Hacker News Reader

Comment by nullc | Hacker News Reader

The quote from the Apple executive is misleading to outright dishonest.

> “Security researchers are constantly able to introspect what's happening in Apple’s [phone] software,” Apple vice president Craig Federighi said in an interview with the Wall Street Journal. “So if any changes were made that were to expand the scope of this in some way—in a way that we had committed to not doing—there’s verifiability, they can spot that that's happening.”

Apple uses complex cryptography to shield themselves and their list providers from accountability. You cannot determine if they've included non-child-abuse images in the database through inspection.

View on HN

It's crazy that people argue what is being scanned, but the very fact that it will take place at all. Imagine a landlord coming to your place and looking around for drugs. This is insane violation of privacy regardless of intent.

s/your landlord/your house maker

The feature is only supposed to be about pictures stored on iCloud, so the landlord comparison is more correct.

When Apple will start analyzing pictures on iphones and not in the cloud, then your substitution will become correct.

They scan the images on the iPhone before they are in the cloud. That's the whole point of Apple's system.

Landlords have the right to enter their property at any time given a "reasonable" notice which is typically 24 hours and almost all states have provisions for "inspecting the premises". I don't have to imagine, this happens almost daily.

Hypothetically you could remove the drugs and be sure they're gone before inspection. Images being "deleted" from the cloud... not so sure

You'd have a darn good case for suing your landlord if they started going through your drawers, though. The inspection is for condition of the building and fixtures.

Nobody seems to remember that the EARN IT Act nearly passed in a bipartisan vote last year in the US. Apple's CSAM Scanning is better than that potentially coming back.

No, but you can verify that only photos uploaded to iCloud are scanned, and can verify that photo metadata beyond the security voucher is not generated or sent to anyone but Apple.

The former, yes. The latter no: because Apple can send it on further beyond your ability to observe. :)

Yeah but once you move something from your personal device to a cloud operated by a private entity why would you expect privacy anyway?

Horrible counter argument, what's the point of Apple advertising privacy ad nauseam if your shit isn't safe and secure for your eyes only.

How can you verify what Apple does on its iPhones?

Apple has special iPhones for security researchers.

Why can't we all be security researchers?

Why are we defending this move by Apple?

Richard Stallman was right about everything. In twenty years, people will be standing up for Apple as they upload your health data to your employer and insurance provider.

"It won't matter if you eat right and exercise," is a quote I expect to hear.

"And even if it matters, so what, everyone does it"

Because most people don't give a fuck on this topic. It ticks the boxes we need ticked. You're different, that's cool. Shout it from the rooftops. I support you.

Yes, but they're loaner units primarily intended to contractually obligate security researchers to work for Apple. I trust a security researcher using an official Apple device about as well as a Trump-funded 2020 election audit.

Apple uses the technical protections on the phone to make it very difficult to actually even be in a position to do security research without also being NDA'd. There is no owner override like there is on, say, M1 Macs. Apple's position is that nobody but them loads OS code onto your iPhone. Not even you - and you can't practically do any research or auditing on things like the CSAM scanner without having the ability to poke around in the OS.

If Apple had an owner override on iOS-fused devices, then we could load our own kernels, call into the neuralhash framework, and so on to actually validate that the system does what it says. But that would also mean that Epic could sell Fortnite skins outside of the App Store, and we can't have that. So instead we need to gag and muzzle security researchers... which also makes them no longer independent auditors of the iOS security model.

> Trump-funded 2020 election audit

How droll.

Don't claim in one breath that an iPhone can't be looked at by security researches, and in the next say "well, not the ones I want"

I understand if their security research policy doesn't go far enough, but let's not pretend there is nothing.

And VW has special software for emission tests. The whole point of security tests is to test on the same iPhones the normal user has without the doubt of special test devices.

Reply on news.ycombinator.com