I wasn't sharing it. To be honest if they're checking for CP then they're messing with your files. There isn't a sudden distinction when you bring in "think of the children"...

I think there's a clear distinction between possessing child porn, which is illegal and subject to a jail term, and so-called "piracy", which is a civil dispute.

There are very few digital things that are illegal to possess (and no, a digital copy of The Matrix is not illegal to possess), and I believe Microsoft has both a legal and moral obligation to ensure the files on its servers are not child porn.

Putting aside the obligation(s), the mere fact they (and to be fair, likely other clouds) have an automated deletion process for unwanted content reduces their reliability. There may be bugs, possibly poor hash distributions, malicious misreporting, erroneous classifications, or misappropriation of the tool for other purposes.

I don't think this measure is effective (it's trivial even for non-techies to circumvent hash-based detection) nor proportional to the likely incidence/impact of this crime. While I cannot speak to what their legal obligations are, I don't think we should encourage invasion of privacy for no particularly good reason. As such, I strongly object to the notion they have a moral obligation to commit this particular harm. Facetiously claiming that doing so somehow protects children is just a joke in particularly bad taste.

> *it's trivial even for non-techies to circumvent hash-based detection

I was under the impression that PhotoDNA was more than simple hashing - that it used an algorithm like Google's "similar images"

Child porn is a "everything must be done against it" topic and while that is what should be done, it means that it makes a perfect "no arguments against it" argument for snooping.

But it is my belief that file hosters have a legal and moral obligation not to know what they are hosting for their customers. It is not the obligation of a host to look at a customer's files and decide what is ok and what is not. It is the same thing with Tor nodes or if you decide to encrypt files. I actually think that any online sync host like this or like Dropbox should not have any chance of knowing what I store with them. That's my private business and there is zero reason for them to know, is there?

Your belief doesn't have any grounds on reality and/or current laws. Once notified of child pornography, Microsoft cannot keep that content stored in its network. Period. Otherwise the next request they will get from a judge is to close the service down.

I actually think that any online sync host like this or like Dropbox should not have any chance of knowing what I store with them

Cryptography is readily available to anyone who cares to use it.

1. It doesn't sound like anyone is "notifying" Microsoft in any way. They're almost certainly just using the NCMEC hash set (which they helped develop) to identify known images.

2. You ought to provide some kind of legal citation for your claim that a judge can order a service like Onedrive to shut down after just two allegations of illegal content.

Once notified! I never disagreed with that, I fully agree with it.

End-to-end cryptography should be the standard.

>Cryptography is readily available to anyone who cares to use it.

Really? It was my understanding that True crypt was done for and I don't know of any other similar software that is open source (ie trust worthy).

Truecrypt is far from done. But wouldn't be the fact that it's open source be enough for you to deem it trust worthy? Of course not, as recent events have demonstrated.

https://www.grc.com/misc/truecrypt/truecrypt.htm

Although we all have reason to believe every single encryption tool out there is compromised, where does that leave us? Paralyzed. IMHO, we won't have 100% trustworthy software ever and we're better off using what we have then not using anything at all. Remember, in this thread we're talking about our privacy, not some top-secret project for which developing a encryption tool from scratch would be affordable (that'd be cool though).

Well, there might actually be value in knowing the content for e.g. searching, analysis, compression, deduplication, and advertising purposes. I'm not terribly in favor of exploiting these uses, but there certainly are conceivable reasons for the online service to examine the content of the stored files.