That’s starting to veer into unreasonable levels of conspiracy theory. There’s nothing to “cover up”, the feature has an off switch right in the Settings and a public document explaining how it works. It should not be on by default but that’s not a reason to immediately assume bad faith. Even the author of the article is concerned more about bugs than intentions.
Since they cannot convince users to enable this feature in good-faith, they are resorting to subterfuge. We know that Apple is vehement about pushing client-side scanning on users that do not want it, I do not believe for a second that this was a mistake or unintended behavior. If this was a bug then it would have been hotfixed immediately to prevent the unintended behavior from reaching any more phones than it already had.
This is illogical. If Apple wanted to engage in subterfuge they would simply compromise the OS.
When a company controls the entire stack either you trust everything they do. Or nothing.
If anything, the lesson Apple might take from this could be "adding the settings toggle was a bad idea, because nobody would have cared about this at all otherwise".
They worked very hard on security these past few months, so it should be all good, right?
I am not claiming for one moment that enabling this by default is OK. In fact, I have explicitly said it is not.
What I am saying is that it is ignorant to call this a cover up, because a cover up requires subterfuge. This feature has a freaking settings toggle and public documentation. Calling it a cover up is the type of uneducated rhetoric that makes these issues being brushed off by those in power as “it’s just a bunch of loonies conspiracy theorists complaining”.
Clearly you have not. If you did, you wouldn’t continue to give an example which is not equivalent.
No, it would not be “perfectly fine”, I just said it wouldn’t. You can do something wrong without it being a cover up.
Irrelevant.
This is Apple's proprietary software, running on Apple's computers, devices which use cryptography to prevent you from inspecting it or running software they don't control. Very few people have any idea how it actually works or what it actually does.
That there's some "public document" describing it is not evidence of anything.
> that’s not a reason to immediately assume bad faith
The mere existence of this setting is evidence of bad faith. The client side scanning nonsense proved controversial despite their use of children as political weapons. That they went ahead and did this despite the controversy removes any possible innocence. It tells you straight up that they cannot be trusted.
> Even the author of the article is concerned more about bugs than intentions.
We'll draw our own conclusions.
What is happening, is that people make tradeoffs, and decide to what degree they trust who and what they interact with. Plenty of people might just 'go with the flow', but putting what Apple did here in the same bucket as what for example Microsoft or Google does is a gross misrepresentation. Present it all as equals just kills the discussion, and doesn't inform anyone to a better degree.
When you want to take part in an interconnected network, you cannot do that on your own, and you will have to trust other parties to some degree. This includes things that might 'feel' like you can judge them (like your browser used to access HN right here), but you actually can't unless you understand the entire codebase of your OS and Browser, all the firmware on the I/O paths, and the silicon it all runs on. So you make a choice, which as you are reading this, is apparently that you trust this entire chain enough to take part in it.
It would be reasonable to make this optional (as in, opt-in), but the problem is that you end up asking a user for a ton of "do you want this" question, almost ever upgrade and install cycle, which is not what they want (we have had this since Mavericks and Vista, people were not happy). So if you can engineer a feature to be as privacy-centric yet automated as possible, it's a win for everyone.
I did read the article, yes :) Maybe our photos are not sent bit-by-bit but enough data from the photos is being sent to be able to infer a location (and possibly other details) so it is the same thing: my personal data is being sent to Apple's servers (directly or indirectly, partially or fully) without my explicit consent.
At least the last time they tried to scan everyone's photos (in the name of the children) they pinky promised they'd only do it before uploading to iCloud, now they're doing it for everyone's photos all the time - it's disgusting.
You can imagine it as hashes (created locally), some characters of that hash from some random positions being used to find out if those can be turned into a query (which is compute intensive so they use PCC for that). So there is no 'data' about what it is, where it is or who it is. There isn't even enough data to create a picture with.
Technically, everything could of course be changed, heck, Apple could probably hire someone with binoculars and spy on you 24/7. But this is not that. Just like baseband firmware is not that, and activation is not that, yet using them requires communication with Apple all the same.
So it does it multiple ways:
- Finite sets and added noise, doesn't hurt performance too much but does make it nearly impossible to ID/locate a photo
- Encryption at rest and in transit
- Transit over hops they don't own
- Homomorphic Encryption during remote compute
The data it finds was available in two ways: the "result" and the vector embedding. Not sure which one you end up consuming since it also has to work on older models that might not be able to load the embeddings and perform adequately, but it doesn't matter since the data itself will be unique so you can't do parallel reconstruction, but it is also uniquely meaningless to anyone without a key. They are essentially computing on needles that aren't in a haystack, but in a needle stack.
The primitives all this is built on have been around for quite a while, including their HBONE implementation, the cryptographically hidden data distribution and the SEP. So far, it has been the only one of its kind outside of disjointed options like buying and operating your own HSM, a large TOR network and a yet to-be-invented self-hosted PCC solution (AMD was supposed to release something but they failed at that, just not as bad as Intel messed up with SGX).
Technically, even with everything else removed, just some good TLS 1.2+ and homomorphic encryption would have been more than any other mass market manufacturer has ever done in an effective way. But by adding the additional factors such as degrees of separation so they couldn't get in themselves (without breaking it for everyone in the process) is what makes this so much more robust.
I would be ok with this being a local feature, where I can download the signature database to my device and run the search locally (as you say), but as it stands some information about my photos (enough to detect places at least, possibly more in the future) is being sent out of my device. I want zero information about my photos to leave my device.
I mean, this is just wrong. Baseband firmware and carrier activation can be managed entirely independently of Apple, they just choose to manage it themselves. The number of places where Apple chooses to insert their own services as arbitrary middlemen has been a perennially worrying topic among Apple enthusiasts. It's not just disrespectful to people that pay a premium for fewer service advertisements, it's downright unsafe and does not reflect the sort of forward-thinking security that people in the industry respect.
There was a time when Apple focused on real and innovative product differentiation, but I'll be damned if you can give me a post-Wozniak example that isn't under antitrust scrutiny. Apple relies on marketing and branding to make people feel unsafe in a fundamentally insecure system - I don't respect that as a proponent of innovation and competitive digital markets.
Perhaps you are thinking about subscription activation (be it GSM or CDMA) and parameters for cell networks (which can indeed be consumed by the baseband, which will be running firmware supplied by the manufacturer, sometimes re-packaged in system images as done in OEM feature phones and many android phones).
Either way, macOS devices do the same thing (activation) as do iPads without cell networking. Same goes for radio firmware loading and updates. You'll find most wintel laptops doing the same for things like WiFi (regardless of softmac/halfmac/hardmac chips).
People aren't making tradeoffs - that's the problem. Apple is making the tradeoffs for them, and then retroactively asking their users "is this okay?"
Users shouldn't need to buy a new phone to circumevent arbitrary restrictions on the hardware that is their legal property. If America had functional consumer protections, Apple would have been reprimanded harder than their smackdowns in the EU.
As for vectorised and noise-protected PCC, sure, they might have an opinion about that, but people rarely are informed enough to think about it, let alone gain the insight to make a judgment about it at all.
This is a dumb take. They literally own the entire stack Photos runs on.
If they really wanted to do a coverup we would never know about it.
This is a useful, harmless feature that does not comprise security or privacy in any way.
Users are smart enough to decide for themselves. Let them.
People won't trust homomorphic encryption, entropy seeding or relaying when none of it is transparent and all of it is enabled in an OTA update.
> This is what a good privacy story looks like.
This is what a coverup looks like. Good privacy stories never force third-party services on a user, period. When you see that many puppets on stage in one security theater, it's only natural for things to feel off.