Comment by game_the0ry | Hacker News Reader

Comment by game_the0ry | Hacker News Reader

Disappointing.

While moderating CP distribution and storage is obviously the right thing to do, I do not think this approach will be a worthwhile endeavor for apple and governments.

Let me explain: imagine you are bad guy with bad stuff on your iphone, and you hear apple will be scanning your phone. What is the next logical thing you would do? Migrate your stuff to something else, obviously. Encrypting a usb stick does not require a high degree of technical skill [1]; neither does running tor browser.

So I am thinking 3 things:

1. This is not about CP or doing the right thing, but rather apple bowing to government/s pressure to create a half-ass backdoor to monitor and squash dissidents.

2. Apple and government/s are incompetent and do not realize that criminals are always one step ahead.

3. Most likely, some combination of the above - government/s have demonstrated they are willing to go hard on dissidents on the personal electronics front [2], not realizing that they will only mitigate, not exterminate, the dissent they fear so much.

For the average joe, I would say this - your privacy is effectively gone when you use an electronic device that comes with closed-source code pre-installed.

For the benevolent dissidents - there are many tools at your disposal [3, 4].

Likely next iteration - governments / courts / cops compel suspects to hand over passwords and encryption keys over to prosecutors. It looks like it already started [5, 6], so act accordingly.

[1] https://www.veracrypt.fr/code/VeraCrypt/

[2] https://www.washingtonpost.com/investigations/interactive/20...

[3] https://files.gendo.ch/Books/InfoSec_for_Journalists_V1.1.pd...

[4] https://www.privacytools.io/

[5] https://www.bbc.com/news/uk-england-11479831

[6] https://en.wikipedia.org/wiki/Key_disclosure_law

It is not the role of infrastructure providers to reach into private, on device content.

That is like the USPS opening every letter and scanning what is inside. Even if it's done with machine learning, that is absolutely not okay, no matter what it is for.

Agreed, but not like we have a choice with that matter.

You have a choice about whether to keep or discard your iPhone.

Though we were okay with Gmail doing the same because "hey, it's free!".

But I understand your concern here. All our lives are now digitalised and maybe stored forever somewhere and anything you do, even if completely benign, could be considered a crime in some country or even in your own country in a few years from now.

Your gmail messages live on Google's servers. It's not ok for them to scan everything, but it's completely different from Apple scanning your phone's content.

The hashes are computed from images that live in iCloud - how is this different?

Suppose Apple flags some image in iCloud using a hash that was probably sent from the device. Do they currently have the capability to decrypt the image to check if the content is actually illegal before reporting it to the authorities without needing access to the physical device?

(Not trying to make a counter-argument to your comment. I genuinely don't get this part).

Hmm not sure what you mean. The hashes are shipped with iOS, and then (if parental controls are enabled) compared with the hashes computed against the unencrypted data on-device, and displays a warning to the user and their parents.

I'm not sure how the image is displayed on the parents' device - it could be sent from the child's device, or the image used to compute the hash that the child's image matched could be displayed.

Are you claiming GMail looks through the emails to match them with crime keywords and reports you to the authorities? citation needed

I'm claiming they use the content of your messages to profile you and better target their ads until they stopped this practice in 2017 in favour of reading your email "for better product personalisation".

gmail (and any other web based email) needs to "read" the email content to provide a search function. If the same program also uses the content to pick some ads from the inventory then I'm personally ok with that.

That is different from searching them for illegal material based on what illegal implies at a given time and location.

nope. i’m not okay with Gmail doing that. in fact I’ve completed removed all google products from my life. i don’t need someone to constantly spy on me.

But the USPS does scan every letter (and package for that matter) for things like weapons and anthrax.

Don't think the US is taking a hard-line stance here. If it were possible to non-destructively scan mail for CP they absolutely would.

The scanning for those things doesn’t allow them to scan the written or printed content of letters sent through the post.

If i recall correctly isn’t there a legal distinction involved in mail privacy, I recall an explanation involving the difference between postcards and letters with respect to lawful interception…

Shine a bright light through the envelope, you Should be able to make out some letters. Maybe make a neural network for reading these letters and putting them together into sentences.

UPS and Fedex can do this as private companies, my understanding is the USPS actually can't due to the 4th Amendment:

"The Fourth Amendment protects the privacy of U.S. mail as if it had been kept by the sender in his home. Ex parte Jackson, 96 U.S. 727, 732-733, 735 (1878); U.S. v. Van Leeuwen, 397 U.S. 249, 252-52 (1970). It cannot be searched without a search warrant based on probable cause."

Reply on news.ycombinator.com