Hacker News Reader

Comment by sandworm101 | Hacker News Reader

Ok. Hashed-based image rec. Where are the hashes? Is the comparison done in my phone against a downloaded database, or is a hash of every image on my phone uploaded for comparison on a server? Could this program then be expanded to other classes of images? Animal abuse imagery? Terrorism? Hashes of known bomb-making instructions? How about people sharing illegal pdfs and text files? Will the MPAA be allowed to submit hashes of their copyrighted material? In short: What other warrantless government inspections of my files will Apple allow?

View on HN

It’s done on Apple’s servers using your iCloud backups. For good or ill this lets people opt out by disabling iCloud.

I would hope most privacy conscious people disable iCloud, but that’s another story.

If apple really cares about security then those images in iCloud should be stored in an encrypted form that makes hash comparisons impossible. If they are hashing them then they have access to them in plaintext. If I used iCloud I would be more worried about the wider implications that creates.

iCloud needs to allow people to restore backups on a new iPhone after losing their old one.

You can setup secure encrypted backups, but the customer losing the key means losing the back so that’s not what consumer focused companies are going to do. In other words any backup service that doesn’t have big warnings that losing your key loses your backup means they can read your data.

https://blog.cryptographyengineering.com/2012/04/05/icloud-w...

"The mud puddle test: You don’t have to dig through Apple’s ToS to determine how they store their encryption keys. There’s a much simpler approach that I call the ‘mud puddle test’"

Most of the process is done on customer's devices.[1]

[1] https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...

I was answering this: “Is the comparison done in my phone against a downloaded database, or is a hash of every image on my phone uploaded for comparison on a server?”

To be clear each image, the image’s NeuralHash, and a visual derivative are uploaded to iPhoto. This allows for the inspection of the NeuralHash algorithm used which I actually prefer.

The phone isn’t downloading the hash database.

From that same page: "Apple further transforms this database into an unreadable set of hashes that is securely stored on users’ devices". The phone is downloading the hash database.

Reply on news.ycombinator.com