Hacker News Reader

Hacker News

Comment by tptacek | Hacker News Reader

Full thread

tptacek

They got Mihir Bellare to review (and write a proof for) the private set intersection cryptography pieces of this.

https://www.apple.com/child-safety/pdf/Technical_Assessment_...

Apple's official proof was done in part by Dan Boneh:

https://www.apple.com/child-safety/pdf/Apple_PSI_System_Secu...

View on HN

I think Moxie came up with the end-to-end encryption technology that WhatsApp and Signal uses.

It is great.

But it didn't prevent Facebook from trying to abuse WhatsApp users in every conceivable other way including some rather innovative ones as seen recently.

Also it didn't prevent Signal from releasing a desktop client with a really nasty XSS bug and the phone client hasn't exactly been without faults either.

You and Moxie are both much smarter than me but I foresaw and maybe even predicted (possibly so early it is under another handle) some of Facebooks actions while everyone else was just talking about how E2E-encryption was the big difference.

This feels more or less the same: the intent is honorable, the core code is clever and almost unbreakable - but you cannot really trust all of the actors you need to trust for the system to work.

We cannot read WhatsApp messages in transit. And, as specified this system sounds good. But WhatsApp happily uploads unencrypted copies to Google Cloud and/or iCloud without your consent if another participant enable backups, and I'm fairly sure we'll see this system containing huge opportunities for abuse by power hungry regimes as well as one or two nasty bugs that has the possibility to utterly destroy a few innocent persons lives.

I'm not sure I really follow this (Signal Protocol is Trevor and Moxie; in particular, I think the triple-DH AKE is Trevor's invention) --- but I'm just here to point out the interesting cryptography angle. I wouldn't touch the policy argument here with a 10 foot pole.

I think the point is that they are using careful engineering to gain the support of cryptographers on the technical aspects, to detract from the problems with the policy aspects.

So what? When you don’t trust the actors running the system, it doesn’t matter if the crypto is perfect.

And right now, I don’t trust the maintainers of the CSAM database and Apple to do the right thing.

So nothing? It's interesting that Bellare and Boneh are involved. That's the extent of my commentary.

Even then, say you trusted Apple.

Nobody signed up/purchased an iPhone trusting random 3rd parties/CSAM aggregators.

Thank you for the purely informational post and I'm currently reading through the second just to understand this more thoroughly but I can say already screw the proofs. Apple needs to stay off my devices with their crime scanning bs. It doesn't matter if this whole scheme ensures that Apple cryptographically keeps their hands clean. The effect is the same. They're on my device looking for things that can send me to jail.

These brilliant academics just don't care so long as they can publish an interesting paper I guess. Whatever, still reading.

I don't think Bellare or Boneh are hurting for cites.

A drive for incrementing their number of citations wasn't what I was getting at.

Then it's not clear to me what you're getting at.

1. Their credentials provide some legitimacy to this endeavor.

2. They get to do some interesting work.

Those are the positives for them I see.

Rather than abstaining they work on it and lend their names. I don't know whether they support what Apple is doing with the protocol or if they just like figuring out the possibilities. I don't think either is good in this case because I don't like the very first application of this PSI System. Maybe I'm being short sighted and jumping to conclusions all at once. I still don't like it.

Reply on news.ycombinator.com