Hacker News Reader

Comment by nomel | Hacker News Reader

Why is this question being downvoted? I too would like to know what this attack achieves.

From what I see, the end result of false flagging is either someone has CSAM in iCloud and you push them over the threshold that results in reporting and prosecution, or there is no CASM, so the reviewer sees all of the hash collision images, including those that are natural.

Is the problem that an attacker can force natural hash collision images to be viewed by a reviewer, violating that persons privacy? Do we know if this process is different than how Google, Facebook, Snapchat, Dropbox, Microsoft, and others have implemented these necessarily fuzzy matches for their CSAM scans of cloud hosted?

Or am I missing something that the downvoters saw?

View on HN

You are one underpaid random guy in India looking at CSAM all day clicking the wrong button away from a raid of your home and the end of your life as you know it.

This, these charges are damning once they are made. Plus the countless legal dollars you are going to have to front and hours spent proving innocence and that's assuming the justice system actually works.. Try explain this to your employer while you start missing deadlines due to court dates.. The police also could easily leverage this to warrant hop. As they have been found doing in the past. I think the bike rider who had nothing to do with a crime and got accused because he was the only one in a broad geo location Warren is all the president of of you need that this will be abused.

A false report is not going to lead to charges. In order to bring a case they need evidence of possession.

Innocent until proven guilty or, with the way we're heading, guilty until proven innocent. And it wouldn't matter as you are now already _tainted_.

Try explaining to your employer that your employer's laptop was seized because the police took all of your computers and devices when arresting you.

Yes. Once you're accused, your life is over. Nobody will pay any attention to a news article the next week saying they found nothing.

You're assuming the police are nice and quickly announce when they haven't found anything. The more likely outcome is that it takes several months until the case is dropped silently.

Could you explain this? The process, according to what's publicly known, is that the images will go to NCMEC for further review, then NCMEC will report it to the authorities, if it's actually CSAM. The low paid (a big assumption here) Apple reviewer is only the final step for Apple, not prosecution.

The idea I've heard is that images could be generated that are sexual in nature but that have been altered to match a CSAM hash, making a tricky situation.

That's an interesting point! From my understanding, Apple's hash is not the final qualifier. SCMEC also reviews them before reporting to the authorities. But, I can imagine a scenario that might require opinion.

Reply on news.ycombinator.com