Hacker News Reader

Comment by djrogers | Hacker News Reader

How is it not still E2EE?

If a copy of your messages (even if it is only low resolution jpgs) get auto forwarded to Apple/FBI under certain circumstances it is not securely E2E encrypted

Apple's investigation code executes on the device, which allows them to preserve their definition of end-to-end as long as you plug your ears and ignore where the 'ends' are.

I’m not interested in Apple’s newspeak definition of “E2EE” (where they are between the ends) or “Privacy” (terms and restrictions may apply).

I want the real thing.

In this case, they wouldn't be "between" the ends, no? They'd be _at_ the ends, just as sending a message on Signal doesn't prevent someone from stealing your phone and reading your messages.

I'm not in agreement with this being ok, but if it truly is on device, it still technically can be E2EE

> but if it truly is on device, it still technically can be E2EE

What do you think this software does when it finds a matching hash entry? Toss a notification to ask you nicely to pop round your nearest FBI office?

What meaning does 'end-to-end' have anymore if this applies? If Apple wrote software on-device to forward a copy of all messages prior to encryption to iCloud for 'backup', would it still be end-to-end? What if they sent it to an AdTech firm to index for interesting terms that match products you should be pitched? The software in this case is still Apple's, running on-device.

E2EE implies it's encrypted between the two parties exchanging messages, which it still is. I'm not suggesting that this isn't an immoral circumvention of the system, but it's still certainly end to end encrypted between the two clients, given that the scanning is performed on device, and not in transit.

> I want the real thing.

If you used iOS/iMessage, you have always trusted Apple. To be truly 'end to end' you would assume that there's no opportunity for another party to intercept your messages: the only trust would be in the keys you exchanged with your peer.

1. They are a trusted broker for iMessage key exchanges. You didn't do the key exchange, you assumed that when Apple did so on your behalf that you're really communicating with the peer you think you are.

2. They designed the iOS features that you trust keep iMessage data inaccessible to other untrusted software on your device.

3. They designed the secure enclave and make public statements that they won't compromise it for law enforcement. You trust that their deeds in private match their public statements.

They used to trust Apple, now they have learned they shouldn't trust Apple. This is progress.

It’s not forwarded to Apple/FBI though, under any circumstances.

the 'visual derivative' of photos on your device are sent to apple

That is the CSAM iCloud photo stuff; iMessage has nothing to do with that.

The subheadline- >More than 90 policy and rights groups ask company to abandon plans for scanning phones of adults for images of child sex abuse.

This thread is about iMessage, and the sub headline you quoted is about CSAM scanning that only concerns iCloud Photo Library.

No, they aren't. You're conflating two completely separate features, and this thread is specifically about the iMessage one.

I'd suggest you read up a bit on this - https://www.apple.com/child-safety/

What we're discussing is this feature:

"The Messages app will add new tools to warn children and their parents when receiving or sending sexually explicit photos.

When receiving this type of content, the photo will be blurred and the child will be warned, presented with helpful resources, and reassured it is okay if they do not want to view this photo. As an additional precaution, the child can also be told that, to make sure they are safe, their parents will get a message if they do view it. Similar protections are available if a child attempts to send sexually explicit photos. The child will be warned before the photo is sent, and the parents can receive a message if the child chooses to send it.

Messages uses on-device machine learning to analyze image attachments and determine if a photo is sexually explicit. The feature is designed so that Apple does not get access to the messages."

There are no visual derivatives, no neural hashes, and nothing is sent to apple.

No copies of any iMessages get automatically forwarded to anywhere. The iMessage stuff is not the same as the CSAM scanning iCloud photo stuff.

That's not what happens with the iMessage feature - that's what happens with the iCloud photo library CSAM scanning feature, and iCloud photo library has never been E2EE.

Maybe it's the expandable back door reporting mechanism that Apple wants to put in there?

That's not related to iMessage - that's an iCloud photo library thing. iCloud photo library has never been E2EE.

Reply on news.ycombinator.com