Hacker News Reader

Comment by tpush | Hacker News Reader

> [...] and the parental notification system is a shift away from strong end-to-end encryption.

That particular statement doesn't make much sense to me. The parental notification system is just a frontend action (one of many, like link previews and such). What does that have to do with iMessage's encryption?

I can see an argument about a shift away from privacy (though it only pertains to minors under 13 receiving sexually explicit images). But I think it's misleading to say that it relates to iMessage's encryption in any way.

View on HN

It is not about the encryption, it is about what an "end" is.

Generally, we consider the "end" to be the end user. If someone else can see the message along the way, it is not end to end anymore from a user perspective, even if it is from a network perspective. And Apple has complete control over your device through software updates. So that the leak is from your device or from the network is a mostly meaningless technical detail.

But the message isn't being sent anywhere. The parental notification stuff doesn't do that.

And obviously both the sender and receiver software processes the unencrypted messages in a variety of ways.

As a parent, I consider myself the "end user" of my child's device, not my child. That I might be looped in on any messages sent or received by this device is not at all a leak, it's a convenience—much like how I can receive messages sent to me on my phone and my laptop.

When someone sends a message to your child, the message is for your child, not for you. Your child is the "end point" and you are an evesdropper.

This is a case where I think it is justified, as long as your child is a minor and you are his legal guardian. But as acceptable as it is, you are still a spy and the app is spyware.

The fears, justified or not, is that the same feature that can be used for parental control can also be used on adults without their consent.

Personally, I think that right now, the fears are overblown, but I also think that Apple got the backlash they deserved. Privacy is not to be taken lightly, it is something that both protects freedom and helps criminals, also a strong political stance. It is not just a marketing took against Google.

Im a parent of young ones and I wouldn't want control of my kids' devices or messages. Good parenting is about preparing your kid for the world, not jumping in whenever there is a fire. Frankly I find this attitude very creepy. At what age do you "turn off" access? If you can't handle your kid being online then don't pay for their device or phone plan.

It’s also about building trust and a relationship with your child.

I also think this behavior is creepy and would do it myself. But interestingly it is preparing them for a world in which there really are no secrets anymore.

If the world is full of goblins and demons you don't become a demon to "prepare them". You are their rock for as long as you're around, and when you're gone they'll be the rock for their children or other friends and family.

> But as acceptable as it is, you are still a spy and the app is spyware.

I vehemently disagree that a feature could be classed as spyware if it clearly and unambiguously declares exactly what it's going to do prior offering a choice whether or not to do it. By that logic, the mere presence of a "report phishing" button in any cloud email service would be sufficient to declare it as spyware.

But fine, whatever. You're welcome to call any form of parental oversight of a child below the age of thirteen "spyware" if you like, so long as you accept that it's entirely my choice as a parent. This feature isn't on by default. If your opinions as a parent are different, don't turn it on. It's not your place to deny me access to this opt-in tool which can help keep my child safe.

When I was a child, my mother refused to buy me any computers. I had to earn money mowing lawns and raking leaves to buy a laptop.

Once I had a laptop, she told me she wished there was software she could install on all of her children's computers that would allow her to view what each of us was doing on her TV.

I considered that spying - even if it was intentional on her part. I detested how few rights I had as a child.

> I detested how few rights I had as a child.

That is called being a teenager, I think.

Minors deserve no privacy? Is that what you're saying?

If you're talking about teenagers, I would say there's valid debate to be had. Minors, hell no. There's no debate. Parents are entitled to know—I'd personally go further and say a responsibility to know—what's going on in their life.

Teaching kids that they have no right to privacy is a great way to raise people who don't respect the privacy of others.

Parents don't have an inherent right to know every single thing in a child's life. By that token, if a child is gay, and their parents are rabid anti-gay bigots, they still have a "right" to know whether their child is seeking out information relevant to LGBT teens. I'm sorry, but I wholeheartedly reject that premise.

Teenagers are minors. Doesn't sound like a very trusting environment.

I guess there's a language difference. I'm Australian.

The dictionary defines a minor as "a person under the age of full legal responsibility" which I think teenagers would still fall under, even in Australia?

Understandably the term might be used differently or more loosely elsewhere.

I'm also Australian but I know what "minor" means.

I would have you know that in some countries this would be illegal. A child has a right to private conversation just like any other person in many law systems.

And yes it is obviously a spyware.

The report phishing analogy is also completely wrong because it does not include any surveillance. You report the phishing and send the message to some authority. It is the same as going to the police after receiving a threatening mail, whereas the spyware is like the postal service opening each of your letters.

You appear to be confused, or conflating this with something else. None of that describes the system Apple has implemented for iMessage. If the child doesn't want the adult to see anything, that's a choice available to the child.

once given a device, a child's technical literacy will quickly surpass that of their guardian and as such, any form of 'protection' will be just as quickly circumvented. there is no technological panacea that will keep your child safe because that is not how predation happens in the real world.

I can't agree with this more. As a child, my technology skills were several orders of magnitude greater than my parents -- and the horrible spyware the school installed on its computers was a red rag saying "crack me" to a rapidly growing bull. These measures, arguably well-intentioned though they are, fundamentally teach kids that they don't own their devices and it's okay to spy on people. Good parenting is fundamentally different from that.

Somewhat related.

In my HS computer science class all it took was asking the teacher to use her computer to format a floppy because “my floppy drive was broken” and i needed a new disk. She agreed and not 15 mins later i had my workstation booting with no management or oversight.

This was certainly our experience when we were children. Near universal, I'd wager. But I don't think it's nearly as true for parents born in the eighties and nineties.

And to the extent that it might be true, it's still not a valid excuse for objecting to the existence of any such tools.

Not true today. Thanks to locked-down and dumbed-down smartphones, Many parents of the PC-era are actually more tech-inclined than their children

The parent paid for the device, don't they then own it? Or can kids sign up for phone plans and buy $1,200 devices these days? Normally, if I buy a device, I want control. If I chose to get alerted to porn being sent to my 10 year old - that should be permitted.

I don't care if the sender hasn't given consent, I don't give them consent to send porn or naked photos to my kids !

The one who pays doesn't matter. Unchecked and applied to adults that line of thinking gives right to terrible things, including slavery.

Children are a different story, they are not free, they are under the control and responsibility of their legal guardians. In fact, the status of a child and the status of a slave are not so different, that's why there are very strict laws regarding child labor, because otherwise it could easily end up in actual slavery.

Here the problem is not parental control, that is fine, the problem is that the backdoor is now in place and could be potentially used against adults with all the nasty implications. Again, I think the fears are overblown, but I understand that it makes people uncomfortable, especially since they may have bought an overpriced device on the premises of privacy. Most of the most egregious privacy violations start with "think of the children", even more than terrorists and covid.

This is just such a crazy position.

If I buy a car it doesn't matter that I own it? If I rent it to you I can't set the terms of that rental?

This is just nuts from the EFF.

There is an enormous difference between a situation where both parties are independent adults, and where the parties are a parent/guardian and their pre-teen child. Trying to make analogies between these is fraught with error.

You have the fructus but no longer the usus and associated rights. If you own an apartment it does not give you a right to set up webcams to look at the tenants.

You do if those "tenants" are minors.

See: baby monitors.

It doesn't matter how much the device cost or how much you want control or how justified your access is, if you are able to intercept private messages sent between two other people then those messages can't reasonably be considered encrypted end-to-end

How does this work if you buy your spouse/SO a device? Or a parent/grandparent? Even a gift for a friend?

You are making this out to be more complicated than it is. A gift is a gift. A device "assigned" to someone by an administrator (e.g. a work laptop) isn't a gift. The gift of a device with administrative strings attached is just that.

Furthermore, by law the parent still effectively owns anything "given" to a pre-teen child. If the parent wants to take the device away from them and sell it, they're well within their rights to do so.

So now you’re the IT administrator of your family and you’re assigning devices to your employees? It’s a gift when it’s your spouse but not when it’s your child?

> Furthermore, by law the parent still effectively owns anything "given" to a pre-teen child.

Now that’s very broad. Which country/state/etc? I think if you actually looked instead of assuming, you’ll find that people under 18 can definitely own things.

If you buy the device, you own the device. Software too. It is just the OS can disable itself for a string of reasons.

To protect the children, should Apple should require verification of parental status? Ie upload birth certificate, photos of parents, child, whatever is necessary to establish true legal guardianship.

This surveillance is a huge can of worms. Apple should stay faraway.

The EFF's challenge is when people abuse the system (ie a partner requiring their partner to register as child), or abusive parents.

From the letter: "Moreover, the system Apple has developed assumes that the "parent" and "child" accounts involved actually belong to an adult who is the parent of a child, and that those individuals have a healthy relationship. This may not always be the case; an abusive adult may be the organiser of the account, and the consequences of parental notification could threaten the child’s safety and well being. LGBTQ+ youths on family accounts with unsympathetic parents are particularly at risk."

Should Apple should require verification of parental status? Ie upload birth certificate, photos of parents, child, whatever is necessary to establish true legal guardianship. Still doesn't protect the children from abusive parents though.

These features need to be killed off yesterday.

It's very creepy that you want to eavesdrop on your child in that way, in my opinion. This is the micro version of governments wanting ubiquitous surveillance.

Partially agree, there was some weirdo on another hackernews thread that monitors their 17 year old daughter's phone and has no plans to stop until Apple remove the right on the 18th birthday. Crazy. That said I think it would be reasonable to check up on your 13 year old to ensure there is no pedophiles messaging etc.. I'd probably draw the line at 14 after having a open chat about risks, peados, impersonation, social engineering etc

Do I want to eavesdrop on my pre-teen child? Hell no.

Am I entitled to know when my pre-teen child has received a message that contains a potentially explicit attachment, or text which matches the traits of child grooming? Hell yes.

> And Apple has complete control over your device through software updates.

This has been true of all operating systems with integrated software updates since the advent of software updates. In this respect, nothing has changed for over a decade.

They went into this in more detail in 2019: https://www.eff.org/deeplinks/2019/11/why-adding-client-side...

EFF would probably argue that technologies like safe browsing are also a shift away from E2E encryption. They were strongly against email spam protection in the 90s for this reason.

You mean when they said blanket banning email lists is bad and shouldn't be done? Because yeah that's still true.

That was in the 2000s and a different issue and not opposed on privacy grounds. There they argued they were defending freedom of speech. In the 90s the argument was against early probabilistic models.

I remember those arguments against spam filtering!

Now we all accept it as annoying but necessary?

My guess is this may meet a similar fate.

Framing the EFF's position as being against browser safety or spam protection is disingenuous.

I didn’t say they were against either. I said their opposition to iMessage parental control features as a change to E2E encryption translates directly to other messages client safety features that may reveal the content of communication to a third party. (Nobody in the discourse seems to take their FUD about iMessage seriously, given that the focus has largely been on known CSAM detection.)

In particular, you can be concerned about E2E encryption being compromised while still believing parents should have some transparency over whether their kids are receiving explicit images. Not clear EFF offers a solution that meets both, but I did not say they are opposed to the latter.

Reply on news.ycombinator.com