Hacker News Reader

Comment by gonehome | Hacker News Reader

The end isn't really compromised with their described implementation.

The only thing sent is the hash and signature and that's only if there are enough matches to pass some threshold.

I don't really view that as 'permanently compromised' - at least not in any way more serious that Apple's current capabilities to compromise a device.

I think e2ee still has meaning here - it'd prevent Apple from being able to see your photo content on their servers.

This is a nuanced issue, I don't think there's an obviously better answer and both outcomes have different risks. [0]

[0]: https://www.lesswrong.com/posts/PeSzc9JTBxhaYRp9b/policy-deb...

View on HN

Yeah, and as argued in one of the blog posts - that's just a policy decision - not a capability decision - malleable to authoritarian countries' requests.

Yes - and I agree that that's where the risk lies.

Though I'd argue the risk has kind of always lied there given companies can ship updates to phones. You could maybe argue it'd be harder to legally compel them to do so, but I'm not sure there's much to that.

The modern 'megacorp' centralized software and distribution we have is dependent on policy for the most part.

That's the problem I had with Ben's post - it's always been policy since Apple controls and distributes iOS.

Yeah - the sense I got was he just liked the cleaner cut policy of a hard stop at the phone itself (and he was cool with the tradeoff of unencrypted content on the server).

It does have some advantages - it's easier to argue (see: the disaster that is most of the commentary on this issue).

It also could in theory be easier to argue in court. In the San Bernardino case - it's easier for Apple to decline to assist if assisting requires them to build functionality rather than just grant access.

If the hash detection functionality already exists and a government demands Apple use it for something other than CSAM it may be harder for them to refuse since they can no longer make the argument that they can't currently do it (and can't be compelled to build it).

That said - I think this is mostly just policy all the way down.

I have no idea if this feature existing makes it harder or easier for Apple to refuse. Based on how the feature works, it would still require a special build of iOS just like what the FBI wanted in order to remove the unlock count years ago.

Given the amount of nuance here, I also think it's important to differentiate between the FBI showing up and asking for something and government passing laws forcing encryption backdoors. The former is what Apple has fought to date b/c they can. The later is much harder to fight and Apple will most likely have to comply regardless of what features already exist or not (see China/iCloud). The later is also the most dangerous since politicians rarely understand technology enough to do something sensible. It remains to be seen, but Apple could be trying to get in front of long term law changes with an alternate solution.

Yup, we can agree on that.

> The only thing sent is the hash and signature and that's if there are enough matches to pass some threshold.

Not true. If there are enough matches, someone at Apple will have a look at your pictures. Even if they are innocent.

I think the one thumbnail of the matching hash? Just to make sure there isn't a (they argue one in a trillion, but I don't know if I buy that) false positive.

That's if there is enough matches to trigger the threshold in the first place, otherwise nothing is sent (even if there are matches below that threshold).

Alternatively this is running on all unencrypted photos you have in iCloud and all matches are known immediately. Is that preferable?

> I think the one thumbnail of the matching hash?

So it is sending pictures? That makes your argument quite a bit weaker.

> Is that preferable?

Nope, E2EE without compromises is preferable.

I think the thumbnail is only when the threshold is passed and there's a hash match. The reason for that is an extra check to make sure there is no false positive match based on hatch match (they claim one trillion to one, but even ignoring that probably pretty rare and strictly better than everything unencrypted on iCloud anyway).

> Nope, E2EE without compromises is preferable.

Well that's not an option on offer and even that has real tradeoffs - it would result in less CSAM getting detected. Maybe you think that's the acceptable tradeoff, but unless government legislatures also think so it doesn't really matter.

This isn't the clipper chip, this is more about enabling more security and more encryption by default but still handling CSAM.

The CSAM issue is a real problem: https://www.nytimes.com/interactive/2019/09/28/us/child-sex-...

>Well that's not an option on offer and even that has real tradeoffs - it would result in less CSAM getting detected. Maybe you think that's the acceptable tradeoff, but unless government legislatures also think so it doesn't really matter.

It should and can be an option. Who cares what they offer us. Do it yourself.

That's just a separate topic.

If you do it yourself none of this policy stuff matters.

> So it is sending pictures? That makes your argument quite a bit weaker.

Important to note this is only ran on images going to iCloud so they are already sent.

I really don't understand how you're arguing as if you don't see the bigger picture. Is this is a subtle troll?

They are now scanning on the device. Regardless of how limited it is in its current capabilities, those capabilities are only prevented from being expanded by Apple's current policies. The policies enacted by the next incoming exec who isn't beholden to the promises of the previous can easily erode whatever 'guarantees' we've been given when they're being pressured for KPIs or impact or government requests or promotion season or whatever. This has happened time and again. It's been documented.

I really am at a loss how you can even attempt to be fair to Apple. This is a black and white issue. They need to keep scanning for crimes off our devices.

So to your answer your question, yes it is preferable to have them be able to scan all of the unencrypted photos on iCloud. We can encrypt things beforehand if need be. It is lunacy to have crime detecting software on the device in any fashion because it opens up the possibility for them to do more. The people in positions to ask for these things always want more information, more control. Always.

The above reads like conspiracy theory but over the past couple of decades it has been proven correct. It's honestly infuriating to see people defend what's going on in any way shape or form.

Frankly the distinction seems arbitrary to me.

This is a policy issue in both cases - policy can change (for the worse) in both cases.

The comparison is about unencrypted photos in iCloud or this other method that reveals less user information by running some parts of it client side (only if iCloud photos are enabled) and could allow for e2e encryption on the server.

The argument of "but they could change it to be worse!" applies to any implementation and any policy. That's why the specifics matter imo. Apple controls the OS and distribution, governments control the legislation (which is hopefully correlated with the public interest). The existing 'megacorp' model doesn't have a non-policy defense to this kind of thing so it's always an argument about policy. In this specific implementation I think the policy is fine. That may not hold if they try to use it for something else (at which point it's worth fighting against whatever that bad policy is).

Apple's good solutions to the CSAM problem (which I think thread the needle for a decent compromise) could prevent worse policy from the government later (attempts to ban encryption or require key escrow like in the 90s).

Basically what I said here: https://news.ycombinator.com/item?id=28162418

This implementation as it stands reveals less information about end users and could allow them to enable e2ee for photos on their servers - that's a better outcome than the current state (imo).

They've given you two options:

1. Encrypt everything in the cloud but upload the hashes of these items as well on the device. Also notify us so we can notify law enforcement if they're doing some illegal stuff.

2. Everything is unencrypted in the cloud. No actions are taken on the device. No notifications to authorities.

With option one the sanctity of the device ownership is breached. With option two it's maintained. Maintaining that stark distinction is hugely important for what future actions can be taken in the public eye. Normalizing on device actions that work against the user must be fought at every instance they occur.

Your line of thinking dangerous because you're ignoring the public perception of a device you own actively working against you. Apple's behavior cannot be allowed to be considered normal.

For #2 actions are taken in the cloud, authorities are contacted, and all of the photos are unencrypted.

Option #1 doesn’t really breach the ‘sanctity of device ownership’ because it only occurs if you’ve enabled iCloud photos on the device.

Option #1 seems better to me in its current implementation. I understand the fear of abusing the hash matching. I just think that’s a separate thing.

>Option #1 doesn’t really breach the ‘sanctity of device ownership’ because it only occurs if you’ve enabled iCloud photos on the device.

I'm done. You'll rationalize anything.

To be fair - I think reasonable people can disagree on this.

I don't think it's a rationalization to point out that it only occurs when the same baseline conditions are met (using the cloud). I think those constraints/specifics matter. I wouldn't be in favor of the policy if they were different (and I'm not even sure I'm in favor of it now).

My personally preferred outcome would be e2ee by default for everything without any of this, but I also understand the concerns of NCMEC and the general tradeoffs/laws around this stuff (and future regulatory risk of CSAM) - and just the general issue of reducing child sexual abuse.

I largely agree with your point fossuser.

I am also in favour of E2E by default for everything without any device or cloud based scanning. However, Apple doesn't want to be caught in having developed a service that enables for child exploitation. Doing nothing may have even more invasive requirements legally forced by government, so Apple is stuck with a dilemma. Also lets not forget that Apple should also not want child exploitation to occur and therefore also should do something.

The question I have for drenvuk is how else is Apple able to prevent or detect child exploitation and the storage or distribution of content such as this on Apple's services?

They can rely on users reporting it. They are not obligated by law to do this.

For now, but if they don’t do something like this laws can change and that change could make things a lot worse for privacy than this implementation.

I suspect they’re trying to get ahead of that and solve this in the most privacy protecting way possible.

How is anyone OK with Apple employees viewing their private pictures because their algorithm fucked up?

> someone at Apple will have a look at your pictures

No, but at a "visual derivative"

A JPEG is a "visual derivative". It's also a "mathematical fingerprint" of an image.

> The end isn't really compromised with their described implementation.

They've turned your device into a dragnet for content the powers that be don't like. It could be anything. They're not telling you. And you're blindly trusting them to have your interests at heart, to never change their promise. You don't even know these people.

You seriously want to cuddle up with that?

> "They've turned your device into a dragnet for content the powers that be don't like. It could be anything. They're not telling you"

They're pretty explicitly telling us what it's for and what it's not for.

> "And you're blindly trusting them to have your interests at heart, to never change their promise. You don't even know these people."

You should probably get to work building your own phone, along with your own fab, telecoms, networks, - basically the entire stack. There's trust and policy all over the place. In a society with rule of law we depend on it. You think your phone couldn't be owned if you were important enough to be targeted?

Yes. All the fabs and stuff we have now shoufd be devoted to implementing a surveillance state. This must happen. It cannot be any other way.

This is what you sound like. The problem here isn't the tech. It's that Big Tech has deluded society into believing privacy and personal ownership of devices doesn't exist because it would inconvenice Big Tech. Law enforcement echoes it because they were spoiled by the brief period that they tasted ClearNet, and they don't want to return to having to investigate the old fashioned way.

Every other major industry has increasingly started doing the same thing. It is not okay. We have no right to sell out future generation's privacy. It's cowardly, selfish, and does more harm to them in the long run.

I’m not making statements about the way things ought to be, I’m being pragmatic about the way things are.

We’re trusting a lot of the stack. Apple’s policy as described is reasonable. If you distrust it because of the things they could do, that same logic applies to the entire stack.

The nature of modern software distribution is that the majority of the stuff we use from centralized corporations is governed by policy, not technical capability or controls, and you don’t get to know the details.

You don’t own the OS you use, you don’t own the important parts of your phone.

This can be different. Decentralized applications via protocols are interesting (DeFi blockchain stuff like Audius or other apps on Ethereum). If the UX can get figured out.

Urbit is interesting too - if you want to actually own your stack, use Urbit: https://media.urbit.org/whitepaper.pdf

Outside of decentralized protocols you’re ultimately just trusting policy somewhere. It seems dumb to me to arbitrarily be upset at Apple’s policy here, when the specifics are reasonable (and allow for e2ee).

> Apple’s policy as described is reasonable.

Apple is performing warrantless searches, and somehow people see it as okay because Apple is not the government (even though it functions as a state agency in this regard).

> They're pretty explicitly telling us what it's for and what it's not for.

Nobody should blindly trust Apple. As an organization, they already love secrecy and shadows--what better place to sneak in and test this kind of feature, free from employee ethics and scrutiny?

They've been cooking this up without telling anyone, which is also indicative of how above board they are. Who knows what else they're doing with this now or will do in the future.

The CIA, FBI, MI6, Mossad, FSB, CCP, et al. will use this to learn more about their targets.

Reply on news.ycombinator.com