbadabba wrote: post #676
hypothesis wrote: post #597

Earlier quoted context omitted.

I don’t like that system, but according to their summary document, CSAM detection system is only (as described today) processing images that are uploaded to iCloud. [1] https://www.apple.com/child-safety/pdf/Expanded_Protections_...

Please look more carefully at that document. It says, on page 5: "Instead of scanning images in the cloud, the system performs on-device matching using a database of known CSAM image hashes provided by NCMEC and other child safety organizations." And look at the diagram. The matching of image hashes with user photos occurs "on device."

On device != Scanning your device. It scans your iCloud uploads and if configured, iMessages (which you didnt mean, because that doesnt work with hashes)
Post reply on HN