I’d argue their attempts at having a plan for CSAM were preempting these exact types of arguments being made in bad faith by governments like the UK, who are actively engaging children’s charities to give their goal of breaking e2ee have some emotional societal weight.

CSAM is a real problem. Its not merely emotional weight.

> give their goal of breaking e2ee have some emotional societal weight.

Breaking E2EE is their goal. CSAM is the McGuffin.

I don’t believe that anyone is saying that it isn’t. That doesn’t preclude the government from preventing a “real problem” going to waste.

Can your elaborate on your trigger here?

Why did you feel that the phrasing minimized it enough to miss the point?

I don’t read their comment as particularly triggered, but if you honestly think they were triggered by a reference to CSAM, this is a wildly inappropriate question to ask.

In general I think it is better to not project some emotional reading onto other people’s posts.

still don't get it, is this one of those things I'll magically be attuned to if I become a parent (but only maybe?), or does it require personal experience? or is there anything I can read about

Generally “triggered” is used to describe the recall of previous traumatic experiences, i.e,

https://en.m.wikipedia.org/wiki/Trauma_trigger

So it is obvious why somebody wouldn’t ask for more details on that sort of thing, right?

Maybe you are just using it to ask why they are annoyed, and weren’t aware of the specific definition that phrase?

People have definitely diluted the word trigger, and it is impossible to tell the difference between someone referencing a traumatic experience or something akin to annoyance or being distracted. 'Triggered my anxiety' where anxiety is also diluted to 'something I would prefer not to deal with'.

In this case, it seemed like the phrasing was enough to distract them from a discussion that didnt need to be derailed

Since you didn’t give any indication that you were using the “diluted” meaning, I’d say it is more accurate to say that you miscommunicated, rather than that anyone got distracted.

Okay I’ll take it

I was curious about why they felt compelled to take the thread that direction when the meaning was clear. They felt CSAM was being minimized when that was a red herring to the discussion.

It is bad when children are abused.

Many (most?) people feel this viscerally, regardless of personal experience of parenthood or of abuse. This why the "think of the children" rhetorical gambit works.

In general, people like to believe in fairness, and dislike it when bad things happen to those who can't be said to "deserve" it somehow. Thus child abuse is more universally reviled than the rape of adults, because it's a lot harder to justify a child "deserving" that. (See also: kicking a friendly dog as a way to show off that a fictional villain is irredeemable.)

For a non-sexual example, remember how the pictures in this article provoked a surprising upswing in horror amongst even very anti-refugee people? https://www.theguardian.com/world/2015/sep/02/shocking-image...

Has their been some massive increase in the amount of child abuse to justify the new paranoia I see in the media and with new laws? Perhaps a certain political party is taking advantage of parents who, let's face it, are emotional and paranoid themselves. Parents by nature operate more selfishly than others and that includes the freedom of the people around them

Parents are more selfish? That is the exact opposite of my experience. Parents are generally the most selfless. Its those who choose not to be a parent who prefer their selfish desires.

And yes, csam is on the up and up.

> From March 2009 to February 2022, the number of victims identified in child sexual abuse material (CSAM) rose from 2,172 victims to over 21,413 victims. From 2012 to 2022, the volume of reports to the National Center for Missing & Exploited Children’s CyberTipline concerning child sexual exploitation increased from 415,650 reports to over 32 million reports.

See https://www.judiciary.senate.gov/press/dem/releases/durbin-i....

If you put the concerns of your children over the rest of the population that's selfish.

Also how about some numbers that aren't swayed by covid

How exactly are parents putting the needs of their children over that of the rest of the population? Or are you saying that societies shouldn’t cater to children on any level beyond a minor inconvenience? Do the school buses making you have to stop driving your car bother you that much? Or are we building too many parks somewhere? And if so, where?

Children literally are the future society. Making them a priority is more selfless than making today's adults a priority.

What does covid have to do with the 10+ years of data I referenced? And even if the data does skew up during covid, how does that make it less of a problem?

nonchildren are also future society, unless every adult immediately dies, so deprioritizing them in favor of someone related to yourself seems selfish to me

if it's just some random kid and you have none of your own, such professions of selflessness might be more convincing

This article talks about how those numbers are manipulated https://www.techdirt.com/2023/04/24/senator-durbins-stop-csa...

Snippet-- "I mean, back in March of 2009, the tools to track, find and report CSAM were in their infancy. Facebook didn’t start using PhotoDNA (which was only developed in 2009) until the middle of 2011. It’s unclear when Google started using it as well, but this announcement suggests it was around 2013 — noting that “recently” the company started using “encrypted “fingerprints” of child sexual abuse images into a cross-industry database” (which describes PhotoDNA)."

This is what I'm talking about with paranoid parents. I'm sick of your "save the children" bullshit

Wait. Are you saying you don't get why some people may be bothered by sexual crimes against innocent children? Am I misinterpreting your post ?

Edit-- I'll happily take the down vote on this, I understand the policy of extending charitable interpretation But I am genuinely confused which is why I asked for clarification, it was not rhetorical.

Can your elaborate on your trigger here?

Was it someone daring to suggest that molesting a 3 year old is actually bad, like really bad?

It is inappropriate to ask someone about their trigger in such contexts. Why would you expect someone to go into details on past traumas like this?

If they are using their experience to advocate for changes that affect me then they should justify it

Justification wasn't requested. Elaborating on their "trigger" was. Again, this is abhorrent. No one should be required to go into details about being sexually assaulted as a means of "justification."

CSAM has nothing to do with encryption and it predates the internet.

https://youtu.be/aAeUeG-PTD0

There is some overlap, since you can't do a CSAM scan on properly encrypted data. It is not completely separate in a modern context of what is going on with IT.

Of course. But that emotional weight is very often cynically used in order to get people to go along with things they consider unacceptable.

I understand your argument, and I appreciate it. The same could be said of of the "other side" of this argument though. The "government will spy on you!"--is also emotional weight cynically being used to get people to go along with technical solutions that support CSAM.

I'd argue society would generally agree CSAM is unacceptable and we're allowing it right now. Many are quick to adopt the assumption that this law is an intentional and cleverly designed "attack on our rights to e2ee", as fact. If one can't recognize it's at least a poor attempt to balance the right to privacy with protecting kids, then I struggle to see how they're being honest with themselves.

I'm not arguing this law proposes the correct solution that should be adopted. I'm not arguing the surveillance state isn't licking their chops. I'm simply trying to point out that CSAM is a real problem. People really care about it. And it's factually wrong to claim otherwise.

It's also wrong and harmful to attribute motive based on assumptions. While you haven't done this, many others have. Instead of taking part in a constructive debate by arguing specific points, they try to paint a false motive on the opposition. "it's just so they can spy on you!" is roughly equivalent to "you view CSAM and that's why you don't want to protect our kids". These approaches are not how you reach a good solution that balances both sides of the argument. They're just throwing the oppositions legitimate concerns under the bus.

I'd also add, while e2ee is strong, unless you're verifying and compiling all the code you run on your device yourself, Apple/Google/etc still maintains the technical ability to snoop on you regardless of this law. I assume the bar to snoop on someone would most likely be lowered if laws like this are passed. But it's still technically possible (and likely happens).

AFAIK the app code can be decompiled to see what it does. The messaging can be monitored as well. I find it hard to believe these apps could sneak in something that breaks the encryption without anyone noticing.

The proposed solution to stopping child porn from being shared on these platforms would at most only do just that: Stop sharing on these specific apps. There are plenty of alternatives including encrypted zips, TOR etc. Breaking e2ee in WhatsApp would not do anything to stop sharing the material.

I don't think it's a leap to question why this is proposed when it could never achieve it's intended goal.

If the update is targeted at a single individual, it's almost guaranteed to go undetected.

Yes you can decompile code. But reverse engineering is time intensive (I've done it). And these code bases are huge. It wouldn't be difficult to obfuscate some element of the code so it's difficult to detect. Especially if it's rarely triggered.

> The proposed solution to stopping child porn from being shared on these platforms would at most only do just that: Stop sharing on these specific apps. There are plenty of alternatives including encrypted zips, TOR etc. Breaking e2ee in WhatsApp would not do anything to stop sharing the material.

There is value in introducing barriers, even when imperfect. You must admit that, otherwise the fact that Google/Apple can ship an OS update whenever they want negates the entire argument in favor of e2ee.

Also, just FYI encrypted zips are easily brute forced.

You can not even bruteforce an AES-128 encrypted zip, let alone 7z or rar with stronger algorithms. (Given a decent length password obviously)

> There is value in introducing barriers, even when imperfect.

Not when they are completely ineffective and introduce other issues.

> I'm simply trying to point out that CSAM is a real problem. People really care about it. And it's factually wrong to claim otherwise.

Very nearly nobody is arguing otherwise, though.

> Apple/Google/etc still maintains the technical ability to snoop on you regardless of this law.

Absolutely. Not only can they, but they do.

> Very nearly nobody is arguing otherwise, though.

How is equating CSAM to (merely) emotional weight not doing that?

CSAM does carry emotional weight. Your entire argument is that since privacy measures are already loose then its okay to make them looser for "the children".

> CSAM does carry emotional weight.

I never argued it doesn't.

> Your entire argument is that since privacy measures are already loose then its okay to make them looser for "the children".

Where did I make this argument? (hint: I didn't)

Privacy is binary you either have it or you dont and to argue that there exists a "balance" is disingenuous.

That isn't reality. You give up privacy all the time in exchange for things. And even with e2ee you don't "have" privacy guaranteed.

The disingenuousness is the point. You're trying to rationalize with authoritarians, who do not argue in good faith.

>CSAM is a real problem.

It's is not nearly as big a problem as states wanting to oppress people.

Right. I don't think people realize there is no such thing as a free lunch. Having something, in this case a free society, means making a tradeoff. The dials on safety, happiness, and freedom cannot all be at 100 percent at the same time, and it is far too easy to fall into the trap of thinking that even the tiniest bit of safety is worth a huge amount of freedom in exchange.

Well, it’s a well-designed trap carefully constructed to have the strongest possible effects on our lizard brains.

Maybe there are ways to check our governments’ true commitment to safety in multiple areas and draw conclusions?

Environmental protection (we live in a period of climate collapse)? Food safety (sugar industry controlling legislation etc.)? Weapon licensing? Access to healthcare services and life-saving medications like insulin? Healthcare and social services for mothers and young children? Preferring diplomacy to aggression and acts of destabilization in politics?

Looking at all of this I conclude that, sadly, our governments don’t seem to care much about our or our children’s safety.

Looking at the efforts politicians put into staying into power and acting on personal or corruption-driven agendas… we’re not in great shape and I have the feeling that there may be some manipulation going on with intention to disrupt organizing, personal privacy, and the ability of individuals to communicate without being surveilled.

All authoritarian governments absolutely hate that - for reasons having nothing to do with the safety of their citizens.

No, it was opt-in not required by law. The system was designed to work only with images as they were being uploaded to iCloud; it didn’t work with just any images on device. The receipt used for processing was generated as part of the upload process and neither the device nor backend could independently determine any useful information without coöperating with each other.

It was a really interesting scheme that Apple clearly put a huge amount of thought into in order to maximise privacy. But people didn’t read the details and instead imagined it worked in a much simpler way, drowning out any useful conversation about what it was actually doing. The UK approach should be opposed, but I wouldn’t be opposed to the scheme Apple wanted to implement.

No thank you. A lot of professionals perfectly understood the idea. What Apple came up with was essentially a "privacy preserving" backdoor; the behavior is still fully opaque to the user and acts against their interests. In the event of a false positive, we fall all the way back to "just trust us bro" territory, which basically destroys the strong guarantees that E2EE is supposed to provide when you use it correctly. The way I see it, you either offer E2EE or you don't: if you can't accept the potential consequences, simply don't play.

That having been said, given how they paraded their backdoor approach as a way to eat their cake and have it too, it's unsurprising that it attracted the attention of governments. They perhaps thought that implementing a scheme like this would put them ahead of the game, showing legislators they're self-regulating to work on these problems. In actuality, they're really just putting the future of digital privacy in dire straits.

Play stupid games, win stupid prizes.

> No thank you. A lot of professionals perfectly understood the idea.

Fucking thank you.

I have spent a lot of time in security. I spend a lot of effort on privacy. I keep abreast of the state of the art, I donate to the EFF. I spent a year auditing security at one of the largest cybersecurity firms in the Western world. I’ve read the texts, I’ve taken the classes.

I’m not saying I can just do bitwise AES over plaintext in my head. But I had no issue understanding the white papers Apple released that described the feature.

That didn’t convince me one iota that it was either a good nor necessary idea. It simply served to highlight the things Apple was being fairly arrogant about. And I say that as someone who daily-drives multiple Apple devices and am highly bought into the ecosystem.

They built a large part of their trust model with that effort upon the idea that two governments either wouldn’t or couldn’t collude to inject non-CSAM hashes into their database. It’s like they’ve never heard the term “Five Eyes” despite harboring serious credentials and contracts in _all_ the right spaces to know exactly how possible that would be.

It was a technologically clever idea, and if we lived in a “it’s this or that” world where we had to choose which technologies would be used to surveil our devices, it would be one of the best options developed to date.

However I don’t accept that premise because it’s not true.

Edit: typographical cleanup.

> They built a large part of their trust model with that effort upon the idea that two governments either wouldn’t or couldn’t collude to inject non-CSAM hashes into their database.

This is not correct. In the event that this happened, there would still be oversight at Apple before reporting to authorities.

Can you elaborate how that worked? Apple only said contemporaneously that they would refuse to include hashes that aren’t CSAM, but never went into detail on how they could actually prevent that, or refuse an order to do so.

But those hashes are produced and provided to Apple (edit: well, to any consumer of the hashes) by government backed actors. (Edited to replace “government agencies” with “government backed actors”.)

I misread your reply, and I cannot edit the above.

My misreading was that (paraphrased) “Apple could ensure the hashes they received were only for CSAM.”

That isn’t what you said. You noted that (paraphrasing) “internally Apple would have some validation functionality to ensure they were not reporting non-CSAM content.”

I was going to say I think your point is orthogonal, but I understand how it’s a response to what I wrote. I think we could rely on a reasonable set of people differentiating a perceptual hash of CSAM from non-CSAM content. That is no guarantee, but if their system worked as described then at some point they would be able to validate the actual stored images uploaded and know whether or not it was CSAM in an account.

Just leaving here that I would counter to others that make your original point constrained to CSAM flagged content only, that:

1. Given the fact that collisions were demonstrated in public before the system was fully implemented, this failure mode had the potential to create an unknown volume of false positives that Apple would have to deal with (which would unnecessarily expose user data to Apple contractors or employees).

2. We probably don’t want to enable corporations to have this kind of power (see recent stories regarding similar false positives at Google).

3. There was proposed no detailed plans for any sort of procedures about what happened next. What happens when Apple makes a report that was “close to the line” and later found not to be CSAM? The perceptual hash concept was not without vectors for human failures. What recourse would there have been if Apple closed an account due to a false positive?

iCloud storage was never E2EE; the iMessage system was, but not iCloud. As of late last year iCloud can optionally be E2EE, with the "Advanced Data Protection" feature, which is off by default (https://support.apple.com/en-us/HT212520).

I'm pretty sure the point of the concept was to enable E2EE for iCloud storage; that's the narrative I've heard. If it's wrong, well, then it's even stranger if you ask me.

Well they went ahead and shelved the idea and then implemented E2EE for iCloud anyways with advanced data protection so idk how well that idea holds up.

> A lot of professionals perfectly understood the idea.

I saw very little evidence of that. Practically everybody against the idea thought the device determined what was a match and uploaded evidence to Apple. Practically everybody against the idea thought “the” hash was broken. Practically everybody against the idea confused a hash false positive with the system’s false positive.

Yes, there were a few thoughtful criticisms and I would have liked to have seen more of them. But they were drowned out by abject nonsense.

> given how they paraded their backdoor approach as a way to eat their cake and have it too, it's unsurprising that it attracted the attention of governments.

It didn’t though? Has there been any government who wanted to take that system up? They all want something a lot more intrusive; the same kinds of things they have been asking for a long time before Apple’s proposal.

> Practically everybody against the idea confused a hash false positive with the system’s false positive.

Doesn't the system output the result of the hash?

What is the difference?

> What Apple came up with was essentially a "privacy preserving" backdoor

As opposed to Google trying to have parents arrested for seeking medical care for their children during the pandemic lockdown?

> His wife called an advice nurse at their health care provider to schedule an emergency consultation for the next morning, by video because it was a Saturday and there was a pandemic going on. The nurse said to send photos so the doctor could review them in advance. With help from the photos, the doctor diagnosed the issue and prescribed antibiotics, which quickly cleared it up.

Because technology companies routinely capture so much data, they have been pressured to act as sentinels, examining what passes through their servers to detect and prevent criminal behavior. Child advocates say the companies’ cooperation is essential to combat the rampant online spread of sexual abuse imagery. But it can entail peering into private archives, such as digital photo albums — an intrusion users may not expect — that has cast innocent behavior in a sinister light in at least two cases The Times has unearthed.

“I knew that these companies were watching and that privacy is not what we would hope it to be,” Mark said. “But I haven’t done anything wrong.”

The police agreed. Google did not.

https://www.nytimes.com/2022/08/21/technology/google-surveil...

That's not just scanning things you upload to a public facing website, that's scanning everything on the device.

> As opposed to Google...

Bad start. I never mentioned Google.

> ... [the remainder of the message] ...

I do not understand how this is meant to weaken the case against what Apple did at all. If anything, it strengthens my resolve that tech companies should not be at liberty to even make these decisions.

I do not understand how anyone can go on a rant about a system Apple discussed but never implemented while trying to handwave away the fact that Google is scanning everyone's device and turning in parents to the police over a single false positive.

> it didn’t work with just any images on device.

Only a matter of time before an authoritarian regime forced them to expand its scope. Create a Pandora's box and it will be opened.

Don't need an authoritarian regime, just the UK government. This is exactly what Apple attempted to head off in a privacy preserving manner. At the time it was speculated (I agreed) that it was part of the lead in to full E2EE - which has happened since.

An authoritarian regime can require spying regardless. This is the exact topic we are currently discussing.

Yes, and companies like Apple(and many others) have been successful - or at least appeared to be - at denying such requests by saying that there is no technical way to break the encryption built into their devices and communication. Now, there would be a way - once it's built it's built, there is no going back.

> companies like Apple(and many others) have been successful - or at least appeared to be - at denying such requests by saying that there is no technical way to break the encryption built into their devices and communication.

This is incorrect. Last time it went to court, Apple used very different arguments.

> Now, there would be a way - once it's built it's built, there is no going back.

Then why is the British government not asking for the system Apple designed? They are asking for something far more intrusive. Apple’s system is irrelevant to that.

You can also meaningfully resist spying by reducing the amount of sensitive user info you hold or building a transparent system. Apple has not done that, so they are now in a position where they have to reconcile what "fair data collection" even means.

If you're just asking me, they bungled it. MacOS shouldn't have ever gotten stuck in the Windows 8 Software as a Service trap, because it radically redirected their trajectory from "well-made personal devices" to "golden handcuffs". Don't believe me? Just try to install a freedom-respecting OS on your iPhone. You can't. It's a goose-chase, because Apple insists they don't even make computers in the first place. It's an iPhone, running a very special superior version of UNIX you're not entirely allowed to look at, but you can trust is secure.

So of course an authoritarian regime can compel spying regardless. They've probably been doing it for the past decade, given what we know about FIVE EYES and PRISM. When you're a company like Apple or Microsoft, they just update the software with the requested backdoor/vulnerability installed and push it to the closed codebase. Even Apple's proposed E2E encryption could be backdoored. Nobody would ever know the wiser.

If you want the reason I'm mad, it's because it echoes the reasons I left the ecosystem with MacOS Catalina. The idea of Apple defaulting to you trusting them on so many things is kinda sickening. They've had the opportunity to build groundbreaking trustless systems with unparalleled openness and plausible deniability for all user data. Now the users are bartering for a better (but also closed) E2E system with a company that doesn't want to hear them out. It's not my jam, I'm not going to be held hostage by my computer because Apple has a fetish for making extreme decisions on the behalf of their users.

Absolutely, but by normalizing scanning on local computers it takes you one step closer to authoritarianism. Every time politicians get a little more power, it only accelerates their desire for more control and inflates their sense of elitism that much more into thinking they're special and above us peasants.

It was designed to scan photos on device and upload reports as a condition of having iCloud Photos turned on. Since iCloud Photos is turned on by default on iPhones (and more or less has to be turned on if you have a photo library that’s larger than your local storage) it would have applied to the vast majority of users, even those that didn’t even realize “iCloud Photos” was a thing they cared about.

Fortunately Apple has abandoned that plan and now supports full end-to-end encryption for iCloud Photos. It’s still opt-in, but hopefully that will get easier in the future.

> it would have applied to the vast majority of users, even those that didn’t even realize “iCloud Photos” was a thing they cared about.

I don't buy this because everyone I know turns off iCloud Photos when it causes you to run out of your measly 5GB of free storage space, which makes the OS insistent about you fixing it to fix backups not uploading. For the people that do pay more, they keep iCloud Photos on specifically for the photo syncing aspect.

I backup my photos to my desktop computer. I would have never experienced the scanning.

I think it is fine that you opt out. But if society as a whole doesn't opt out of a surveillance regime, it still affects you as a member of society. And eventually your ability to opt out will probably be removed: after all, once you've acquiesced to the idea that private, unshared, possibly encrypted photos still need to be scanned for criminal activity -- then why should there be an exception for criminals who back up to a local computer.

Because in the USA if we keep our secrets in our house we are protected from unreasonable search an seizure. If we share our secrets with a third party the third party is free to share them. This seems like such a clear line of distinction that a layperson could understand.

There is no U.S. law that requires Apple to scan your uploaded content for CSAM and share reports with law enforcement. If such a law existed, it would almost certainly be a major 4th amendment concern. Instead Apple chooses to do server-side scanning "voluntarily" (which means, they do it under considerable pressure from law enforcement agencies and politicians) after making you click Agree on a ToS that gives them permission to do so.

Similarly, I am not aware of any constitutional rule that prevents a private company like Apple from installing client-side software into your phone OS that scans the local photos on your private device even if you never upload them, as long they don't do the scanning at the government's direct behest and you give them permission by agreeing to their ToS.

The important constitutional principle here is "is this private company acting as an agent of the government." The important civil principle is: "do we, as citizens and customers, want our government and phone manufacturers to scan private files and submit automatic police reports." Once you've decided those questions, the physical/logical location of the files is a detail that only we nerds care about.

Never said there was. I said there is a constitutional idea that items stored at home have more expectation of privacy than things store with other people. That you have some axe to grind with this or that company shouldn’t cloud the issues.

You're trying to argue in good faith with someone that fully understands the strategy of using private/public partnerships to bypass constitutional protections, and is playing oblivious. Don't feed the glowies.

>>It was a really interesting scheme that Apple clearly put a huge amount of thought into in order to maximise privacy.

No. They appeared to put in this effort, but at the end of the day they built a system which could be used for scanning any file on your device for any reason, saying "oh it's only for files uploaded to icloud" was obviously the first step. And then of course the fact that if anything was deemed innapropriate it would have been submitted to their own verification centre where someone would actually physically look at your pictures and then forward them to law enforcement, without you being notified that this has happened in any way - that doesn't sound like maximising privacy to me.

>>but I wouldn’t be opposed to the scheme Apple wanted to implement.

I would. It was a horrendous implementation and any on-device scanning should always be opposed to the maximum extent that you can bare.

> at the end of the day they built a system which could be used for scanning any file on your device

They could already be doing this though, right? Unless some trustworthy external auditor has gone through the iOS/macOS/iPadOS source and audited that they don't (good luck with that.)

Of course - but Apple isn't going to produce a custom iOS build to find pictures of dissidents for a dictator(at least I find that unlikely), but if it's a system that everyone knows exists but verifies your pictures against some closed, uninspectable and constantly updated database of hashes......what's the harm of sneaking few more hashes in, right?

> No. They appeared to put in this effort

To be clear – you are saying this was an easy thing for Apple to construct?

> but at the end of the day they built a system which could be used for scanning any file on your device for any reason

This is factually untrue and also not in contrast to the amount of effort they put in.

> And then of course the fact that if anything was deemed innapropriate it would have been submitted to their own verification centre where someone would actually physically look at your pictures and then forward them to law enforcement

This is also factually incorrect. Did you read the technical documentation Apple published?

>>To be clear – you are saying this was an easy thing for Apple to construct?

No.

>>This is factually untrue and also not in contrast to the amount of effort they put in.

How so? I fail to see how this system has anything that would prevent it from being used to scan any file on the device? Sure their design is only for pictures, but why would it be limited to them?

>>This is also factually incorrect.

It's not, that is exactly what their technical paper says.

>> Did you read the technical documentation Apple published?

I did, multiple times, I've been having these arguments for a long time now.

> at the end of the day they built a system which could be used for scanning any file on your device for any reason

This kind of comment is exactly why they said lots of people didn’t understand the system.

Because it’s utterly untrue & appears to not display ANY understanding of the underlying system at all

Please explain how it's not true. I understand the system and its design pretty well and I literally don't understand how you can't see the risk of this happening here.

If you understood the system you’d understand how that makes as much sense as saying “the iPhone has cameras that means they will be able to see everything you’re doing!”

It’s not true, it’s not how that works, it’s not how any of it works. It’s also something that could ONLY be true of they changed how everything worked.

>>If you understood the system you’d understand how that makes as much sense

I don't know why you keep implying I don't understand how the system works - I do.

And I literally don't see how you can take your position and believe in it.

The system as proposed would generate a special "similarity" hash for pictures that are about to be uploaded to icloud - then those hashes would be compared against an uninspectable database of hashes provided by apple in collaboration with law enforcement agencies.

Literally all that would need to change here is that this system would need to scan all files not just pictures(trivial) and either all the time or on request instead of on upload to icloud(trivial). And of course it's silly to believe nation states wouldn't force Apple to add their own hashes of anything they want into the database - after all there is no oversight process over this. This isn't a major change to how the whole system works, it's a minor change and one that definitely would be made with time "because think of the children/terrorists/etc"

You really don't see it as an absolultely inevitable consequence of this system being implemented and in fact just existing at all? If no, then you have more trust in Apple than I do.

> But people didn’t read the details and instead imagined it worked in a much simpler way, drowning out any useful conversation about what it was actually doing.

I read the details. I think I understood it perfectly well. I found it very objectionable.

Great! It’s a shame voices of people like you were next to impossible to find amongst the ignorance.

I think there’s a strong argument for and a strong argument against the system Apple designed. I wanted that discussion to be had instead of it all being washed away with knee-jerk ignorance.

I found quite a lot of intelligent debate about this. Not in the popular media, of course, but that's to be expected.

I was here for the discussions on hacker news, and it seemed to me like most people knew basically how it worked. A lot of people on here defending the authorities and clutching pearls about “think of the children” telling us we didn't understand and when we presented them with evidence that we did in fact know how it worked they would go radio silent.

> "Didn't Apple recommend on-device scanning recently?"

> "No, it was opt-in not required by law."

Your comment indicates the answer is yes.

Trying to figure out where the gap may be...my guess is the view objections come from "people [who] didn’t read."

I found the other replies powerful evidence that other people did read, and had nuanced thoughts on this matter.

The delta is that the “on-device scanning” proposed by the British government and the “on-device scanning” proposed by Apple are very different in meaningful ways.

> The system was designed to work only with images as they were being uploaded to iCloud

Not iCloud, since that would imply it was scanning entire device backups stored in iCloud.

It was intended to scan just the photos that you uploaded to their publicly accessible Photo sharing website, iCloud Photos, in a way that even Apple wouldn't have access to the results unless you uploaded more than 100 photos that matched known kiddie porn.

iCloud Photos is part of iCloud. iCloud backups are not end to end encrypted by default. The option did not exist then. They claimed 30 not 100 photos. It could change at any time. The claim could not be audited. The databases are known to contain false positives. They could not be audited.

> iCloud Photos is part of iCloud

iCloud Photos is a photo sharing website accessible to the public, like Flickr. It has nothing to do with device backup.

iCloud has many features in addition to device backup. The sync and sharing feature called iCloud Photos is 1 of them.

Apple only discussed scanning images that would be uploaded to the photo sharing website.

Apple documentation said photos stored in iCloud. Synced photos are stored in iCloud. And they told people to turn off iCloud Photos to avoid it. Not not share.

Backups are also stored in iCloud, but Apple made it clear that it was only considering scans of photos that you uploaded to iCloud Photos (since that content is publicly accessible through the web).

Scanning device backups was not even on the table, unlike at Google, where they have been scanning device content for years now.

https://www.nytimes.com/2022/08/21/technology/google-surveil...

I explained already sharing is part not all of iCloud Photos.

Backups entered the discussion because you claimed iCloud meant backups not photos. And Apple has access to device backups even when they do not exercise it without E2EE.

The article said backed up to Google Photos. And the photos were sent over Gmail and chat. It is not clear device backups were involved or even existed. And device content is a misleading thing to call backups in a discussion about scanning on device.

I read the details. It normalized letting corporations scan and police my computer without a search warrant. I didn't like that and I complained. If they want to scan my data on iCloud, then fine, and good luck since there is a layer of heavy encryption there before it's backed up there. Normalizing scanning of local devices is a big no-no in my opinion and the opinions of lots of others. Yeah we read the white papers and know exactly how it works, if not how every bit and byte is juggled.

Apple's plan to compare images on-device to hashes of CP was an eminently sensible attempt to give governments an alternative to banning E2EE encryption. As the government spokesperson in the article said: "companies should only implement end-to-end encryption if they can simultaneously prevent abhorrent child sexual abuse on their platforms." Apple was trying to do the latter so it has a leg to stand on when it comes to asking governments not to regulate against E2EE.

This is HN. The facts are not relevant.

So, Apple felt it had to "burn the village in order to save it"?

I don’t understand why comments like this are getting downvoted. I understand the absolutist position against any content scanning, but Apple very clearly tried to strike a middle ground that is far less invasive than the content scanning systems in every other photo service run by Google, Microsoft, Flickr, etc. And then when everyone freaked out, Apple didn’t ship it! Meanwhile the FBI can browse all your Google Photos right now.

Can the FBI not browse all my iCloud photos too?

I don't think a closed-source E2EE implementation would do much to change that.

E2EE is an option for iCloud Photos now, so no, not if it’s turned on.

Not sure what you mean about closed source. If you’re implying that the FBI can break Apple’s encryption because it’s closed source, uh, sure.

With a subpoena they can access anything unencrypted. If a user turns on advance data protection, they cannot.

Based on the Pen Letter laws. Anything stored with a third party can be subpoena by the government. The reasoning is if one wanted to keep it a secret they wouldn't be sharing with a third party.

If you use an ISP for email the ISP can be subpoenaed with you being aware. If you want run your own mail server from your house. A search warrant of your house for the mail server is required. Different notification standards.

Yeah, I think people who are absolute about E2EE here need to remember the xkcd about the person with the wrench. Apple's reading of the tea leaves is that the government will be the one with the wrench and will ban E2EE. This was an attempt to head it off. Of course their reading could be wrong, and the government would ban anyway. Or maybe a ban never comes to fruition. I have to imagine it would ultimately end up at SCOTUS.

> This was an attempt to head it off.

Right, by building in what amounts to a back door.

It sounds like you didn’t read the paper. It’s a reporting system, not an access system. No one can actually be granted access to your photos under Apple’s scheme. One of your photos must be an exact match for photos already existing in the CSAM database, at which point a report is generated, still not with the complete image from your phone. Even if the CSAM database were compromised by the FBI, where is the back door?

I did read the paper, and I understand what the system did. I suspect that you just have a more narrow definition of "back door" than I do.

> One of your photos must be an exact match for photos already existing in the CSAM database, at which point a report is generated

IIRC, one of your photos must match a hash that exists in the database, not an exact match to an image itself. That's the means by which end-to-end encryption is evaded. That evasion is why I call it a back door.

Really, my entire problem with the scheme was that it took place on the device itself rather than in the iCloud. While all smartphones are surveillance devices already, making one as overtly a surveillance device like this sets a precedent that I think is exceedingly harmful.

You’re missing the key point that there isn’t much surface for misuse under Apples scheme. If the FBI wants to falsely accuse you of having CSAM, inserting a hash from a photo on your phone into the CSAM database is actually much more complicated than simply putting CSAM on your phone. Running the scanner on your device means they actually need to compromise your device.

> You’re missing the key point that there isn’t much surface for misuse under Apples scheme.

No, I didn't miss that point at all. It's just orthogonal to my objection to the scheme. I object to the idea of formally making highly personal devices like your phone into ones that are spying on you. We have more than enough of that sort of thing informally. To make it official could only make things worse for everybody, Apple users and otherwise.

Since the whole thing was about photos being stored in the cloud, it would have been much less objectionable to put the scanning on the cloud side of things. At least that's actually someone else's computer and not someone using your own hardware against you.

Your theoretical objection is divorced from any actual consequences that affect people. Why should anyone care? You state no benefits or harms other than what you feel. My point is about reality, so yes you missed it

Hmm. I think the opposite, that you are missing my point entirely. But, really, it's probably just that we fundamentally disagree on very basic issues. That's fair.

E2EE with a back door is not E2EE.

Yes, it really smells like a strange about-face. What is Apple's real stance here?

Companies have only one stance - make more money. When squeezed from both sides they might try poking either in order to see what would hurt their bottom line less.

> Companies have only one stance - make more money.

That's not entirely correct, but close enough. Since that's a constant, we can ignore that. Outside of "make more money", different companies absolutely take different stances about things.

Most companies seem to have at least some amount of consistency in their stances, though.

>"Most companies seem to have at least some amount of consistency in their stances, though."

Do no evil?

I did say most, not all.

I've dealt with many companies in the last 25 years and from my personal experience their stances are like a windsock (well except for that main "more money" stance).

Your experience can of course be different

Their idea & implementation was MUCH better (and more secure & private) than the awful proposal their opposing here.

IIRC their argument for on-device scanning was that it was a (largely) privacy-preserving way to comply with existing law.

I don’t think they’re insincere if they oppose new regulations, yet begrudgingly comply with them if they become law despite their attempts to prevent that.

Few people/organizations are willing to die for their principles.

I hope they go all in on privacy as a brand "distinguisher". I know corporations only exist to make a profit but stuff like this can make your brand stand out.

Glad to see someone mentioning this. It's a strange about-face for them, as I thought they still scanned iCloud