Hacker News Reader

Comment by 1cvmask | Hacker News Reader

This invasive capability on the device level is a massive intrusion on everyone's privacy and there will be no limits for governments to expand it's reach once implemented. The scope will always broaden.

From the article:

Apple’s choices in this case, though, go in the opposite direction: instead of adding CSAM-scanning to iCloud Photos in the cloud that they own-and-operate, Apple is compromising the phone that you and I own-and-operate, without any of us having a say in the matter. Yes, you can turn off iCloud Photos to disable Apple’s scanning, but that is a policy decision; the capability to reach into a user’s phone now exists, and there is nothing an iPhone user can do to get rid of it.

A far better solution to the “Flickr problem” I started with is to recognize that the proper point of comparison is not the iPhone and Facebook, but rather Facebook and iCloud. One’s device ought be one’s property, with all of the expectations of ownership and privacy that entails; cloud services, meanwhile, are the property of their owners as well, with all of the expectations of societal responsibility and law-abiding which that entails. It’s truly disappointing that Apple got so hung up on its particular vision of privacy that it ended up betraying the fulcrum of user control: being able to trust that your device is truly yours.

View on HN

> It’s truly disappointing that Apple got so hung up on its particular vision of privacy that it ended up betraying the fulcrum of user control: being able to trust that your device is truly yours.

Well said.

It's very easy to understand that content on a physical disk I own will not be scanned by some government-friendly surveillance program, and content I upload to somebody else's servers will. I am comfortable with [subsets of] my files existing on both sides of this distinction, but only because I understand it.

Now Apple is letting the surveillance apparatus reach into my own physical hardware, blurring the lines with some overwrought, proprietary crypto-gobbledygook solution. Given the details they've provided, I get why they might have thought this was in line with their general privacy ethos of keeping everything on-device, but the fact is that it is too complicated to build a reliable understanding of in my mental model of my own data privacy--and that's for somebody (me) who is quite technical and has even dabbled in crypto.

Now that I no longer understand Apple's practices as a steward of my private data, I can no longer trust them with it. It's a real shame.

I feel like there's a third option here, though, in that Apple is very likely trying to get ahead of what's likely to be requests from the government that they won't be able to just not abide by. This already happens to every hosting and storage provider and it's entirely plausible that politicians will start publicly wringing their hands to try and justify an actual invasion of privacy where "the government" will be able to scan devices (and even require it from manufacturers) in the interest of "saving the children". This (and I realize it assumes good intentions on behalf of the actors involved) seems to be an attempt to get ahead of that kind of situation by saying "we'll scan things if we're 99% sure they're breaking the law" but we don't want to violate people's privacy. The iCloud vs Facebook comparison is great and noble and all but how long do we honestly think that'll stand up before the politicians move past that argument and onto the next one.

When it stops being about the children, it'll be about the terrorists. When it stops being about the terrorists, it'll be about whatever the next excuse is. This seems like a compromise between those unfortunate scenarios - upholding privacy (we don't see the content) while still attempting to solve for the problems that privacy inherently allows for (we can still identify CP).

> Apple is very likely trying to get ahead of what's likely to be requests from the government that they won't be able to just not abide by

No. Don't make that excuses for them. If it were true it would be a shocking revelation which might result in thousands of cases being overturned.

If the NCMEC searches by providers are being done as a result of government coercion then the fourth amendment requires there be a search warrant. Since there isn't one, these searches would all be unlawful if there was coercion.

Thus far, tech companies like Google and AOL have gone out of their way to testify that there is no coercion (I haven't found a case involving Apple).

If there were coercion it would be a shocking conspiracy. I wouldn't argue that it's impossible: The USG has done some shockingly unethical and illegal things in the past but it fails occams razor.

Moreover, the excuse doesn't actually make apple look better: Instead of being a corporation compromising user privacy and security for commercial gain, they'd be an active participant in a conspiracy to violate the US constitution.

Apple is doing this because they believe they'll make more money this way, and because they believe the complaints raised here about people rejecting devices betraying their trust are fundamentally inconsequential.

Show them otherwise, don't make excuses. Don't blame the government. The government may well be to blame too, but Apple's actions are apple's fault.

>> If there were coercion it would be a shocking conspiracy.

This comment is as if the 2001-2010 decade never happened. Secret wiretaps. Secret Evidence. Overseas torture facilities. Imprisonment without charges. What makes you think that checks and balances would miraculously appear after having disappeared for over a decade.

NOTE: this is a USA-centric viewpoint

> NOTE: this is a USA-centric viewpoint

Those are USA-centric examples.

I'm sure the viewpoint is just as valid across five eyes and even worse in places like Saudi Arabia, Turkey, China et al.

I'm from Australia, allegedly a 1st world democracy - and secret wiretaps, secret evidence (and even secret trials!), overseas torture facilities, imprisonment without charges - are all public policy, covered my the media, and enshrined in laws passes by both of the two-party political system.

>Australia

Don't forget raiding journalists homes and public broadcasters (using illegal warrants!) for reporting on proposed secret spying and hacking laws.

Nice "democracy".

I watched "Secret City" and was aghast at the secret trials, evidence, etc. Is all that really happening today in Australia?

"Covered by the media" is a stretch: Murdoch has been hard at work ignoring all of it.

I would not argue that the conspiracy is impossible, but if it exists then it makes Apple's actions less excusable instead of more excusable.

If the conspiracy exists Apple is an active participant in secretly and illegally undermining the constitutional rights of well over a hundred million Americans. If the conspiracy does not exist, then they're simply lawfully invading people's privacy in order to improve their profits.

Those are examples of shocking conspiracies that got uncovered. Illegal wiretapping and Guantanamo Bay ended up in the news and we're still talking about them now.

But nobody apologies for them or went to prison. There is little to believe the don’t continue.

> If the NCMEC searches by providers are being done as a result of government coercion then the fourth amendment requires there be a search warrant. Since there isn't one, these searches would all be unlawful if there was coercion.

Not a US citizen, so I’m not familiar with this argument. As I understand it the government isn’t searching anything themselves so would the requirement for a search warrant apply?

I think what the US government is requiring is that if a service provider comes across CSAM they must report it. Since I don’t see why searching your own service would be anything to do with search warrants either, is it constitutional to make such a requirement for other reasons?

Finally even if Apple could avoid this requirement, which they seem to have largely been doing until now, was it viable for them to continue like that? Even without a legal mandate to actively search for CSAM, knowing there must be millions of unreported CSAM images on their service can’t have been a comfortable position to be in.

If the government requires or otherwise coerces someone to perform the search, then the searching party is acting as an agent of the government and is equally subject to the fourth amendment. Similarly, the government can't create a privileged entity like NCMEC and allow it to search without a warrant and pretend it's not the government doing.

What is permitted is that if a private entity of their own free will and self interest searches and then finds something, the government can require them to make a report when they found something. Just as you say.

But the government cannot require them to search in the first place, not without extending the fourth amendment protection against search.

Apple can decide that the commercial value of reducing the risk that they're accused of helping perverts is greater to them than the commercial value of respecting the customers privacy. Indeed. But lets call that what it is, and not make excuses that they're forced to search: They're not. They are choosing to search.

Take your argument one step further - the government knows this and starts issuing warrants for exactly these situations. Now, Apple is in a position where they have to violate their user’s privacy and share content in order to comply with the search warrants. The new system allows them to comply with warrants without ever knowing or needing to know what the contents of users’ phones are and only in cases where it’s known that illegal content exists. Apple can’t divulge any other content from the users’ devices because it doesn’t have it or know what it is in the first place.

> Not a US citizen, so I’m not familiar with this argument. As I understand it the government isn’t searching anything themselves so would the requirement for a search warrant apply?

There's a difference between cops paying someone to break into a suspect's house to steal evidence without a warrant, and a 3rd party that, while doing business, comes across material that might be criminal evidence.

The former case, in the US, falls under the doctrine of the "fruit of the poisonous tree"[1]. Evidence collected illicitly won't be allowed in court, and any evidence or argument based on the tainted evidence can be thrown out, as well.

I think the line is blurred with the system in the OP, where it seems like it kind of fits the latter case. It's fuzzy to me when parties are working in tandem with law enforcement, even going as far as running law enforcement's own systems voluntarily, or collecting or giving up information without a warrant when simply asked. To me, that seems a lot more like former case, where the government persuades someone to collect evidence on their behalf without warrants or subpoenas.

[1] https://en.wikipedia.org/wiki/Fruit_of_the_poisonous_tree

> voluntarily

In the US, that is currently where we've drawn the line.

They can cooperate, but it has to be voluntarily and the private party can't be government-by-another-name (e.g. not NCMEC which has a special legislative permission to handle child porn and is overwhelmingly funded by the government), but an actual private party.

Hasn't this already been tested in a US court? I can't remember what it was called, but since you're giving away your privacy to a third party, you've given up right for privacy period.

Two different legal doctrines.

https://olemiss.edu/depts/ncjrl/pdf/PrivateSearchDoctrine.pd...

https://en.wikipedia.org/wiki/Third-party_doctrine

Thank you. Third-party doctrine was what I was thinking of. So I'm guessing putting things in your phone will soon be seen as crossing into third-part territory if it hasn't already.

I’m not making excuses. The government can mandate that Apple monitor content uploaded to its services. All the other major hosting providers do this already. The only difference here is that Apple is trying to maintain encryption while also giving an out. They can’t give more information to the government if they don’t have it.

> The government can mandate that Apple monitor content uploaded to its services.

In the US, if the Government were to mandate Apple search the users content, then Apple would be acting as an agent of the government and the searches would require a warrant per the fourth amendment. This is the unambiguous case law.

If Apple is being forced they should say so explicitly rather than secretly participating in an unlawful conspiracy to violate their customer's fourth amendment rights.

Other providers, such as google, have been unambiguous in their testimony in court that they are not being coerced, for example quoting US v. Miller (6th Cir. 2020):

> Companies like Google have business reasons to make these efforts to remove child pornography from their systems. As a Google representative noted, “[i]f our product is associated with being a haven for abusive content and conduct, users will stop using our services.” McGoff Decl., R.33-1, PageID#161.

> Did Google act under compulsion? Even if a private party does not perform a public function, the party’s action might qualify as a government act if the government “has exercised coercive power or has provided such significant encouragement, either overt or covert, that the choice must in law be deemed to be that of the” government. [...] Miller has not shown that Google’s hash-value matching falls on the “compulsion” side of this line. He cites no law that compels or encourages Google to operate its “product abuse detection system” to scan for hash-value matches. Federal law disclaims such a mandate. It says that providers need not “monitor the content of any [customer] communication” or “affirmatively search, screen, or scan” files. 18 U.S.C. § 2258A(f). Nor does Miller identify anything like the government “encouragement” that the Court found sufficient to turn a railroad’s drug and alcohol testing into “government” testing. See Skinner, 489 U.S. at 615. [...] Federal law requires “electronic communication service providers” like Google to notify NCMEC when they become aware of child pornography. 18 U.S.C. § 2258A(a). But this mandate compels providers only to report child pornography that they know of; it does not compel them to search for child pornography of which they are unaware.

I think you’re missing the point. If the only thing stopping the government is a warrant (which the government itself can authorize) then there’s nothing stopping the government from just issuing those warrants. It may take slightly longer to do so but they will get it and all they need is reasonable suspicion to make that happen. This system makes it impossible for Apple to provide anything to the government outside of anything that is already criminal. If the government entity gets a warrant, they can simply get access to the whole device. This, in theory, prevents that situation because everything is encrypted and only things that are confirmed as being CSAM are provided. They literally can’t provide something they don’t have.

To be equivalent, they'd have to get courts to issue warrants for hundreds of millions of US Apple product users, people who have no reason to suspect they've engaged in any wrong doing. I suspect the courts would take issues with that.

Besides, if they could get the warrants they could get access to all the data in any case (e.g. by getting access to the users backups to steal the users credentials and then accessing the icloud accounts).

>Thus far, tech companies like Google and AOL have gone out of their way to testify that there is no coercion (I haven't found a case involving Apple). If there were coercion it would be a shocking conspiracy.

Isn't Google a company with billion dollar government contracts? No coercion required...

If Google is being forced to search their users private data for fear of losing government contracts then they've purjured themselves in court by claiming otherwise.

If that were the case and Google honestly testified that they performed the searches based on the belief that the government would withhold business from them it is likely that the warrantless searches would be disallowed. Courts have found that even covert encouragement can apply. What matters is that the if it's functionally the government's choice if the searching does or doesn't happen, then its subject to the fourth amendment.

>If Google is being forced to search their users private data for fear of losing government contracts then they've purjured themselves in court by claiming otherwise.

Doesn't need to be fear. Doesn't even need anybody to insinuate something threatening.

The conflict of interest is enough, to willingly do anything you're asked and play the good boy out of greed - to keep/get more contracts.

This seems to imply "the government" is some single minded entity. Anyone who has had to deal with "the government" knows that it is rare that the same department can stick to a purchasing strategy.

> Apple is doing this because they believe they'll make more money this way

And possibly, as mentioned in an earlier post on HN, as a defense against Anti-trust litigation.

Yeah - my read of this is Apple wants to increase their e2e adoption while still handling CSAM in a way that gets them an okay from the regulators.

Ben Thompson's suggested approach for them in this article is to just do the unencrypted iCloud model with normal CSAM reporting like FB does and make that the tradeoff.

Apple actually wants things to be more secure by encrypting everything e2e with this CSAM hash approach to still fulfill that obligation (and protect themselves from future regulatory requirements that are more broad).

Reasonable people can disagree on these approaches to policy, but it's not obvious that Apple's move here is strictly worse for end users - if they do make moves to e2e then it's arguably better for user privacy to do it the way they're doing it.

It's been said elsewhere, but it bears repeating: E2EE is useless if the ends are compromised.

Furthermore, since the end is compromised, it's no longer a true end. The true end is the user and a system compromised in this way doesn't offer any guarantees to the user.

I don’t agree with apples approach. But it’s worth being clear that the hash scanning they propose doesn’t fundamentally break e2e, except for files which match the hash. Yes it might be possible to adversarially create collisions, but that is an edge case.

What is actually bad about their plan is the potential for scope creep and might wider scanning in the future. Your own, handwritten messages and personal photos can be secure even while this destroys many freedoms and lives.

Why are you assuming the end is compromised? What makes you say it is in the first place?

The "end" will happily send information to Apple such that under certain circumstances (that Apple and various organizations get to decide) low-resolution versions of the "end-to-end encrypted" messages can be obtained. That seems "compromised" by any reasonable definition.

Edit: thanks dpkonofa, I made the description vague in the hope that it's more correct.

That's not what happens. Read the white paper. The only thing sent is the hash and signature (which, at worst, essentially amounts to a thumbnail of CSAM). No part of the encrypted content is ever sent to Apple.

Yeah, good cop, bad cop, game.

Bad cop: I want access to all your information.

Good cop: Oh, these guys are after you. Let me see if I can intervene for you. I can implement a selective limited search, that make these bureaucrats happy and at the same time will protect you. I am on your side, I hate them too. This is the best practical solution.

> problems that privacy inherently allows for

I wonder how we ever survived with the level of privacy we had before the advent of the internet. It must've been a living hell. /s

Privacy is not a problem, it is necessary in order for freedom from tyranny to be possible. Even if all the governments of the world mandate that all communication devices must be compromised like this, criminals will still be able to have private communication channels, but lawful citizens won't.

I don't claim to have an ideal solution here, but to your point: There weren't highly-effective global distribution networks for CSAM "before the advent of the internet" either. This capability has created a market for these people to produce/obtain this material, and thus creates financial incentives for people to abuse children in this way more than in pre-internet times. There needs to be some way of combating this that can keep up with this growth curve, and that answer can't simply be to throw up our hands and say "the criminals will always win, so there's no solution worth doing".

We should tackle this from the other end though. That there are children so abused and isolated whilst ignored by society is shameful. We need solutions that treat children as humans rather than a product or contraband.

This makes it sound like there aren’t entities out there who are interested in such solutions. If you have one that fulfills that need, I’m sure Apple and others are open to hearing it.

This is a great response and covers what I think the crux of the issue is. Technology has exacerbated a problem and, rather than simply bow to that, they tried to come up with a solution. Whether that solution addresses the negatives of the problem without introducing other, worse negatives is to be seen. On paper, it feels like they have addressed the problem in a reasonable way if you trust that they want to make money while absolving themselves of liability. They can’t violate users’ privacy if they don’t have the ability to do so.

//they tried to come up with a solution.// ... they decided to spy on us ^there I fixed it for you. Making me total dictator would be a 'solution' too I mean something has to be done nothing else is working or could possibly work. Me for dictator- I promise to be benevolent, who can argue with that. At worst it is a thing reasonable ppl can disagree about. /s

But I fail to see how icloud backups are a good place to tackle it.

And I doubt this system, which looks for known files, is going to do very much to impact production.

I never said privacy was the problem, so your argument is irrelevant. What I said is that privacy (true privacy) introduces problems that we may want to solve for. You can simultaneously be an advocate for user privacy while agreeing that CSAM is bad and should be minimized. The question is how do you maintain privacy while still being able to act (especially if mandated by a government) on known illegal actions. In the past, that wasn’t possible. Apple is suggesting that this is possible but with the giant caveat that you have to be willing to put trust in the way the system is developed.

I don't necessarily disagree with the "getting ahead of it" thing, and I do see the benefits of this strategy wrt. keeping data private in the face of escalating govt overreach, but I'm simply not comfortable with the surveillance happening on my own physical device. It means trusting proprietary software to work exactly the way it claims to, which in my own experience is often not the case.

I share that concern and completely understand. My only response to that concern, though, is that what you’re asking for is not possible without submitting the content in question to Apple and I would rather they not have it at all and therefore not even have the ability to go down that route.

It’s like a double airlock. If your content never leaves your device, there’s no way for them to provide it to someone upon request. It’s definitely a complicated situation but I have yet to see someone provide a solution for how to achieve what Apple has while never transferring your data to them in the first place.

> what you’re asking for is not possible without submitting the content in question to Apple

This unfortunately appears to be true, and part of me is impressed by [the idea of] the solution they've come up with. But, like I said in my first comment, it means in practice that I have an opaque and unaccountable surveillance program running on my personal physical hardware, which is undeniably an escalation. Whatever they claim it's doing is both completely unverifiable and probably complicated enough, and subject enough to change, that it's practically impossible to form a complete and persistently correct understanding of the attack surface it exposes—even if it were open-sourced and exhaustively documented, which it isn't and presumably never will be.

I am much more comfortable simply knowing that anything I upload to somebody else's servers is subject to snooping, and anything I keep on my hardware is not. That's how the other cloud storage providers do it, and I may not like it, but it's at least easy to account for when I'm thinking about my own data security and privacy. It's admirable that Apple tried to come up with something better, but (I'd argue) from certain important perspectives it's arguably worse.

Software is a chronic disease. Once you let it in, it never goes away, and changes beyond the scope of "fixes" seem to infallibly make it more intrusive and/or harmful. We are like frogs with many bodies, each being boiled in a different pot by a different chef. I have no interest in yet another unaccountable daemon inhabiting my private person.

While I agree, in principle, I think that cat's been out of the bag for a while. The government will continue to mandate things away from end-to-end encryption (they're already trying to pass bills to make it illegal) and this seems like the most reasonable solution I've seen thus far that still allows for end-to-end encryption while addressing the concerns of governments around the world. If you want what's on your device to stay on your device, I think you have to live in a place that doesn't exist - namely, a world without governments or the internet.

//It’s like a double airlock. If your content never leaves your device, there’s no way for them to provide it to someone upon request.// Except they just built themselves a way to get our data on our devices which very much does transfer our data.

No, they didn’t. Apple never gets any of the content on your device. They get signatures and, at best, a visual representation like a thumbnail.

Whether scanning happens on the iPhone or in iCloud does not counter the problem that the dragnet nature of this makes it easy to weaponise.

Getting CSAM pictures in the iCloud photo library of someone you don't like does not even require physical access sometimes: For example, WhatsApp has a "Save to camera roll" option that's enabled by default: just send a bunch of bad pictures via WhatsApp, those will get synced to iCloud after a little while, and now that person is in big trouble.

>It's very easy to understand that content on a physical disk I own will not be scanned by some government-friendly surveillance program, and content I upload to somebody else's servers will. I am comfortable with [subsets of] my files existing on both sides of this distinction, but only because I understand it.

According to Apple, the only content being scanned are the images you are storing in iCloud. So how is this breaking your rule?

> According to Apple, the only content being scanned are the images you are storing in iCloud

Thats the whole point of this debate. TODAY (if you trust apple is honest) it's only stuff being stored in icloud. But there is no technical reason for this to be true - just a "policy" reason. The scanner is already deployed to devices, we already let in the trojan horse. Tomorrow, the rules could change (and we might not know)

This is breaking my "rule" because the detection is being moved device-side as part of a complicated scheme I don't believe it's realistically possible for an outsider to have a complete and persistently correct understanding of. Thus, I do not trust myself to fully understand the attack surface I'm exposing, and that is something I'm not personally comfortable with.

I thought this was fairly clear from the later parts of my comment.

"The USA PATRIOT act will only be used against terrorist threats." 12 years later, Edward Snowden proved otherwise.

The world is a much different place than when I grew up in the 80s. I can't imagine what it would look like in another 40 years. I hope I'm dead by then, because it doesn't seem like it's going to a place I want to live in.

I guess we all now just realize the truth: you don't control your iPhone. Apple does. You merely use it.

In a way, nothing changed. Apple could've done on-device scanning forever. In another way, everything changed.

I'm not sure what I'm going to do about it. Problem is that the devices are really really good.

Buying an iPhone (and increasingly Mac) is like going to Disneyland: You pay a lot of money to be allowed in so you can pay them even more money. The experience is highly curated and controlled. At the end of the day, you are just a guest there and what you are or aren't allowed to do is determined by the company.

EDIT: And they have CCTV and undercover security officers everywhere. More than you can possibly imagine.

I really don't Apple Hardware is a lot of money. I buy the cheapest MacBook Airs with a ram upgrade and they last me around ~6 years. Same with the phone I buy (iPhone SE). Outside of the battery needing replaced they last me a long, long time.

Everything else with I agree. The eco-system of all these companies is never-ending (cars, food, cities, etc.). It's like those sci-fi movies where one corporation owns everything. The only difference is it's 5 or 6 companies because they haven't yet started to merge.

You can buy an Android phone with better specs (except the camera, where the iPhone objectively the best) for 200$, while an iPhone is minimum 500$ (and for an SE 2 that is an old iPhone 8 with a newer SOC).

For a computer you can buy for the same money that you spend for a MacBook Air a computer with better specs and hardware that you can upgrade. Apple tends not to upgrade the oldest computers, leaving you with an insecure OS where you can't run the latest software. I have my battle Thinkpad that with Linux runs better than most Macbook and we are talking about a PC that has more than 10 years and I bought used on Ebay for 100$.

Really Apple is not that great. I once used to buy their product thinking they were superior, and maybe once they were, nowadays they are just the other crap made in China but sold at (at least) twice the price because they have the Apple logo on it.

> You can buy an Android phone with better specs for 200$ > For a computer you can buy for the same money that you spend for a MacBook Air a computer with better specs and hardware that you can upgrade

If you compare two phones at 200$, sure. But it is not possible to buy a phone with a better CPU than the 500$ iPhone SE 2. Impossible, no CPU can beat it. So no Android phone has better specs.

For a laptop, if the case is considered a spec like it should, then you have a much clearer picture. Apple has perfected its aluminium processes to provide a rigid and shock-resistant casing, and inevitably when people provide legitimate examples of PC laptops to buy, they never mention that the laptop you'll get will have a shitty plastic case with a heavy steel frame. The worst of both worlds, and many friends have come to me saying they need to change their laptop when theirs is fairly recent. The culprit? their case broke or the display hinge did.

> For a computer you can buy for the same money that you spend for a MacBook Air a computer with better specs and hardware that you can upgrade.

Which specs? When I last checked, the latest M1 Airs were dominating the entire laptop market on CPU performance, battery life and not making noise. These are important considerations. I mean, sure, for the same price you can probably find better displays, more RAM, a bigger SSD, a better port selection, and all sorts of other things, but there are always tradeoffs, it's not like any laptop beats an Air wholesale on all specs.

If someone doesn't particularly care about upgradability (most people don't), the Air actually seems a pretty good deal. Perhaps they were overpriced before, but I don't think they are anymore.

Any recommendations for phones or laptops?

> Buying an iPhone (and increasingly Mac) is like going to Disneyland: You pay a lot of money to be allowed in so you can pay them even more money.

Bought the latest SE over a year ago at considerably less than my last comparable Android device. Have spent under $100 in the App Store since.

Phone does everything that I want it to do including some fairly complex multi-app automations 15 minutes before I leave, when I get an SMS, etc...

That's just like going to Disneyland, but packing your own luch and not going on any of the rides. :)

More like going on the rides, but not paying for the Fast Pass. Taking the Fast Pass is like paying for Apple services. I took the shitty Fast Pass for Apple Music and iCloud Drive, but I'm not paying for bloody Ted Lasso!

A Mac is very different from an iPhone. I am writing this in Firefox, I have development tools and commandline scripts installed.

Are you sure? I have a Mac too, and earlier this year all of my non Apple-approved software stopped working because some random Apple server went down.

Yes, and the price these companies can charge is determined by the market. If what they are doing no longer serves a large market, their business will shrink. And if there actions expose a new opportunity for someone else, that company will form and business will grow.

And Disney is one of the most well-known global brands - at least when people think about entertainment and vacationing.

RMS has been saying this stuff for decades, but people ignore him.

This sentiment gets repeated all the time and it drives me crazy.

I've read a lot of stuff by RMS and am certainly aware of his concerns.

I have an iPhone and Mac so I guess you would consider that I "ignored" him. This is a ridiculous conclusion. I considered the risks and trade-offs of non-FOSS software, and regrettably accepted them, because the FOSS alternatives had trade-offs that cumulatively (for me) were much worse. Unlike RMS, I am not a one-dimensional person that only evaluates tech on the single dimension of freedom. Tech is not a religion for me; it's just a tool.

RMS pontificating about FOSS does not magically bring iPhone comparable FOSS software and hardware into existence. If the FOSS community wants consumer adoption, ratio of pontificating about to building consumer products needs to be much lower.

This is a very solipsistic way to look at the world. FOSS has no duty to try to appeal to you personally, and if you accept the end of your privacy over UI niggles, that's your choice to make. The reason Apple can spend so much on UI is because of your willingness to eat whatever they serve you.

After emancipation, there were plenty of slaves who wouldn't leave the plantation, and became slaves-by-another-name in the sharecropping system. I don't think any of them were so up their own asses that they blamed the slaves who left for not making it easier to leave.

Also, RMS didn't talk about "FOSS." He talked about the inevitable future if we continued our trajectory, and suggested Free Software as the solution.

I'm also not going to make lowering your carbon emissions just as easy and convenient as using all of the carbon you want. Take responsibility for yourself, or at least don't actively denigrate people for being right.

But I never asked FOSS to make me anything.

All I said is if the FOSS community wants consumer adoption, the path forward is making things consumers like, NOT blaming us for "ignoring" RMS, because no one ever did that.

Basically everything your post implies (that I think I am entitled to something, that I think everything should be easy, etc...) is not true.

As I keep pointing out again and again, all I'm saying is that people don't use FOSS, but it's not because they don't value privacy, not because they don't value freedom, and for the love of biscuits not because of anything to do with RMS or ignoring him.

The options are use an iPhone (not freedom), use an Android phone (not freedom), or use something like LineageOS. Using something like LineageOS is major commitment that most people don't have room in their lives for, because they have different priorities, which might also be very good.

EDIT: Here's a metaphor, it'd be like if you asked your friend who owns a car with an ICE why he keeps ignoring Al Gore's warnings about the climate. It's like, Al Gore can be right, your friend can believe in Climate change, and he can still decide he needs an ICE car because he's barely making ends meet and is trying to support a family. You can claim that your friend has made bad choices, but there is no argument that he "ignored" Al Gore.

> The reason Apple can spend so much on UI is because of your willingness to eat whatever they serve you.

No, it's because FOSS has no economic model.

You have hit on one of the problem permeating modern society. No one wants to take personal responsibility for anything.

it always some one else that is to blame, the rich, the evil corporation, the right wing, the left wing, china,.... etc etc etc

> I've read a lot of stuff by RMS and am certainly aware of his concerns.

> RMS pontificating [...]

Uh, no. RMS was right all along and you're still not getting it.

You bought devices you can't upgrade, you can't run software on, that oppress indie devs, that tax 30% of the market, that sell out freedom fighters in oppressive regimes, and that now spy on you. And now you realize the problem.

The only way out of this madness is to get the sensible representatives in Congress to move forward with an antitrust case. Breaking up the power monopoly will perhaps get us back to a place where we have rights. The way it is now, Apple is a central point of failure.

Again, everything RMS spoke was truth, and it's here again rearing its ugly head.

It's weird that people seem to trust Congress with this. This is the same Congress that is considering banning end-to-end encryption, remember?

The funny thing is that you are failing to recognize the value of devices that can render web pages, give navigation instructions that won't get me lost, run games, have long battery life, great screen quality, and a bunch of other things.

I have yet to see a phone with the build quality and value add that I need a mobile phone to have from Free Software endeavors. These are the table stakes for the majority of people. Not the list you just rattled off. You aren't even in the running to compete on the other value adds if you can't do the above.

The real-world alternative to Apple is Microsoft, Google, and Blackberry, not GNU. Because almost no one and no money cares about GNU.

> The only way out of this madness is to get the sensible representatives in Congress to move forward with an antitrust case

What are you looking for out of this anti-trust case? Apple is not a monopoly. There are numerous privacy-focused phones and Android distros available. I think there just isn't a huge market for a privacy-focused phone (no, 1000 people on a HN and twitter is not a huge market.)

> If the FOSS community wants consumer adoption, ratio of pontificating about to building consumer products needs to be much lower.

Actually it's not like FOSS community is fighting for your adoption, you know? It's you who should do something in order to make good things happen.

He did. He bought Apple products. That's the whole point.

> Tech is not a religion for me; it's just a tool.

Ok, it is a "tool", but it's like an axe controlled by another person, not you. Maybe you trust that person with such a tool; I don't.

You are doing the exact thing I am complaining about. I DON'T trust Apple and never said I did; I quite explicitly elaborated on this above.

Not trusting Apple doesn't magically bring a trustworthy iPhone competitor into existence.

That much was known upon purchasing the axe - maybe it cuts trees 50% quicker and thus was worth the tradeoff, but now you can re-evaluate your options and purchase a different axe.

TL;DR: You understood the trade-off, and chose to become a product for the convenience. The majority of us here have done the same, because becoming a product is part of the modern life. Nowadays choosing digital purity is like becoming a digital Amish.

Bingo. RMS is not being ignored. People are just making informed decisions that FOSS purists don't like.

No one takes you seriously when you describe an interdependent mutually beneficial bur imperfect relationship as "become a product"

Well your sentiment drives me crazy, especially for techies. It is up to us whether a non-feudal digital society will exist or not. It's true that FOSS will never be as good as the monopolists' who are able to pour billions of dollars into polish while tightening their grip over our lives. But if we are unwilling to make sacrifices in this fight then the battle is already lost.

Agreed and a great example of why his message on free software is so important. I would never have been as cognizant of the topic if not for his laser-focused and committed work.

Quite literally: https://youtu.be/Ag1AKIl_2GM?t=57

Every year RMS sounds less crazy.

They don't ignore him, they just don't have the same priorities. Having privacy with a phone means giving up a lot of other things which people value.

>Having privacy with a phone means giving up ...

Well it would mean giving up the phone entirely.

who is RMS?

Richard M Stallman: https://en.wikipedia.org/wiki/Richard_Stallman

https://xkcd.com/743/

Apples selling point is that they decide what should be running on your phone. From the various app store monopolization threads, people like that apple controls your iphone, and wouldn't buy one if the owner controlled it.

On the other hand, I'm not buying an iPhone due to control issues. If I were able to fully control it, I'd probably buy one.

Why would you choose apple over anyone else at that point?

> people like that apple controls your iphone, and wouldn't buy one if the owner controlled it.

My guess is that this applies to about as many people as the opposite “wants to control their device” stance. Which is to say approximately nobody. Most users probably don’t think about these things much if at all. They want a smartphone that runs the expected smartphone apps and has the expected smartphone features, and do not care whether or not some nerd can install and run some apps they’ve never heard of on his own device.

I imagine, though, that most people would have an opinion one way or the other about phones snitching on their owners.

The iPhone is a status symbol. That's why most people buy it.

Exactly, it's easy with phones - you can have the same phone your favorite celebrity has! Not so with almost anything else. People have just the weirdest reasons. It's also funny to me because I will never ask anything about a persons phone, laptop or other tech gadget if I recognize it from a distance (for example Apple products), but I will ask and converse about brands/devices that I have not seen much of. Not sure why people think Apple products give them any credit whatsoever.

Android is a low-quality platform with limited security updates, multiple app stores, preinstalled crapware, and other debris. I chose an iPhone so I wouldn't have to deal with these issues.

I bought an iphone because I want a phone that'll last five years and get security updates for at least as long. I also bought an iphone because I have a lot of confidence it won't have design flaws that break its gps (like the motorola I had) or have its ecosystem EOL'd (like the Windows phone I had, which was an incredible piece of hardware, and I loved it!)

I wish the android hardware ecosystem had half the longevity you get with the cheapest iphone.

Steve Jobs received a standing ovation when he showed how the new iOS would finally let you change your wallpaper. This broke the RDF for me.

Why is that wrong? I also applauded (internally) when notifications were added because it was a feature that I wanted and I didn't care that Android had it before because I wasn't using an Android phone. I bought all of the Google-branded Android phones when they came out and I still preferred iOS and the iPhone so having that feature was worthy of applause for me. I don't see how the wallpaper thing is any different. As much as I would like to have had the ability to change wallpaper before then, that wasn't as important as all the other things I cared about more.

I've never been to one of Apple's events, but as a viewer of their videos some of those applause breaks have me convinced there are giant "Applause Now" signs. I imagine them being on more than they are off by how over the top their dialog is written. Or they fill the air in the room with some sort of gas that makes the attendees very susceptible to the RDF.

Those are much more fun explanations than just realizing they probably have plants to start the cheering in a room full of fanboys

Life existed before the iPhone. Life goes on even if you have to use other devices, and you'll be able to do more stuff than before iPhones were invented. ppl are very inventive and adaptable. Give Linux a try. Mint is a pretty good noob friendly version. Ubuntu is a very popular one.

There’s not much you can do about it if you want a decent smartphone. On Android Google also can do on-device scanning since forever.

The problem is _not_ on-device scanning, it's on-device scanning and then sending incriminating results to the device maker.

Final result is better than before, because scanning applies only into targets which are ending into the cloud. Content was plaintext in the cloud before (not counting server-side encryption).

With current change, they have "partial" E2E encryption and Apple can decrypt them only if CSAM treshold is reached. If we leave all speculation, this is a great improvement for privacy in CSAM context.

You can opt-out from scanning by not using iCloud.

On Android they can do this?

Source?

The distinction still needs to be made between AOSP and whatever ships on your phone or is included in play services. Especially on HN of all places.

Fair enough, but Android includes Play Services in all notable cases. Yes a handful of people run it without, which does solve that issue, at the cost of convenience and usability.

That's why I specified "decent smartphone". I wouldn't consider the UX of Android without Play Services to be "decent".

phone's are just phones. At this point multiple companies and potential governments are monitoring or have the capability to monitor it.

But computers are another story. So far we still maintain some privacy there thanks to Linux.

One of the most pernicious sins of the smartphone revolution was to rebrand the "computer". We'd evolved expectations as to what we were entitled to on our own machines - yes, even those with a proprietary OS - and then with one weird trick, it all went in the trash. Advertising, surveillance, inability to install whatever you want - before smartphones, this sort of thing used to be unequivocally malware.

The worst part is that now the dam's broken, it's all bleeding back into "computers".

You're blaming smartphones for problem that exists because of the Internet. If smartphones didn't render computers irrelevant to most people, all this "bad app" stuff would have happened on computers.

And the computers that don't have "bad apps" are hacked and encrypted by ransomware. Is that better?

Spyware is older than smartphones.

> The worst part is that now the dam's broken, it's all bleeding back into "computers".

Back in the day, before cellular phones, mainframe and minicomputer vendors tried their best to restrict the software that could be run on “their” hardware. They realised that they could squeeze the most out of their customers that way.

Android is also Linux. Yet some manufacturers don't allow any kind of boot unlocking or root access.

Open source doesn't guarantee we have any type of control over it if the hardware is locked down. The reason is more that the industry hasn't bothered selling locked-down computers yet by default. The tech is there, Secure Boot + TPM. They just give us the options to override in the BIOS. For now.

> Open source doesn't guarantee we have any type of control over it if the hardware is locked down

It can though. See: GPLv3.

IMO the greatest failure of Linux was not upgrading from GPLv2.

Open source also doesn't guarantee any type of control if it's SaaS or anchored to a closed source SaaS system. There's a ton of "but it's open source!" SaaS companies that I shall not name that leverage open source but in reality are lock-in walled gardens. The code is open but the data and network effect are not.

Unfortunately, phones are most people’s primary computer.

> If people could understand what computing was about, the iPhone would not be a bad thing. But because people don’t understand what computing is about, they think they have it in the iPhone, and that illusion is as bad as the illusion that Guitar Hero is the same as a real guitar.

-- Alan Kay, https://www.fastcompany.com/40435064/what-alan-kay-thinks-ab...

> phone's are just phones

> But computers are another story.

Librem 5 and Pinephone smartphones are computers running GNU/Linux.

Yeah I think the distinction is more with OS than the form factor.

With a close garden and close sourced apps, there are basically nothing you can do (to make sure you're not being monitored). Completely at whim, true for regular computers too, but a lot more choices exist for the latter group.

Unfortunately that is accurate for every property software, not only that but you can easily make a case that all software that you personally don’t maintain including open source has same problem.

I think what you mean is that you don't control the iCloud Photos client, Apple does. Your photos are scanned by the iCloud Photos "client" (which is built into the OS) before uploading them to the cloud.

Would it be any different if Dropbox was scanning files before it uploaded them rather than afterwards? It already computes hashes of your files on your device so that it doesn't have to re-upload existing content, so I honestly don't understand the objection to doing image scanning on your device before uploading your content.

The point is that if the capability for "the iCloud Photos client" to scan your photos before uploading them to the cloud exists, it's only Apple's policy that stops it from scanning all of your photos.

That capability obviously already exists independent from this CSAM-scanning system.

You can uninstall Dropbox. You cannot uninstall Photos.

While there is certainly truth to this, this is also a defeatist position. Of course Apple could do anything, with or without telling us. And they do some fairly indefensible things, though I would argue those have mostly to do with the App Store.

But this is not the time to throw our hands up and say there was nothing we could do all along. That the situation was never ideal does not preclude there being something worth fighting for.

> I'm not sure what I'm going to do about it. Problem is that the devices are really really good.

The devices are good, but still Apple has a weak value proposition.

Also, handing them your money probably isn't going to make things better in terms of alternatives.

> Problem is that the devices are really really good

their devices are really good, but they come with so much crippling for the sake of the walled garden that their goodness is wasted in some fronts.

There's a large list of things they are (or can be with minimal effort) perfectly capable for, but are forbidden for reasons, like reverse wireless charge of other iphones / airpods.

Meh. Dropbox and Google Drive can run arbitrary queries over your files stored there. iCloud (assuming they finish e2ee transition) will have to push the same hashes to everyone. It's not transparent and we don't have a way to inspect what exactly are they searching for, but at least there's a way in principle to reverse engineer the algorithm and to monitor how often hash database gets updated.

In my book that's a step in the direction of privacy, compared to old status quo.

> Meh. Dropbox and Google Drive can run arbitrary queries over your files stored there.

However, unlike with Apple's invasive on-device scanning, you can encrypt files before storing them at Dropbox or Google Drive. There are even simple turnkey solutions like Sookasa:

"Sookasa acts as a transparent layer over Google Drive to encrypt your sensitive files on the cloud and across connected devices..." https://www.sookasa.com/GD

"Sookasa protects data both on devices and in the cloud, and decouples the data from the encryption keys, meaning your data stays secure no matter where it goes." https://www.sookasa.com/dropbox-security/

Cryptomator is another encryption software which can encrypt files before they're uploaded to the cloud, and it's open source.

https://github.com/cryptomator/cryptomator

How do you know Sookasa isn’t doing the same thing? It doesn’t appear to be open source.

You can irreversibly transform the image data of photos added to the Photos app as well.

Rclone and gocryptfs are other options for cloud encryption.

Huh? You can choose not to use any cloud service if you want. If you buy an iPhone, you can't... Choose not to use the iPhone you just bought.

This isn't a step towards privacy and it sounds (to me at least) like quite the logical contortion to argue that it is.

Not for people that didn't trust the cloud and didnt out their life in there in the first place.

> iCloud [...] will have to push the same hashes to everyone

Why?

What's to prevent them from pushing specific hashes to a specific phone?

There are three primary sources stating that the database will be embedded in iOS. Remote hash updates introduces privacy risk.

This is a better way to frame the discussion, IMHO.

The conversation is around Apple, which is critical, but we need to compare them to the rest of the industry, and discuss the government/citizen tradeoffs in that light. I.e., holistically, not per company.

True. The constant migration of everything to the cloud has lots of consequences just like this. If the false positive are as common as the fotoForensics guy states, this could also become a new weapon for corporate warfare. A small competitor to a market Apple wants to control happens to have assets stored in an apple cloud? Guess who's offices are getting raided today?

That is indeed what the article does, does it not? It makes the case that storing online with a decryption key that can be used with a search warrant is probably the right trade off, and the way other companies sometimes implement this.

Then you get to choose whether to push your data to the third party or not, given the risks involved.

The author even notes they were opposed to Facebook's end-to-end encryption previously, I assume because as for defaults it sets a precedent and makes it unsearchable, but I'm not sure the specific tradeoffs they weigh and points they consider since it's behind a paywall (and I'm not sure I agree).

> discuss the government/citizen tradeoffs in that light. I.e., holistically, not per company.

Right now the differences are essentially per-company, since we've let our experiences be controlled almost entirely by a small subset of companies. To abstract the implementation from the primary implementer is to obfuscate some of the cause and effect here. We should discuss this as a societal tradeoff, as you note, but we should not ignore that this was spurred by a company running out in front of what was required of it and implementing this system which many see as at the expense of their users privacy.

I don’t keep child porn on my phone (or any where else. I also don’t keep smallpox in my freezer or nuclear weapons on my basement. Noninvasive scans for these things probably make the world a better place in some ways.

The part I object to having my life disrupted by having my personal accounts unilaterally deleted by a fucking buggy bot. Our phones are too important to us to just have them shut off without notice. That’s bullshit.

>Noninvasive scans

Scans on a local device feel quite invasive to me. Phones have become an extension of our person, let's not kid ourselves.

Is a picture of a naked kid going to trigger this algorithm?

In a few places taking pictures of your child naked while swimming is considered child pornography. Other places having children run around naked on the beach is the norm. (I have a few pictures of me, at 3y/o, naked on the beach)

In the world of remote medicine, can a parent take pictures of their naked child to send to a doctor?

How are they going to fit their cultural specifics to the world?

Knowing how Facebook dealt with it - they are going to apply the strictest rules, so no naked child photos are allowed on your iPhone anymore. For no reason.

Apple has said multiple times that accounts are not shut off with any automated system, that portion of the process is handled by humans.

It's hard to argue they did this for a vision of privacy.

They did this because they want YOUR phone to be a liability not THEIR servers.

I've heard it argued that this allows Apple to move iCloud toward end-to-end encryption (which would be a good thing for privacy, right?). It seems like the current US government position is "we'll let tech giants use end-to-end encryption for user data as long as they put measures in place to catch CSAM."

by "US government position" I'm including negotiations and proposed/threatened legislation, not just the current laws on the books.

If you really believe that, then I have a bridge to sell you. The exact same safety argument can and will be applied to ALL data whether on your device or Apple's servers.

Why limit to iMessage and photos? Why not Signal on your device?

Why not your backups on Apple servers? Oh wait, already happens.

I think Apple would rather put this CSAM-scanning system in place (which allows them to implement end-to-end encryption for iCloud in the future) than deal with the EARN-IT Act or similar becoming law, which could effectively make all e2e-encrypted services illegal (require a government backdoor).

>The bill also crafts two addition changes to Section 230(c)(2)'s liability, allows any state to bring a lawsuit to service providers if they fail to deal with child sexual abuse material on their service, or if they allow end-to-end encryption on their service and do not provide means to enforcement officials to decrypt the material.

https://en.wikipedia.org/wiki/EARN_IT_Act_of_2020

If that were the case, wouldn't this CSAM scanning system be insufficient to meet those EARN-IT requirements?

You have other Apple services and third-party apps that host material on Apple's servers.

For example, if a user turns on iCloud backups, then every third-party app's Documents directory is backed up to iCloud. Would it be a violation to not CSAM scan that content? What if the contents are encrypted? Would they be required to be decrypted so that they are CSAM-scanned?

iCloud drive is another Apple service that backs up to Apple's servers. Wouldn't its absence from the list be a violation? What if a user hosts encrypted files on iCloud drive? Would the user be required to decrypt them so that Apple can scan them?

It seems that the real intention is to eliminate end-to-end encryption.

>wouldn't this CSAM scanning system be insufficient to meet those EARN-IT requirements?

Yes. My point is that there's an ongoing dance between the tech companies and the government, and through their negotiations and government connections Apple probably views this CSAM-scanning move as making an EARN-IT-like law less likely to be passed. It's overall the less-invasive option. The US federal government is putting pressure on tech companies not to host CSAM, and if tech giants didn't agree to do stuff like this the government could respond by passing stricter laws to effectively make unbackdoored e2e encryption illegal.

Apple has a lot of influence but at the end of the day they're a US-based company that has to follow US laws. Voluntarily implementing CSAM-scanning is in their own interest as a "pro-privacy" company if it prevents more draconian anti-encryption laws from being passed that could effectively outlaw e2e encryption.

I don't view this as Apple singlehandedly trying to eliminate end-to-end encryption; that seems like a pretty radical view of the situation to me but of course you're free to hold that opinion.

I don’t hold the view that Apple is trying to eliminate end to end encryption. I view this as a push by governments to do so and the increasing willingness of the tech industry to work with them.

This is more like Apple giving way gradually and the government happy since in the long run they get everything they want.

Examples: we don’t unlock phones for the government… but we give them all the data if you back up your phone… but you have so much privacy!

We don’t read your messages, oh wait now we do, but only for child abuse, oh wait, we don’t control what it looks for but let’s not talk about that because it hurts our marketing

Hard to believe that a law limiting that would stand up in the supreme court, and Apple has previously indicated they would be willing to pay whatever legal costs are necessary to defend themselves from that sort of attack.

It is weird that Apple would do this in the first place though, it certainly doesn't make me want to use their products.

It moves iCloud to end-to-end encryption by compromising the ends. Not really a reasonable outcome.

> move iCloud toward end-to-end encryption (which would be a good thing for privacy, right?).

"End-to-end" encryption is nothing to strive for if you're destroying the ends. With this change, the "ends" become the users themselves. By embedding an agent acting on behalf of Apple/government, the device in front of end users is no longer a tool but rather an adversary. This is computational disenfranchisement.

Hey if the ends justify the means.

I’ll show myself out.

Feels like nobody here has bothered to read the actual technical specifications.[1]

This already adds new level of encryption into iCloud stored images. They have essentially created E2EE system with a specific access (or backdoor), while preventing the use of backdoor for other purposes than CSAM (so nobody can ask randomly to decrypt something else). They can only decrypt images, when user's account reaches the treshold of CSAM hash count:

> Only when the threshold is exceeded does the cryptographic technology allow Apple to interpret the contents of the safety vouchers associated with the matching CSAM images.

While this is not perfect end-to-end encryption solution, it is better than only server side encryption. Now there are two levels of encryption. If someone breaches Apple's servers and they have also access for server side private keys, they still need matching NeuralHash value to decrypt the images.

[1]:https://www.apple.com/child-safety/pdf/Expanded_Protections_...

I think the argument here is that (1) the model is going to have false positives (e.g. revealing pictures of you and your spouse, your beach photos, etc.) that will permit access for non-CSAM (or at the very least, mark your account as suspicious in the eyes of authorities), and (2) the model itself can be updated/replaced for any reason and potentially at any government's demand, so the limits on scope are effectively moot

For argument (1), they are only looking matches from existing database of hashes what NCMEC is providing. They are not developing general AI to identify new pictures, they only try to stop redistribution of known files. Because of that, their claim for 1/1 trillion false postives might be actually close to be correct since it is easily validated on development phase. Also, there is human verification before law-enforces are included.

For argument (2), this might be valid, but yet again, all we can do is to trust Apple, as we do all the time by using their closed source system. Model can be changed, but it is still better option than store everything unencrypted? In case you mean forging hashes to decrypt content.

For the sake of surveillance, it is not strong argument because again, system is closed and we know only what they say. Creating such model is trivial, and is not stopping government for demanding if Apple would want to allow that. System would be identical for antivirus engines which have existed since 1980s.

This is such a PR failure for Apple, because all their incoming features are improving privacy on CSAM area, everything negative comes from speculation which was equally already possible.

Not to mention, this neural hashing can't be a cheap operation. Better to use the processors paid for by your customers than ones you have to pay for in the cloud!

I honestly wonder if the privacy/intrusion backlash wasn't even considered because they were focused on this from the perspective of "isn't this great that these phones now have enough power to do this computation on-device", the same way they were proud to be able to announce that Siri processing would begin to happen on-device.

I thought about that as well. They rushed to publish some unpolished PR pieces and FAQs right after the announcement and at very unusual times (3am in Cupertino) trying to damage control so my guess would be as well that they didn't even consider the backlash. Maybe they were really proud about the technology they implemented. It's a little bit sad if you think about it.

If you think about this, this is a really great innovation, which is left behind bad PR. There was a leak about their system before release (which got a lot of publicity, and was heavily missleading), so that might be a reason for their hurry.

I have been browsing their technical papers for couple of days now, and they have managed to innovate a system which has "kind of" end-to-end encryption, but enables access for specific (and only this kind of) content. They have managed to make encrypted system where they can lock themselves out, and can't answer for example the demands of FBI to show all images of specific user.

On the context of CSAM, this is an improvement for privacy, but being able to understand that, it requires great understanding of different technologies.

I would like to see tests wrt this before I assume it--Apple puts a pretty hefty premium on battery life for customer devices, and while that would probably not win out when placed against this kind of liability minimization, they've got a lot of sharp folks there who crunch this stuff in their sleep.

I have been noticing increased background activity on my phone after it reached 100% during charging, for years now.

Pretty sure they can infer your normal sleep schedule and, after your phone has fully charged (1h to 3h after you fall asleep) they can freely use it as a P2P computing device.

Nothing new really. And they can still keep their promise of a good battery life -- which is quite justified by the way, I am using iPhones for 4 years now and they've consistently won over any of the 13 Android devices that I've used in the years before (and sometimes during).

There are ways to achieve both -- good observable battery life plus ability to use your phone for P2P computation -- and it's IMO obvious that Apple has succeeded in that for several years now.

> which is quite justified by the way, I am using iPhones for 4 years now and they've consistently won over any of the 13 Android devices that I've used in the years before (and sometimes during).

I find this a bit shocking. Were all of these Android low battery devices?

I don't have a good point of comparison, as I've only used Android on phones, but there are a lot of Android devices with really large batteries and very long battery life. It'd be pretty amazing if iOS were beating them in the real world.

There's no magic in iPhone's batteries, they are basically identical to all others.

The secret sauce ingredient is the idle battery life. The Android devices I used -- all 13 of them, without exception -- routinely lost anywhere from 15% to 40% battery when I was out and about without me picking them up even once. We're talking anywhere from 2 to 5 hours with them being in my pocket or a backpack, in the middle of a big city, with excellent 4G coverage, so it should not be a constant radio antenna activity (although if their antennas were of lower quality that might just be it).

I installed all sorts of root apps to try and pinpoint the culprit and inevitably hit a brick wall when all the apps can do is point at a system service without any way to drill down further.

In contrast, the iPhones that I've used -- 6S Plus, 8 Plus and 12 Pro Max -- are all extremely frugal on using battery when the device is idle. I've grown used to picking the phone from my bed at 100% battery in the morning on days where I had to do a lot of stuff outside, be out and about for 4-5 hours and only pick up the phone once or twice, and then get back home and find the phone at 98% battery.

As someone with an iPhone 12 Pro and a Galaxy S21 Ultra, swapping my SIM between each every ~two months; this situation has absolutely changed sometime in the past couple years.

Android's idle power draw, at least on the S21 Ultra, is fantastic. I'll sometimes leave this phone on, with no SIM in it but connected to WiFi, sitting on my desk, using it every once in a while for Tik Tok or whatever, and it'll last a week or more. The iPhone is pretty similar.

But display-on time, apples to apples; the iPhone has fallen behind. With the 12 Pro, most days I'll end at 5-10%. At least once every couple weeks, the day will end with the iPhone having already shut down. In comparison, on the S21 Ultra: I give it ~20-40 minutes of charge every day while I'm working, just unplug my USB-C laptop and plug it into the phone, and that's it. I don't charge it at night. Its battery life is ungodly; by the time I go to bed, its at 50-60%. Wake up, plug it in while I'm showering and making coffee, good to go.

> I've grown used to picking the phone from my bed at 100% battery in the morning on days where I had to do a lot of stuff outside, be out and about for 4-5 hours and only pick up the phone once or twice, and then get back home and find the phone at 98% battery.

Is this true when the device is a year or two old? I've always found iPhone battery life impressive... but only until its about a year old or so. My iPhone 11 plus now requires nightly charging, or I will inevitably hit a Low Battery situation

> The secret sauce ingredient is the idle battery life. The Android devices I used -- all 13 of them, without exception -- routinely lost anywhere from 15% to 40% battery when I was out and about without me picking them up even once.

I think Android and newer chips have mostly fixed this. The Pixel 5 on my desk right now has gone from 100% to 81% in the last 7.5 hours with 1.25 hours of screen on time during that period. Last week, I had a session of 18 hours with screen on of 4.5 hours that went from 100% to 34%. IMO, idle draw is likely still a little higher, but then again I run a lot of little background apps (eg, tasker, the pebble app, wear os connectivity and others).

Most of my previous Android devices wouldn't have fared nearly so well, even back when I cared enough to spend time trying to find wakelock culprits. Thankfully, I haven't needed to do that in years either. :)

Yeah this. I’ll leave my iPad on my bed for 10+ hours and when I come back it’s lost maybe a percent or two of battery life. With my Android tablet I had it had to be on the charger constantly. My phones battery lasts about a day with all my apps on it, where my old android I had to charge mid day.

> The Android devices I used -- all 13 of them, without exception -- routinely lost anywhere from 15% to 40% battery when I was out and about without me picking them up even once.

That hasn't been my experience.

My current (very crappy) Mi A1 still lasts 3-4 days with moderate use.

> In contrast, the iPhones that I've used -- 6S Plus, 8 Plus and 12 Pro Max -- are all extremely frugal on using battery when the device is idle.

As a iPhone user (that uses an android device for work) myself, I can't confirm this at all.

I'm sorry, this is ridiculous. I don't even lose 15% of my battery life in 2 hours on my galaxy S3 without using it, and it is nearly a decade old at this point.

I've got an older Moto X4 and it consumes 2% per hour when in my backpack. I guess the only remarkable thing about the configuration is no social media apps.

    Pretty sure they can infer your normal sleep schedule and, after your phone has fully charged (1h to 3h after you fall asleep) they can freely use it as a P2P computing device.

They already do, the feature is called “Optimized Batter Charging”. It charges the battery to 80% and only does the full charge a bit before you usually start using the phone. You’ll find the setting in the battery health section.

Optimized Battery Charging isn’t the same as being a node in a bot net.

> they can freely use it as a P2P computing device

Do you have any evidence of this, or are you just making up something that sounds good to you?

More likely it's doing the background on-device work that Apple has actively advertised for a long time, like analyzing photos to attach metadata to them. (There's a lot more to this than is obvious at first glance - I can text "penguin" or "sunset" in my Photos.app library and get a set of matching pictures back, for example.)

You reckon I would know of a way to gather an exact evidence unless I work for Apple? (In which case I'll likely be convicted and thrown in jail as well.)

Obviously I can't know for a fact. I also thought they likely analyze photos and that's my chief suspect even now. But critical thinking demands to keep an open mind -- and that's how I suspect they might use fully-charged iDevices (that are expected to sit on the charger for several more hours) for unsolicited and non-advertised P2P computations.

I don't claim it, I merely suspect it.

> You reckon I would know of a way to gather an exact evidence unless I work for Apple?

Monitor your network traffic.

Lots of people do this already for various reasons and haven't noticed anything like this going on.

I have owned nearly every premium phone on the market and none of them come close to the Sony Xperia for battery life. I try new iPhones every other model or so...battery life has never been outstanding.

Do you disable Background App Refresh? First thing that I do on every iDevice. That feature being on is hugely overrated, you absolutely don't need it because you enter an app and manually refresh it; what's the big deal with that, are people that lazy?... Gods!

(The only useful application of that feature is email apps, I suppose; you do want to have your messages downloaded when you unlock your phone because Apple Mail takes ages to sync with Gmail... and it only gets worse with time.)

With that option set to "on" the idle battery life might quickly take a nose dive if you have stuff like Facebook / TikTok / Snapchat et. al. installed.

To make it even worse they extended the functionality to Mac OSX. WTF???

Do you have references for this? I must have missed this part.

https://www.apple.com/child-safety/, at the bottom lists macOS as target platform.

It's unclear exactly what this means to be honest. Which is not less scary but more.

This sentence:

> Next, iOS and iPadOS will use new applications of cryptography to help limit the spread of CSAM online

seems to suggest that the hash-matching happens only on iOS and iPadOS.

The rest of the text OTOH suggests many things happen across all types of devices and OSs.

Regardless, this seems very bad.

Won't implementing this on macOS make it too easy to reverse engineer? Think the hashes are supposed to be secret.

ETA: Apple quote: "unreadable set of hashes that is securely stored on users’ devices". Unreadable, unleakable, no doubt uninterpretable... unless someone reverses them to get a blurry 'visual proxy' collection.

How is this worse? Any Apple device you thought you owned and controlled was never under your control. You were wrong.

Perhaps your understanding of the situation has changed so that you better understand how bad it is. But the situation isn't worse.

That’s an interesting point. Do you know I’d this is the case? That is, by putting this in the phone then Apple’s liability is lessened.

Apple's just really weird when it comes to the control they exert over devices.

they do it with 'privacy' in mind and what they come up with is usually better than the worst case but it can still be pretty iffy

eg. a few months back when their notarization/entitlement verification system was being discussed

it's all just their vision of computing (which has some merits), hyper-controlled, locked down and "safe" it's not going to change if you're not comfortable with it you really shouldn't be using their products

Hate Apple's philosophy personally but I recommend my mom a Mac every single time.

Not everyone needs freedom, she's not downloading fitgirl repacks.

This is a weird mindset. Either you care about privacy or you don’t: what a person does on their device shouldn’t matter. If you only care about privacy when doing illegal things you don’t actually care about privacy you’re just a criminal not wanting to be caught.

>This invasive capability on the device level...

As the article points out, the capability to scan things on devices is already deployed on huge swathes of devices in the from of virus scanners and content search indexing. All the photos on iPhones and many Android devices get scanned for text recognition now anyway. I'm sorry, but 'OMG scanning things" is a genie that got out of the bottle decades ago. So no, scanning content is not a dangerous new capability, it's an extensions of existing capabilities to a new use case.

Now arguably this is a further slip down that slope of on-device scanning, but it is not some new watershed moment where scanning is happening for the first time. Also we can see that the trend is not to repurpose existing scanning systems for new purposes. Virus scanning, search indexing, text recognition and now this are all separate mechanisms implemented and operating independently in task specific ways. The prediction that these mechanisms will be subverted for other purposes has not panned out.

The real issue is what is being scanned and why, and the implementation of this system. That's the topic we need to focus on.

> As the article points out, the capability to scan things on devices is already deployed on huge swathes of devices in the from of virus scanners and content search indexing.

that's a ridiculous counterpoint. 1) no iphone has AV 2) AV and content indexing don't secretly contact the feds.

adding a new "background service that sometimes contacts the US government" is a big privacy regression.

>cloud services, meanwhile, are the property of their owners as well, with all of the expectations of societal responsibility and law-abiding which that entails.

This is already a shifted/normalized perspective.

If I rent an apartment or a house, it comes with an expectation of privacy. I don't know where to draw the line exactly, but a dumb storage-only cloud service should carry the same expectations. Things get more complex if a service is actually doing something with the data.

But the broader point is that with cloud services, we've already given up some established legal expectations of privacy without much awareness or realization, let alone resistance.

> It’s truly disappointing that Apple got so hung up on its particular vision of privacy that it ended up betraying the fulcrum of user control: being able to trust that your device is truly yours.

Disappointing, sure, but not surprising.

Since the introduction of the iPhone, Apple has made it clear that one of their core beliefs is that they alone know better than their users. They have repeatedly demonstrated that they are happy to remove user control wherever possible. Their decision here fits that pattern perfectly.

The one thing that occurred to me is that this is almost seems like this is a cya, Section 230 protection in disguise. There has been more discussions about Big Tech and 230, and this is one way to say "Look, we are compliant on our platform. Don't remove our protections or break us up, we are your friend!" It also shouldn't be too surprising given how Apple has behaved in China. They will only push back against the government up until the point it starts to affect profits.

I'm also curious and I don't mean this in a judging way, but are all the people who are planning to sell their iDevices also going to divest all their retirement holdings from Apple? Stock price is the thing that actually applies pressure. Everyone's comp is based on it. What would happen if enough people divested from these rent-seeking companies? We can't expect the government (though they should) or companies to behave in a way that is pro-consumer, but if we can align incentives we have a chance.

> Yes, you can turn off iCloud Photos to disable Apple’s scanning

To me, it is such a weird implementation. The feature is about scanning on-device data, not data in iCloud, but for some reason disabling iCloud is the way to opt out? Did I miss any technical details?

Apple is always pretty OK with handing over iCloud data to authorities. Not only that they have already stored Chinese users iCloud data in state controlled entity, this was their whole argument regarding the San Bernardino case -- on-device data is user's sacred privacy, but if the shooter's phone uploaded data to iCloud, they were willing to send a copy to FBI in a heartbeat.

This makes me wonder, is iCloud the underlying technical boundary for privacy?

The feature is because it’s illegal for Apple to host/have/posses CSAM (in iCloud).

But Apple doesn’t want to know what they host for you on iCloud.

So they need to be sure that before something is uploaded to iCloud, it’s not CSAM.

So if you don’t intend to upload to iCloud (i.e. you disable iCloud on your phone), then Apple doesn’t care anymore if you have CSAM or not.

Apple's approach opens the door to get full end-to-end encryption for other assets that are currently stored on iCloud, that currently are not.

It is not a guarantee, but it leaves that door open, which currently would face very strong headwinds to get rolled out.

That's mentioned in TFA, Apple relented to the FBI's request that iCloud backups would not encrypted. I can't see that changing since scanning for CP won't help the FBI in the vast majority of their investigations (terrorism, drug trafficking, fraud).

> now exists

Is this true? I've always assumed apple can always do that (if they somehow needed to).

They always had the potential, but now the code is there and running.

It’s like your spouse’s communication has broken down, they’re doing things that don’t make sense, and they just randomly went out and bought a gun without telling you.

Sure, they haven’t killed you in your sleep yet… but they sure are acting weird and recently acquired the means to do so

> being able to trust that your device is truly yours

Yeah, this is essentially impossible today. Even personal computers have processors with potentially malicious firmware. In order to get a trustworthy processor to run free software on, we need to limit ourselves to hardware from decades ago.

It's gotten to the point I don't we can trust any computer we haven't fabricated ourselves. Anyone can download a compiler and make their own software but hardware requires billions of dollars worth of equipment and personnel. Software freedom is doomed unless we somehow develop a way to fabricate chips at home.

It's an unfortunate choice because my understanding is that it's possible to match encrypted files on the cloud with CSAM, assuming that Apple has the public key, and this has done before in a court case as evidence leading to a conviction. Maybe it's computationally prohibitive?

The files that iCloud Photos stores are encrypted to your account and Apple can't access them. Apple scans the images on your phone so that this can continue to be the case, but they're doing a perceptual match - i.e. determining if this image looks like a modified version of the original image (e.g. if it's just been resized or re-encoded or something).

This way Apple can scan for CSAM without having to actually violate privacy by scanning a user's images themselves.

> The files that iCloud Photos stores are encrypted to your account and Apple can't access them.

This is false[1]. Apple can decrypt them, and they can decrypt them and send them to law enforcement should they get subpoenas. They're encrypted at rest with keys that Apple has.

[1] https://www.bbc.com/news/technology-51207744

This article is about iCloud backups. It doesn't say either way whether or not iCloud Photos are encrypted.

Apple’s website clearly states what components are e2e encrypted. iCloud photos is not one of them:

https://support.apple.com/en-us/HT202303

I recall a court case where a police officer was convicted of possessing CSAM on his computer. The files were encrypted so the prosecution was not able to view them, but they were able to demonstrate that the encrypted files contained known images, I believe by encrypting a known image with the same public key and demonstrating that the result was binary identical. Obviously this wouldn't work except for unmodified files including cropping, scaling and editing metadata.

Interesting. Can you link to the case?

> This invasive capability on the device level is a massive intrusion on everyone's privacy

I am a user uploading a photo to the cloud.

Google's servers scan photos after they are uploaded to the cloud, and have done so for the past decade.

>a man [was] arrested on child pornography charges, after Google tipped off authorities about illegal images found in the Houston suspect's Gmail account

https://techcrunch.com/2014/08/06/why-the-gmail-scan-that-le...

Apple wants the device to scan the photo before it is uploaded to the cloud.

Both are equally invasive and both can only be avoided by refusing to use the cloud.

But only Apple can, at least for now, scan content or your phone. Google cannot. Yet. Small, bit crucial difference.

Frankly, it's more of a problem for my data to be flagged after Google has it than it would be for it to never leave my device at all.

People have certainly run afoul of the law when the data Google has about them is misused.

>Innocent man, 23, sues Arizona police for $1.5million after being arrested for murder and jailed for six days when Google's GPS tracker wrongly placed him at the scene of the 2018 crime

https://www.dailymail.co.uk/news/article-7897319/Police-arre...

We are only talking about what happens when you try to send the data to the cloud, after all. Not about all the data on the device.

You are so close to understand the issue. When Google, or anyone else, is flagging it and sharing the result with, e.g., law enforcement you can have a problem. Apple will no just simply refuse to upload stuff that would be flagged in the cloud, it is flagging it already before upload on your device. And share the results with authorities. That for now they claim to only do so with stuff about to be uploaded is of minor concern, the tech is there to scan all the pictures on an iPhone now. No reason to believe it will stop with intended uploads, or pictures.

> Apple will no just simply refuse to upload stuff that would be flagged in the cloud, it is flagging it already before upload on your device. And share the results with authorities.

None of this is true. A sibling comment describes the process:

>1. Only if you're uploading files are the files matched. 2. Only if the matches are very close are they considered matches. 3. Only if you have multiple very close matches is Apple able to decrypt the low-res versions of the images themselves. 4. Only if a human reviewer discovers any of the decrypted low-res images to be illegal content is any of your information shared with anyone else.

https://news.ycombinator.com/item?id=28120598

Really? Apple and Google have been able to scan content on your phone as long as they have sold phones. They control the OS, therefore they have access to the content. The ability has always been there. The only difference is that Apple has now openly announced what they are going to do and how. If governments wanted to pressure Apple (or Google) to scan content they could have done that anytime in the last few years. If Apple and Google resisted that before, why is now different?

From a legal perspective, there is a significant chasm between "you are hereby ordered to develop a whole new surveillance feature for devices you build" and "you are hereby ordered to add these new (potentially unrelated to CSAM) signatures to your existing surveillance network".

Under what legal basis are certain corporations immune to government demands while others are not?

Google does reporting on how many National Security Letters requesting information about it's users that it responds to annually.

Why doesn't it just ignore them?

> Google does reporting on how many National Security Letters requesting information about it's users that it responds to annually.

So does Apple[1]. Apple gave data on over 31,000 users/accounts based on National Security Letters in the first half of 2020 alone[1].

> Why doesn't it just ignore them?

In the first half of 2020, Apple provided data to the US government (non-FISA or NSL) about 9,000 times, and responded to requests for data with the data about ~85% of the time, and 92% in cases of "emergencies"[1].

[1] https://www.apple.com/legal/transparency/us.html

I don't understand your question. Google, Apple, Facebook et al comply with their legal obligations.

Apple does not have a legal obligation to install spyware on your phone (at least not in the US, not yet).

I think so too but from a different angle. It sounds like the federal government is strong arming Apple to spy on their users. Apple would rather use on-device hashing to preserve some amount of privacy rather than give unfettered access to the feds to their cloud.

On the other hand, Google can run arbitrary queries over your data (published to their cloud) while Apple uses the same algorithm and hash database for everyone (which probably will get reverse engineered and audited by next BlackHat).

What makes you think that Apple will use the same database for everyone?

You can't realistically reverse engineer a hash to source image.

1. Previous submission (http://www.hackerfactor.com/blog/) claims that PhotoDNA is reversible to 26x26 grayscale

2. What’s more important is you can reverse engineer algorithm that’s used locally to compare these hashes. Unlike with cloud-based searches other providers run, this puts significant limitations to what Apple or LEA can do on your phone. E.g. they can’t extract strings from PDF or grep through image metadata or request all images of certain users without knowing what these images would depict in advance. The frequency of hash database updates even if opaque will still provide more insight into what is being searched for compared to current status quo where public has zero insights because all search / aggregation queries are run on the server.

My understanding is they only scan for content if it's being uploaded to iCloud. Scanning on the phone, yes, but only if the image is to be sent over the network.

And they seem to be doing that because they both 1) want to enable e2e encryption for iCloud images, soonish, and 2) don't want to become the world's most popular child porn storage and sharing platform.

I get the arguments for why the fix for #2 is too dangerous to be worth it, but also get why they'd be inclined to choose it.

Apple can already find photos of my cat, of ice cream, and of the sky directly on my phone using AI

A webpage does authentication by downloading a list of usernames and passwords and comparing your inputs in JavaScript in your browser. Another sends a hash out to an endpoint in the cloud.

To the user - using your line of reasoning - they're both the same, right?

This isn't supposed to be a technical comparison, I just want to point out that the implementation matters as much (or more) than the customers' experience.

I don't use the cloud. I don't even sign in an email address on my android phone. That makes all the difference to me.

>Both are equally invasive and both can only be avoided by refusing to use the cloud.

Technically Apple can do a scan regardless of wether or not you posted it to iCloud if they so desired to, or were ordered to.

Technically, Google can sell the entire trove of data they have collected about you to anyone willing to write them a check.

Do you think it's likely they will do so?

The difference is you don't put your data in Google's cloud, they can't sell it. With this Apple change on your local device, you don't have any recourse other than get a different phone.

Also, Google sells your data already don't they? Probably not a great counterpoint.

https://www.tampabay.com/news/2021/05/07/google-selling-user...

Again, the only thing different here is that when you upload a photo to the cloud, Apple scans it on device before the file is uploaded, while Google scans it on their server after it is uploaded.

Nothing is happening to files you don't attempt to upload to the cloud.

Also, if Google is selling everyone's data to third party data brokers, it's news to me.

>Nothing is happening to files you don't attempt to upload to the cloud.

I am aware, but because the scanner now exists on the device, they have the capability of scanning images on your device regardless of whether or not you upload it to the cloud if they so choose to OR ARE ORDERED TO. Do you not see the difference in capability?

“Google has the capability to upload images from your device and could choose to upload every image IF ORDERED TO.”

By that logic, Google is every bit as vulnerable to being ordered to scan all files on Android devices.

There are many photos one could take without uploading or saving them in the cloud. The question is can I safely store things locally on my device without a multi-national corporation being able to set the policy of what's allowed there. The article cites examples of banned memes/images by the Chinese government.

There is also the risk of algorithm mistakes. Without the trust + safety team or any cloud verification, does this just get immediately forward to the FBI?

What is the process to be made non-guilty if the Apple algorithm thinks you have something illegal and you don't if there is no human in the loop involved before it's forwarded to authorities?

At least if you upload to a service someone on the trust + safety team can verify the algo worked properly. I would be very nervous building this kind of system of the risk of false positives! Maybe even so nervous to introduce many more false negatives - which is in itself terrible in the case of something like CSAM.

Here's how it works, in short:

1. Images which are going to be uploaded to iCloud are matched against known hashes. A match has to be very close in order to actually be flagged as a match. The results are uploaded to iCloud Photos along with your image. 2. If your account hits a sufficient threshold of matches (i.e. you have to have multiple/many images matched) then Apple is alerted and they are able to decrypt low-resolution versions of the relevant stored images. 3. Apple's team performs a manual review of the images to ensure that they are in fact inappropriate images and not false positives. 4. If any of the matched images are actually illegal, then Apple reports you to the authorities.

In other words, there are several safeguards in this process:

1. Only if you're uploading files are the files matched. 2. Only if the matches are very close are they considered matches. 3. Only if you have multiple very close matches is Apple able to decrypt the low-res versions of the images themselves. 4. Only if a human reviewer discovers any of the decrypted low-res images to be illegal content is any of your information shared with anyone else.

In my opinion, this is a vastly better system than literally any other cloud provider at the moment; it allows Apple to find and report even more CSAM with effectively no risk of reporting false-positives to law enforcement, while also preserving your privacy through encryption in transit and at rest.

> The question is can I safely store things locally on my device without a multi-national corporation being able to set the policy of what's allowed there.

Didn't Microsoft just start removing people's torrent clients from their computer without permission and announce that you wouldn't be allowed to use your own PC running Windows 11 Home without using an online Microsoft account to log in?

I think a lot of people are either stuck with images of Apple under Steve Jobs or Apple under Tim Cook's marketing.

It is at still nice to see people are finally asking these sort of questions.

The thing no one seems to be discussing here as this topic arises again and again is that the problem being addressed is Apple's problem, not the problem of anyone who purchases an Apple computer. Apple's "solution" is to create a new problem for all Apple purchasers.

The majority of Apple hardware purchasers are probably not engaged in illegal activity. Yet all Apple purchasers are being forced to pay the price for Apple's mistake. Apple's hands are not clean.

No Apple purchaser ever intentionally requested that Apple copy their files to servers in Apple datacenters, or that Apple perform encryption intsead of the user, store and forward the user's personal messages through servers in Apple datacenters. Those were business decisions that Apple made to benefit Apple.

Technology allows, all computer users are quite capable of storing their files on their own portable media, and many are capable of encrypting and then sending messages directly to others, peer-to-peer, without leaving a copy with a third party. Technology allows, Apple has choices. No purchaser ever demanded that device storage capacity be reduced or ports for removable media be removed. Nor did any purchaser ever demand that her message be stored with Apple. Those are choices made by Apple, not users. Users should have choices too. Instead they are corralled into a user-hostile vision of personal computing that props up the world's wealthiest companies who horde money offshore while their domicile country falls into chaotic decline.

As the parent comment states, "One's device ought to be one's property..." Apple has actively and aggressively sought to overcome this basic tenet of common sense. As people online argue about "misinformation" please stop and consider the "lies" that Apple and the companies they compete with are telling the public about what exactly it is they do. Apple has taken Jobs' idea of the "Reality Distortion Field" too far.

Computer users need quality hardware. Apple can design and assemble it and be the best at what they do. Users do not need to be manipulated by a hardware vendor after purchase. Where did that idea come from. The sad fact is the "new" Apple is not competing with other hardware vendors. No other vendor even comes close. Apple has set its sights on competing with "tech" (middleman) companies that do nefarious things and cover up the truth. Apple wants user data after purchase. Why. To compete with "tech" (middleman) companies. Bad decision. Users pay the price.

The easiest way Apple could have fixed this problem with storing illegal files would be to stop storing user files and messages! Be a hardware company. Let purchasers use portable storage or arrange their own "cloud storage" with a more "competent" provider (let another company deal with the inherent flaws of the "cloud" concept^1). Let users discover how to encrypt their own data and use peer-to-peer transmission. Let them use the Apple computer to write programs without needing "permission" from Apple. Apple has only tried to hide these basic capabilities and competencies from the majority of new computer users, strengthening the "Reality Distortion Field".

A long line of bad decisions from a hardware company we once admired. They just keep getting worse. And all for what. Greed. Immense untaxed cash reserves held offshore. Why not be a hardware company and stop trying to compete with "tech" (middleman) company surveillance. Why keep dumbing down and locking down what a former CEO once called a "bicycle for the mind".

1. "Cloud" is a synonym for "someone else's computer." "Cloud storage" is another way of saying "storing files on someone else's computer". Perhaps "Apple" is also a synonym for "someone elses's computer". If Aple can exercise control over a computer after they sell it, how it is not still theirs. Purchasers are just "users", not owners.

Here's an idea, make devices which make it easy for people encrypt their own stuff

Funny you mention that I had the same idea; why is there never any discussion of this problem

Let's say the user wants to encrypt a file on her "smartphone" (portable computer bundled with a cellular phone)

Using her own choice of open source encryption program and her own key(s)

Are there even any "apps" that do this; theres an app for that; not this time

AFAICT its easier to encrypt the file using a different computer running an UNIX-like OS then transfer the file (back) to the phone

From there it might be copied to someone else's computer, i.e., a "tech" (middleman) company's data center; this could happen, e.g., when sending "private messages" or when "syncing" with "cloud storage"

When the user encrypts herself with no tech (middleman) company assistance, only the user has the keys and only the user can decrypt

"But users will lose their keys!" - Big Tech industry enthusiast

Tech companies never, ever lose keys, right

I wouldn’t kind making one but I know that I’ll probably get in trouble by law enforcement agencies immediately.

Google could’ve announced the same solution for Google Photos as a 3rd party app. I don’t understand what privileged position Apple as OS maker has used to build this solution. It’s a feature of their Photos application when used with their cloud photo service.

It's more accurate to think of it as a feature of the iCloud Photos client software (which is built into the OS). If you don't use iCloud Photos, you don't use the client software, so nothing changes.

To be installed by default and not removable on one of the most used devices in the world.

It’s a pretty weak argument to say that a clearly communicated change in behavior of a single application compromises trust in the entire operating system. You’d basically need to argue that Apple should not be allowed to install any default applications or services.

The Photos application can’t be removed, but this behavior can be turned off.

It does because they control the entire os, ecosystem, now and in the future, and have demonstrated with PRISM and this they don't play for our team.

> they don't play for our team

I'm no apple apologist but apple must follow the laws of the countries they operate in. They can't advocate for us because we are not the ones setting the rules.

Sure. If the law tell them to locate all gays so that they can be jailed in the emirates, would you agree with that ?

I could do worse, but Godwin called.

Of course not. I even said "i am not an apple apologist" so these lame "gotcha" questions are kinda silly

You can remove the Photos app and disable iCloud Photos.

At no point are you forced to use either.

Are you suggesting that people who want to opt out of this should stop taking photos on their iPhones?

The way to opt out of CSAM scanning on an iPhone is identical to opting out of it on Android: disable the platform's cloud service to synchronise your photo galleries.

You can take photos on your phone without using the Photos app.

You can use Photos without using iCloud.

And you can use iCloud without using iCloud Photo Library.

This is an interesting comment. If you had an Apple device it was never truly yours to begin with.

If you own a device with builtin software that synchronizes part of the data on it to the cloud then it was never truly yours to begin with**

Fixed it for you. I hope you are not implying that Google, whose bread and butter has been selling personal information, has resisted the temptation for all these years?

I use Apple and it's an informed choice. I am pretty realistic about their practices. And realistically we don't have a choice. Either you use a smartphone and it's a Swiss cheese of security vulnerabilities -- worst of which are embedded in the device on purpose! -- or you don't use a smartphone at all. This is the era we're living in.

I hope that custom ROM Android communities can win and give us back some freedom but I am skeptical. Still, I am open to try some of the de-bloated Xiaomi ROMs at one point. Or maybe put LineageOS / PostmarketOS on them.

I didn’t mention Google at all, not sure why you brought it up

Because I dislike the implication that only Apple is doing it. No. Everybody is doing it. Apple was just the first to publicly admit it. Doesn't make it better, sure, but let's not delude ourselves at least. No company can resist using all that valuable personal data on the smartphones.

I didn’t imply only Apple is doing it either

Let's not argue over this all day. :)

The fact that you only mentioned Apple makes it a safe assumption that you only meant Apple. I chimed in to specify that I believe everyone is doing it, and let's stop at that. There's no prize to fight over here.

It’s an article about Apple so I only mentioned Apple lol. While we’re at it we should mention Microsoft probably does this too. Probably Snap as well.

> there will be no limits for governments to expand it's reach once implemented. The scope will always broaden

Speculating it is slippery slope arg. https://wikipedia.org/wiki/Slippery_slope

As the article says:

"The strength of such an argument depends on whether the small step really is likely to lead to the effect."

> It is true that a computer, for example, can be used for good or evil. It is true that a helicopter can be used as a gunship and it can also be used to rescue people from a mountain pass. And if the question arises of how a specific device is going to be used, in what I call an abstract ideal society, then one might very well say one cannot know. But we live in a concrete society, [and] with concrete social and historical circumstances and political realities in this society, it is perfectly obvious that when something like a computer is invented, then it is going to be adopted will be for military purposes. It follows from the concrete realities in which we live, it does not follow from pure logic. But we're not living in an abstract society, we're living in the society in which we in fact live. If you look at the enormous fruits of human genius that mankind has developed in the last 50 years, atomic energy and rocketry and flying to the moon and coherent light, and it goes on and on and on -- and then it turns out that every one of these triumphs is used primarily in military terms. So it is not reasonable for a scientist or technologist to insist that he or she does not know -- or cannot know -- how it is going to be used.

-- Joseph Weizenbaum, http://tech.mit.edu/V105/N16/weisen.16n.html

To pretend it's inherently unknowable right up to the point until it's "too late" is kinda getting old.

From Wikipedia[1]:

> Argument from fallacy is the formal fallacy of analyzing an argument and inferring that, since it contains a fallacy, its conclusion must be false.

[1] https://en.wikipedia.org/wiki/Argument_from_fallacy

I've made no prediction as to if it will happens (contrary to the parent comment). I think I got downvoted because people interpreted this as a support of theses changes (it's not).

It's a very real slippery slope, however.

What if the Chinese government could search every device for images of yellow umbrellas, as part of the HK revolution?

I’ve been thinking carefully about this situation.

I just don’t see the intrusion.

Firstly, you are syncing your photos to iCloud. It’s equivalent to developing your photos at an old timey film shop.

iCloud happens to have lots of security guarantees, much like the film shop.

But the moment you develop CP, all bets are off. I think most of us lead pampered, selfish lives. Perhaps this is a “think of the children” cry, and perhaps this has been used for many evils over time.

If Apple were to get their lists of hashes from China (a situation they’ve opened themselves up to in the future), then sure, that’s awful. Or if they were doing these checks and alerting law enforcement without iCloud sync, then that’s awful too.

But this doesn’t seem to be a slippery slope, yet. They are targeting a specific case: you uploading your photos, and your photos being of known child sexual abuse.

Yes, there are false positive photos in the database. Maybe there’s even a flower in there. But if you got flagged as a false positive, the moment law enforcement looks at your photos (which, remember, you’ve surrendered to iCloud), you sexually abusing a flower won’t cause any problems.

Or will it? Please, my mind is open. I’d love to change it.

>But this doesn’t seem to be a slippery slope, either. Any photos you’re worried about can trivially circumvent the hashing system: adjust their brightness. Boom, done.

I've been briefed about it. Apple says explicitly that this is not the case. They mention that cropping, transforming, or even desaturating an image won't result in a hash that's so different from the matching one. The similarity will be high enough to detect the photo anyway. They don't seem eager to explain in detail how that actually works, though.

The reason they don't explain how it works is that the CSAM hash matching is an algorithm from NCMEC, which was apparently originally designed by Microsoft.

If you want to learn about the algorithm/hashes, you have to, among other things, sign an NDA about it, so it's likely that Apple, legally, cannot go into detail about how it actually works.

Microsoft has a page on it here if you're interested: https://www.microsoft.com/en-us/photodna

For obvious reasons, they don't go into a whole lot of detail.

I've learned a lot about how the process works from this blog post: https://hackerfactor.com/blog/index.php?/archives/929-One-Ba...

He gets a few facts about Apple's approach wrong, but it's an incredibly interesting read.

Apple designed a new system, which is different than PhotoDNA - they call it neural hash, and the specifics are not disclosed.

crosschecking hashes is only possible if they use the „same“ implemantation for the hashes. it would be safe to assume that the implementation/algorythm is the same regardless of being called photodna/neuralhash.

Sorry, I edited that part out one minute after commenting. I realized it was a weakness in the argument.

Thank you for pointing that out though. I had no idea.

This is about Apple scanning the pictures on your phone, not the pictures that have been synced to iCloud.

A good point to keep in mind, there is no "scanning". There is a hashing, then a check of the hashes - not the pictures - and if a hash matches the on-device NCMEC hashes list a "security voucher" is generated. Said voucher will be uploaded to iCloud photos along with the picture it refers to, without anyone in the chain being able to know that it happened.

Do they do device local scanning for this purpose? Apple’s original announcement said that it was to give law enforcement answers about photos synced to iCloud.

If so, then I’ll immediately change my mind and join the protest. Device local scanning is equivalent to someone checking your personal possessions at your home.

Yes, you can find more information here: https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...

From the overview:

> Apple’s method of detecting known CSAM is designed with user privacy in mind. Instead of scanning images in the cloud, the system performs on-device matching using a database of known CSAM image hashes provided by NCMEC and other child-safety organizations. Apple further transforms this database into an unreadable set of hashes, which is securely stored on users’ devices.

Yes, but my understanding was that they do this for iCloud-synced photos.

If iCloud is off, do they still do this? Your quote actually doesn’t contradict that, which is my main hangup. If you turn on iCloud, you forfeit certain expectations.

I’ll read through it carefully now.

EDIT: It was the very first sentence of the intro:

> CSAM Detection enables Apple to accurately identify and report iCloud users who store known Child Sexual Abuse Material (CSAM) in their iCloud Photos accounts.

I don’t get it. It’s their platform. Other image platforms do this matching. Old film shops used to do this matching. Why is this evil?

The sticking point is that the matching happens on-device, not on their servers. Sure, it only happens for photos that will be synced, but it’s still your device doing the matching and snitching.

There’s also the fact that the “only scans local photos marked for upload to iCloud” is a technically thin barrier. A switch that could very easily and quietly be flipped in the future.

If you scan in the cloud, photos not synced to the cloud are 100% not going to be scanned - they are JUST NOT THERE. If you can on device, you are one "if(" condition away from "Accidentally "scanning other photos. See the issue now?

Do you have any general objection to client software scanning content it uploads before it uploads it, rather than afterwards? Scanning it on your phone means that unencrypted versions of your data don't have to leave your phone, which IMHO gives more privacy than any other option.

Do you have an objection even though it means that the content (in a form readable by anyone else) never leaves your device? Would it be preferable if Apple scanned files that were synced to iCloud, but no longer encrypted them in transit/at rest, or encrypted them in a way that they are able to decrypt?

they already scan all the images on your phone. that's how i can search for "dog" or "flowers" and find results in my photo library.

Local scanning/indexing is fine. It’s reporting the results of the scan to Apple that people have a problem with.

I'm not sure that's true. A lot of people seem to have less of a problem with Apple scanning for CSAM and more of a problem that they're doing it on the phone (and looking for specific images, I guess?).

It’s the fact that the phone is scanning your images and relaying the results to Apple that’s the issue. If this feature were just an extension of existing on-device scanning and stayed on the device, perhaps informing the owner “Hey, it appears a few of your images may be CSAM. Would you like to review them?” then I don’t think people would be very upset.

Apple used to be able to say 'we don't have that capability' if, for example, a Turkish judge ordered them to scan phones for a certain picture of Erdogan. What are they going to say now?

Reply on news.ycombinator.com