Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's child protection features spark concern within its own ranks: sources

reuters.com

Post reply on HN
Print view View original

801–810 of 860 posts

Re: Apple's child protection features spark concern within its own ranks: sources

#801

Post by alwillis »

noduerme wrote: post #588
alwillis wrote: post #502

Earlier quoted context omitted.

Except for the "oops, due to an unexpected bug in our code, every image, document, and message on your device was being continuously scanned" mea culpa we will see a few months after this goes live. Only images that match the hashes of the database of CSAM held by the National Center for Missing and Exploited Children (NCMEC) that are uploaded to iCloud Photos are checked. Based on their technical documents, it's not…

>>> Only images that match the hashes of the database of CSAM held by the National Center for Missing and Exploited Children (NCMEC) that are uploaded to iCloud Photos are checked. Incorrect. All files on the phone will be checked against a hash database before being uploaded to iCloud. Any time before, which means all the time, if you have iCloud enabled.

All files on the phone will be checked against a hash database before being uploaded to iCloud.

A cryptographic safety voucher is created for each photo as they're uploaded. The iPhone doesn't know wether or not anything matched. Nothing happens unless the user reaches a threshold of 30 CSAM images that have been uploaded to iCloud Photos.

Re: Apple's child protection features spark concern within its own ranks: sources

#802

Post by nextlevelwizard »

goldenkey wrote: post #790
nextlevelwizard wrote: post #768

Earlier quoted context omitted.

Thanks for that, I still dont get why this is such a big privacy concern for everyone.

You're welcome. I think the crux is that people are worried about the police knocking at their door and/or inspecting their photos due to mismatching on this purportedly unreliable hash method.

That feels like purposefully misundertanding the situation. The hash match only escalates the matter to a human inspection. In no sane world is that inspection done physically. It means that if your picture approximitely matches a known abuse picture someone gets to view it to verify if it contains abuse or not and then potential legal actions can be taken.

Police knocking down your door will only happen if you are found to posses multiple abuse pictures and they suspect you might be endagering people.

Re: Apple's child protection features spark concern within its own ranks: sources

#803

Post by jjgreen »

grkvlt wrote: post #689
jjgreen wrote: post #667

Earlier quoted context omitted.

For example, the UK switched its organ donation laws from opt-in to opt-out. We have, yet oddly, it's still called "organ donation".

don't be disingenuous - fairly obviously it is a donation because it is optional, voluntary and non-compensated.

voluntary (adjective) done, made, or given willingly, without being forced or paid to do it (Cambridge)

How is my will involved here?

Re: Apple's child protection features spark concern within its own ranks: sources

#805

Post by pritambaral »

zepto wrote: post #791
pritambaral wrote: post #787

Earlier quoted context omitted.

How are you still not getting this?: "search" and "spotlight" do not have the code to report anything to anyone.

How are you still not getting it? The code to ‘report’ something is barely more than a one liner http request. It could be added at any time. On the other hand, making the CSAM code scan your text documents would be pointlessly difficult given that the other mechanisms exist.

> It could be added at any time.

It has already been added. That's the point here. The phone already has the code to report its own owner. People are rightfully pissed about that.

Also, adding a one-liner of code is a lot more than a bit-flip. That's the addition of a feature, which is a major business decision. Code that already exists is a lot closer to "misfiring" than code that simply does not. Flipping a policy config, OTOH, could be "explained" away a lot easier. In fact, Big Tech does it all the time! (Remember Facebook's "Oh. Sorry. It was a bug."?)

----

Please stop this poor attempt at moving the goalposts by saying, "But, similar code could be added at any time in the future! Why're you guys complaining now?!"

It's also not about where the scanning is happening, or whether that's new or old. The old scanning is not a problem, precisely because it does no reporting. The new scanning IS a problem, precisely because it does the reporting.

The former is not a problem on its own. The latter is. That's the point you keep missing.

Re: Apple's child protection features spark concern within its own ranks: sources

#806

Post by goldenkey »

nextlevelwizard wrote: post #802
goldenkey wrote: post #790

Earlier quoted context omitted.

You're welcome. I think the crux is that people are worried about the police knocking at their door and/or inspecting their photos due to mismatching on this purportedly unreliable hash method.

That feels like purposefully misundertanding the situation. The hash match only escalates the matter to a human inspection. In no sane world is that inspection done physically. It means that if your picture approximitely matches a known abuse picture someone gets to view it to verify if it contains abuse or not and then potential legal actions can be taken. Police knocking down your door will only happen if you are f…

Could be as simple as you bathing your kid in the tub. Why cede power to arcanists?

Re: Apple's child protection features spark concern within its own ranks: sources

#807

Post by benmmurphy »

spacedcowboy wrote: post #745
hn_throwaway_99 wrote: post #337

Earlier quoted context omitted.

I disagree, strongly. Let's say you're authoritarian government EvilGov. Before this announcement, if you went to Apple and said "we want you to push this spyware to your iPhones", Apple would and could have easily pushed back both in the court of public opinion and the court of law. Now though, Apple is already saying "We'll take this database of illegal image hashes provided by the government and use it to scan you…

There is so much disinformation about this with people not being informed. Apple have put out clear documentation, it would be a good idea to read it before fear-mongering. 1) The list of CSAM hashes is that provided by the relevant US government agency, that is it. 2) The project is not targeted to roll out anywhere other than the USA. 3) The hashes are baked into the OS, there is no capability to update them other…

Regarding 3: it’s very easy to make a mistake in the protocol that would allow apple to detect hashes outside the CSAM list. Without knowing exactly how their protocol works it’s difficult to know whether it is correct.

https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...

For example here is a broken PSI protocol in terms of point 3. I don’t think normally in PSI this is considered broken because the server knows the value so it is part of its private set.

Server computes M_s = g . H(m) . S_s

where g is a generator of an elliptic curve, H(m) is the neural hash of the image and S_s is the server blinding secret.

The client computes M_sc = M_s . S_c where S_c is the client ephemeral secret. This M_sc value is the shared key.

The client also computes M_c = g . H(m) . S_c

and sends the M_c value to the server.

The server can now compute M_cs = M_c . S_s = M_sc since they both used the same H(m) values. This allows the server and client to share a key based on the shared image.

However, what happens if the client does it’s step using the ‘wrong’ image. If 3) is to hold it should not be possible for the server to compute the key.

Client computes:

  M_sc = M_s . S_c

  M_c = g. H(m’) . S_c
The clients final key share is: M_sc = g . H(m) . S_c . S_s

Now server computes: M_cs = M_c . S_s = g . H(m’) . S_c . S_s

The secret shares don’t match. But if the server knows H(m’) it can compute:

M_cs’ = M_cs . inv(H(m’)) . H(m)

and this secret share will match

Normally this client side list in PSI is just used to speed up the protocol so the server does not have to do a crypto operation for every element in its set. It is not a pre-commitment from the server.

Also, maybe the way I’m doing it here is just normally broken because it is not robust against low entropy inputs to the hash function.

I've also reversed some of apple's non-public crypto that is used in some of it's services and they have made dubious design decisions in the past they have created weird weaknesses. Without knowing exactly what they are doing I would not try and infer properties that might not exist or trust their implementation.

Re: Apple's child protection features spark concern within its own ranks: sources

#808

Post by codedokode »

prophesi wrote: post #747
porpoisemonkey wrote: post #731

Earlier quoted context omitted.

> Indeed, up until reading these comments I had no idea that iCloud wasn’t encrypted. iCloud data is encrypted at rest (edit: except for Mail apparently). The type of encryption (service or end-to-end [E2E]) is specified here: https://support.apple.com/en-us/HT202303 It can be argued that from a user's viewpoint not having E2E encryption is tantamount to not having encryption at all, but from a technical standpoint t…

This is more from Schneier's book, but I would say the most import reason E2E encryption should be the default is that in the event of a data breach, nothing would be lost. If a company's servers are hacked, they'd have access to the symmetrical encryption keys, and therefore all of the data. It also ensures that the company can't be selling/sharing your data, as they don't have access to it in the first place. Edit:…

What are the advantages of having unencrypted cloud backups? The only advantage is that authoritarian governments can better control their citizens. Apple is playing on the side of dictators instead of protecting their users.

Re: Apple's child protection features spark concern within its own ranks: sources

#809

Post by ctdonath »

brandon272 wrote: post #730
ElFitz wrote: post #564

Earlier quoted context omitted.

Those already doing far worse than banning a consumer electronics company's products? And, in all honesty, there's a lot of those.

I meant in the context of U.S. governments. What Democrat administration wants to ban Apple? What Republican administration wants to ban Apple? Sounds like political suicide on either side: government interference with the country's largest company, an iconic brand, for no reason other than to hopefully spy more on your citizens.

Analogy: the prospect of “vaccine passports” for jurisdictional movement and access is getting serious consideration at all levels of U.S. governance. Not long ago, anything so resembling “papiere, bitte” commonly inspired a sense of violent resistance against totalitarianism. Just takes one engaging “but this is different” to reframe the worst of humanity to popular compulsion.

Re: Apple's child protection features spark concern within its own ranks: sources

#810

Post by simion314 »

zepto wrote: post #800
simion314 wrote: post #799

Earlier quoted context omitted.

You misunderstand my comment, maybe is my fault. Let's say the threshold is 10 , you trigger the threshold so Apple checks all the 10 images , but 9 are false possitive and one appears to be a correct match, Apple will report you for 1 image ... so my point is that is not designed to catch people with big collections of CP, is designed to not trigger to often.

Ok, but the threshold is 30. It seems unlikely to be a problem.

Yeah, I was commenting about the "collection" part of the comment.
Post reply on HN