Hacker News Reader

Comment by sebiw | Hacker News Reader

What do you think are the chances we'll see a server-side implementation instead of the so far proposed client-side one?

View on HN

My prediction, based on zero evidence whatsoever. They'll implement it server side, and eventually introduce encrypted iCloud photos. But your choice is to allow this scheme (scan on device before upload) and have E2EE, or to not have E2E encryption and have it scanned on the server side.

Huh, I never really thought about the possibility that Apple would implement both schemes. I don't think they will go down that path, though. Why: Cost and complexity for Apple would be somewhat higher and the surrounding discussion about capabilities (abuse of the client-side system for other things than CSAM scanning) would persist just because of the existence of client-side scanning. Let's see how this story continues.

I highly doubt they’d offer a choice like this. 99% of their customers won’t know what these terms mean.

I’m guessing that rather than a choice, it’d be one or the other depending on the market, with most countries getting the server-side version, while totalitarian countries where people are already used to being spied on get the client-side one.

Interesting thought but Apple never gives choice on much (well except Safari UI now!), and I don't see them giving an explicit choice on this. If they really had for a goal to implement E2EE, I could maybe see this now that you are mentioning it.

However if I had to make a guess, they'll go server-side scanning only, and E2EE backups/Photos will never happen.

To me it's a pipe dream to believe they would offer E2EE, there's too much international pressure from governments around the world to keep iCloud backups open and going E2EE would trigger unpalatable retaliations.

I think it's plausible that they'd offer E2EE for all of iCloud.

They already do it for iMessage, and it makes it easier to turn down subpoenas if they can credibly claim that they can't even access the data themselves.

Likewise, offering an explicit choice also seems plausible. The full E2EE flow might have UX downsides (for example, the user might need to write down a recovery seed phrase on paper), so they might not force all users into that flow.

But that's the thing, they have reached a compromise regarding iMessage being "E2EE" by keeping all those avenues (iCloud backups and iMessage on iCloud) that essentially trade E2EE for the convenience.

Most users opt-in to the convenience for iMessage making it, for all purposes, no longer E2EE.

I don't see them removing that precisely because of iMessage.

Is there an alternate where they upload, scan, encrypt only non-offending data? Is there a way to share a public key that only allows for encrypting but not decrypting that would make this a viable option?

If server-side implementation, you mean they will scan images that I manually upload to iCloud, then I don't have a problem with it. As long as its off my personal device, and it is through my own action and not theirs. My device is my property, not theirs.

I guess the trade off here is that your data is still stored in (essentially) plain text on Apple's servers, and they (or whatever authorities) can still rifle through it at any time without telling you.

iCloud is encrypted but Apple has the private keys so it’s only slightly better than plain text. You should not expect you data to be anything more whenever you post anything online. The only exception is E2EE but Apple will never offer it.

The whole point of this hashing thing everyone complained about was to enable E2EE.

Just to be clear - that's pure speculation. There's no evidence (apart from this local CSAM detection) or other reports to back that up.

Agreed. If they really planned to enable E2EE, they would have announced it with the CSAM detection. It makes no sense to have all this backlash only to enable E2EE at a later date.

Which ironically, is less transparent, less open, and less private than Apple's original plan.

The main issue with privacy is not necessarily the initial implementation, but the sliding scale that it permits. Apple's statement that they will ignore "government requests" for broadening the scope is almost funny, because the government wouldn't request: it would demand. Just like how China has control over the crypto keys for the iCloud data in Chinese data centers.

So you're right that the initial plan is indeed more privacy-friendly, but it has some major future privacy implications that are much worse.

Is there any other way? The way I see it, the scanning is coming either fully server side or with a bit more privacy with the proposed client side system so is there something better?

Others providers do it and I don't expect Apple to sit and do nothing about it (governments, ngo pressure, etc.). Something worse is that the Apple brand could be labeled as a "CP enabler" which would very much hurt Apple way more than the current backslash.

Yes: E2EE and not having the ability to scan is a legit alternative. Apple has lost its credibility as a privacy-enabler. That's a real consequence, as opposed to a potential consequence of being targeted by propaganda.

There's a good chance we'll have a server-side implementation and a client-side implementation. The currently proposed client-side implementation has obvious holes and there's no way Apple doesn't know that.

They can expand client-side scanning massively or implement server-side scanning too. The latter will cause less objections, because 'Apple will not provide E2E' isn't a news item if they keep silent, while the client-side expansion will be.

Assuming they become very clear about advertising what they are doing and whether your data is stored locally or in their cloud, I might be okay with this. Having a vendor scanning my own personal device is downright terrifying to the point of walking away from iOS full stop. However the same logic can be applied to Apple's servers, and I think has serious implications for how we view cloud services going forward. If a company signs up to host my content, doesn't it make sense they would like to examine that content to make sure they are not breaking any laws simply by being in possession of said content?

The real answer is the same it's always been, we need to abandon the cloud in favor of going back to self-hosting and bring back the fully distributed internet, the problem is just getting technology to the point where doing so is easy enough for non-technical users.

This is already done by quite a few places. Take a look at PhotoDNA. I believe at least OneDrive and Gmail have been confirmed to do this same scanning.

For reference, from 2014: https://techcrunch.com/2014/08/06/why-the-gmail-scan-that-le...

They scan material already on servers they own, I don't think anyone is surprised about this. If you don't want anyone seeing or scanning your data, don't push it to the cloud. Apple's new policy of analyzing your data before it even gets to their cloud would break that paradigm.

>What do you think are the chances we'll see a server-side implementation instead of the so far proposed client-side one?

If Google, Microsoft and Facebook are doing this for years then the question is why is Apple not doing it? Did they not think about the children until last month?

Personally, I wouldn't object to a server-side implementation at all. My objection is that it's client-side.

Reply on news.ycombinator.com