Hacker News Reader

Comment by gpm | Hacker News Reader

Apple has literally proposed using the phone you bought and paid for to spy on you and report you to the authorities if you do bad things. While they backed down from that plan, they went out of their way to make it clear that they were only backing down temporarily. To suggest that iOS is ahead in privacy is ludicrous.

I'll keep buying phones that only use cloud services that spy on me, instead of spying on me directly. At least that's somewhat defensible as it's not my hardware acting against me.

View on HN

> To suggest that iOS is ahead in privacy is ludicrous.

On Android, you have a dad reported to the police and his Google account locked (including his Google Fi cellular plan) for taking photos of his toddler to send to the doctor https://www.nytimes.com/2022/08/21/technology/google-surveil...

Apple has not done this.

The photos were synced to Google Drive where we know it would be scanned...which is fine. Apple's proposal would report you as soon as you took the picture.

You're leaving out the detail that the CSAM scanning and detection would only occur if you upload your photos to iCloud. If you don't have iCloud photos turned on, the scanning wouldn't happen.

Additionally, scanning would happen on-device at time of upload and not on Apple's servers.

Not only that but Apple’s only matched hashes of known CSAM kept in the NCMEC database.

Google meanwhile scans for algorithmically determined new content and ruins people’s lives without any ability to appeal (even after national news coverage): https://stratechery.com/2022/rights-laws-and-google/

Also Apple was clearly doing this so they could enable e2e encryption on iCloud.

They were doing it as a favor to the DOJ to avoid an investigation into their business practices.

To be fair they were probably doing it as a disguise to the real goal: spy on everything you do on your phone and send it to the "authorities", no questions asked. Before the autists noticed it after it was implemented, Apple simply announced beforehand that it's devices would start spying on you, but it's to protect the kids you know...

> but it's to protect the kids you know...

Yeah, but the big question still remains, do they protect me from terrorists as well?

ya thats BS argument, I dont need my cellphone os to protect me from terrorists I need them to protect my privacy from unnecessary overreach from govt. having a completely surveilled society will will protect you from most of the attacks but to most people the cost will be unbearable. I thought that was quite settled after snow-den disclosures.

> If you don't have iCloud photos turned on, the scanning wouldn't happen

At first. Then some legislator gets the bright idea mandate on-device scanning or someone adds a dark pattern to trick people into uploading to iCloud without realizing the ramifications. Having that capability is a threat to privacy even if it is initially configurable.

This is what happened in the google case. The photos were immediately auto uploaded to google photos because that’s the default configuration.

Apple’s proposal scanned for KNOWN abuse images. It didn’t try to identify NEW images the way Google did.

So in the same situation Apple’s proposal (which was designed with the input of many experts to avoid false positives and respect privacy) COULD NOT have flagged the father.

You are incorrect. A quick google search will show you that the Apple CSAM detection was only going to be implemented to photos uploaded to iCloud.

I was under the impression that Apple only planned to scan photos that would be uploaded to the cloud. Is that incorrect?

They were planning to compare hashes/fingerprints of your photos against known, existing child porn images.

This is the thing that confuses me about this discussion.

Apple planned to look for known abuse images. People freaked out and they had to back down.

Google already scans for possible abuse images including new ones using AI. Thus it found and reported a father for a pic he had just taken.

And Apple is somehow the worse of the two.

Yeah lots of cognitive dissonance. Some people keep comparing what Apple could be instead of what they actually are. Google as a privacy champion is not something that is supported by reality.

They're free to scan whatever they want on their computers. Not on mine. Especially not without my knowledge. I don't want anti-cheating and anti-malware software surveilling me either. Even the goddamn NSA has had data leaks because someone installed Kaspersky and it phoned home with a copy of some suspect data.

They were adding a hash of a photo as metadata that is unreadable by everyone except Apple after you upload an image and only if it matches the hash of a known csam image.

The whole OS is proprietary. You either trust apple to do what they say or you will have to run Android on a build you completely reviewed the source to.

If you want to act practically, scanning on your device is slightly better for privacy.

Everyone agrees that stopping CSAM in a way that respects everyone rights is a good thing. We aren't making a results oriented objection to the goal, but a methods oriented objection.

The courts at least all agree that a company can be compelled to scan content in their possession, the creator of the content has no significant privacy rights. This is known as the third party doctrine. All Google is doing is doing this kind of scanning.

Apple meanwhile, wants to take your device (something that they cannot be compelled to do, due to the 4th amendment restriction against seizures) and use it to scan the content on your device (something they cannot be compelled to do, due to the 4th amendment restriction against searches) to decide whether or not there is illegal content on it.

The company violating you worse is pretty obviously the one doing things to you that the government couldn't compel them to do, because (if compelled) it would violate your rights.

Apple isn’t compelled to proactively scan photos on iCloud.

The scanning on device was adding a hash to each photo only readable

  - if it matched a known csam image

  - multiple photos within the iCloud account match known csam images

  - the image was uploaded to iCloud

Compare that to Google where only the last point needs to be true in order to have Google run any algorithm they please on your photos looking for violative images.

But they were not not going to do it if you chose to use iCloud Photos. It’s basically a condition in the ToS, just like Google has one saying they can scan stuff in Google Photos.

It seems like hair-splitting to me. In both cases your photos are getting checked if you want to use the cloud storage service. Why is it worse to do on device (where it’s private) instead of on Google’s server (where you have to give them a plaintext copy of the photo)?

“Oh but Apple could change that with any update”. Couldn’t Google do the same with any update to Android, or even a Google Play Services update?

>Why is it worse to do on device (where it’s private) instead of on Google’s server (where you have to give them a plaintext copy of the photo)?

Suppose you go to a public restroom and someone has installed a camera in there to perv on the people using it. That would be an invasion of your privacy, right? Now suppose someone installed a camera in your bathroom at your house. Would you say that's an equivalent invasion of your privacy?

Your analogy is way off base.

First: this was all, quite literally, about Apple wanting to NOT have access to your unencrypted photos.

In Apple's proposed plan, we would only be talking about hashes of pictures, and the comparison would be done by your device.

A fitting analogy would be if the "public restroom camera" snapped a Polaroid of you and asked you to compare it to a binder of known child porn, except somehow did this in a way that did not expose you to child porn and would not inconvenience you in any way and was guaranteed not to transmit the Polaroid somewhere else, and you had opted in to the whole process and there was another bathroom right next to it that required no such participation.

It's important to understand that Apple's on-device scanning plan was in the service of allowing E2E encryption.

The idea was to create a path by which they could comply with various current and upcoming CSAM legislation while still maintaining an E2E encryption flow.

You're taking the analogy too literally. I was merely responding to the question posed by MBCook in general, not in this particular case. Performing an operation in the user's device is inherently more intrusive than performing the exact same operation in the server.

Incidentally, this scanning using hashes is indistinguishable from malware. Someone other than the user is instructing the device to perform operations that under no circumstances will benefit the user. Would this be tolerated if the list of hashes included copyrighted files, or prohibited books? I'm constantly disappointed by how effective "won't somebody please think of the children" is.

I certainly agree that "won't somebody please think of the children" has been exploited countless times in various shameful and downright evil ways.

(And tangentially, I'm not even sure that spotting traders of known CSAM is even a great way to combat the extremely real problem of pedophilia. Feels like another "war on drugs", where we target end users, as opposed to addressing the actual roots of the problem)

In a way, Apple is the victim of that here - they need to comply with laws based on "think of the children" rhetoric.

There are various current and proposed laws in various places around the world that compel Apple to share cloud content with various law enforcement agencies. Various current and future laws may compel Apple and other cloud hosts to actively scan for and report various things on behalf of government. This is... not great. I don't want to put words in your mouth, but I think we agree on that much?

We also agree that it is at best impractical for Apple to flaunt the law of nations, yes?

They are powerful, but they can't just defy federal law in a brazen and public way.

This is the context in which Apple's on-device image fingerprint scanning was conceived. They would like to enable E2E encryption for users for privacy's sake (because privacy is also a unique selling point vs. Google) while simultaneously complying with law.

If you want to argue that it sucks: sure. That's totally valid. The alternatives are certainly viable and even commendable: running your own "cloud", eschewing cloud storage, shunning smartphones entirely, etc.

However, it seems like most people like and want cloud storage.

Working within the constraints of "people want cloud storage" and "we can't openly defy multiple world governments", Apple's CSAM scanning proposal felt like clearly the best possible (least evil, if you prefer) cloud solution that doesn't involve exiting the market entirely or establishing their own offshore data centers and declaring them sovereign nations.

>(And tangentially, I'm not even sure that spotting traders of known CSAM is even a great way to combat the extremely real problem of pedophilia. Feels like another "war on drugs", where we target end users, as opposed to addressing the actual roots of the problem)

Agreed.

>We also agree that it is at best impractical for Apple to flaunt the law of nations, yes?

It's unclear to me what law would be violated by both storing encrypted data on their systems that they don't have the keys for and not scanning client devices.

> Performing an operation in the user's device is inherently more intrusive than performing the exact same operation in the server.

Why? That’s the part I don’t get. People state that like it’s obvious on its face and it’s not to me.

If you perform an identical operation on a server, why is it better than performing the same operation on my device?

The result is identical. The inputs are identical.

Well, because that's what "intrusive" means. Your property is being intruded into in order to use it for the benefit of someone other than you. Your property is yours. It's in your possession because you paid for it. It should only do something because you tell it to or because it will help it to better respond to your commands later. It should never act against your interests. You would not buy a microphone that eavesdropped on you, right? It should be equally unacceptable that your computers read your files, perform some computation on them, and send the results to some remote location without your intervention.

On the other hand, when you transfer your data to someone else's computer, you're relinquishing some control over it. Just like how your computer should serve you, that computer will serve its operator, and that operator's interests may be adversarial to you.

> It should be equally unacceptable that your computers read your files, perform some computation on them, and send the results to some remote location without your intervention.

I hear you. I really do. The world you describe is the world I want to live in.

But it’s not the world we live in. Your device is so complex, does so many operations per second, has so many sensors, sends so much data, receives so much data, that it is functionally impossible for a person to consent to everything that their device does. For all intents and purposes, you own the device, but have very little control over it. This has been true since smartphones came into existence.

So to take a stance like yours — and all-or-nothing stance, a declaration of sovereignty from the The Way It Works — is, I’m sorry to say, delusional. Demanding that perfect be the enemy of the good is exactly how we will sleepwalk into the dystopian surveillance state.

You're looking at it the wrong way. You're saying that it's impractical to have perfect knowledge of everything the device is doing, but in fact that's not necessary. All it would take is to have laws that make it illegal to inspect data in a user's computer except by confiscating the device with a warrant. That would remove all incentive for LEO and companies acting on their behalf to pull stunts like these. It would also mean they would have to have very good tracking to prevent tainting of evidence (since it would otherwise be difficult to tell where a piece of data came from). Obviously this would not secure you from all attackers (e.g. imagine you want to keep some trade secrets, secret), but nothing other than good infosec would.

The problem is that a lot of people don't understand why privacy is important and why compromising it for what seems like good reasons is dangerous. Such people don't understand that some laws that make it easier to get away with crimes can still be good.

If they were going to enable e2e wouldnt that have to mean no manual review before reporting people to authorities?

So you’re against all scanning?

No, the analogy isn't perfect. It was just intended to show how both types of scanning are different. If someone agrees that installing a secret camera in a private bathroom is worse than in a public one, they should also agree that scanning files in someone's personal device is worse than scanning files in one's own server.

I think once you give someone else your unencrypted data, anything that happens to it afterwards is fair game. I assume at some point a human will snoop around my files.

Do you have a source for that? I somewhat recall their proposal was only to ever scan photos uploaded to iCloud.

The announcement was a little confusing, but Apple said they would scan photos being sent to iCloud but the scanning would occur on device (I suppose right before uploading).

I believe that was the plan, initially, however the scanning was still happening on device. That has many people rightfully concerned that the scanning could extend to local-only images next.

What a strange concern. Sending hashes of images as you take them to a remote server is very easy to do in any OS update, if they really wanted to betray their customer base's privacy expectations like that.

IMO the more logical guess as to the actual reason Apple wants to do this - to approach e2e encrypted iCloud photos in a LE-friendly way.

The thing is they never announced e2e iCloud photos with the new process. So we could presume, but I honestly believe they never intend to give it to us.

iCloud backups are not e2e encrypted, though.

And I don’t think anyone was suggesting that Apple would secretly betray users. The concern is normalization of the notion of on-device scanning before (publicly) expanding the scope to all images.

I was not suggesting this either... And yes, iCloud backups if you choose to use them are mostly not e2e encrypted (some important bits like iCloud keychain etc aside).

In any case, I think this concern of yours is unfounded, as echoed by many in the other comments below, and you should rethink it before continuing to push it.

The amount of scanning has not changed since the invention of corporate image hosting on the internet; you still cannot use iCloud to host known illegal content - they just moved where the scanning takes place. I don't see how this makes it any more likely or normalized to scan your non-iCloud photos.

If are talking about the whole device backup, Most of it are encrypted with your phone unlock pin or recovery code. Only iMessages (iirc) are not e2ee.

They have it backwards, scanning cloud uploads on device is more private than scanning them in the cloud.

Only if iCloud photos were e2e encrypted, which they are not. Then cloud scanning would necessarily mean removing the e2e encryption.

Since the photos are decryptable by keys in Apple’s possession, there is no real advantage to scanning on-device unless Apple/the government wanted to increase the scope of the scanning beyond iCloud.

https://support.apple.com/en-us/HT202303

The advantage is that it doesn't use those keys, and you can see what it's doing. Less time spent ever decrypted = more private.

iCloud photo are not e2ee, but encrypted at rest. The key is encrypted with your password. Once you're logout, they are not supposed to be able to access them..

This isn't true at all FWIW, except for the "encrypted at rest" part. "At rest" just means Apple doesn't dump them onto hard drives somewhere in plaintext. Their security model is documented in detail and is worth understanding.

https://support.apple.com/en-us/HT202303 https://support.apple.com/guide/security/welcome/web

It's illogical to fault Apple for something that they hadn't even talked about implementing ("local-only images" as you put it)

> That has many people rightfully concerned that the scanning could extend to local-only images next.

Apple didn’t propose this, and the scheme that Apple did propose was very inconvenient if they actually wanted to do this. They would have had to redesign how the system worked to do it, at which point most of the system would become completely useless. Nobody would come up with a system like Apple’s if they wanted to do what you describe. There are much simpler ways to do that which would have saved Apple a lot of time and effort. The only reason to design a system like Apple’s is to limit knowledge in all directions as much as possible.

Nobody was rightfully concerned about this, they got outraged because they would rather jump to conclusions over headlines than take the time to read about how the scheme worked.

The only reason to design a system like Apple’s is so that it is impossible to opt out of once it is rolled out to non-iCloud photos.

iCloud photos are not e2e encrypted. If only iCloud photos were the true final target, there is absolutely no need for on-device scanning.

> The only reason to design a system like Apple’s is so that it is impossible to opt out of once it is rolled out to non-iCloud photos.

This doesn’t make any sense because this system cannot be rolled out to non-iCloud photos. They would have to redesign how it worked. So the whole idea that Apple designed it this way for reasons that only kick in when it’s rolled out to non-iCloud photos is incoherent. If Apple were designing it for that purpose they would have picked a design that actually worked in those circumstances.

What about the design makes this only possible for iCloud? The scanning occurs on device. What limits it to only iCloud photos?

Well it’s quite clearly integrated into the iCloud system. Why would you think that it works for local photos without iCloud?

A known CSAM photo gets added to photos on an iPhone with iCloud disabled – what happens next? What do you think is the mechanism for that getting reported?

Apple’s proposal would have only worked against previously known pictures in the database maintained by the non-profit. The story we’re discussing here is due to machine learning deciding the pictures were CSAM.

Umm, Google also reports you to authorities for bad things

https://www.nytimes.com/2022/08/21/technology/google-surveil...

Google reports you to the authorities, the phone you purchased from Google, but now own, does not.

So basically.

As of now, Apple does nothing as they backed down from that plan.

And google reports you to authorities and never stopped and also never went public about letting you know they were doing it (at least apple published a freaking press release to announce it and ask for feedback!)

And somehow that makes Apple worse.

To be clear, Apples current actual activities is the same as Googles current actual activites. They scan files uploaded to their cloud services and report you to the authorities if they discover illegal material. Both companies are of course unable to detect CSAM in encrypted files, and Apple encrypts more files by default meaning that the impact of their current policy is somewhat less than Googles. Neither company has ever felt the need to make splashy press releases about this.

Apple additionally has said that they will (though have backed off on the timing to "some time in the future") said that they will use your hardware to scan your photos and have it report you to the authorities.

> To be clear, Apples current actual activities is the same as Googles current actual activites. They scan files uploaded to their cloud services and report you to the authorities if they discover illegal material

Actually, they don't, at least according to Hacker Factor. There's definitely not only 160 images of CSAM uploaded to iCloud Photos every year.

> Of all of the companies identified by NCMEC, I only saw one that had an unexpected decrease in reporting: Apple. According to NMEC, Apple submitted 205 reports in 2019 (a third my my reporting volume). Apple increased a little, to 265 in 2020, but then dropped in 2021 to only 160 reports. That's nearly a 22% decrease over two years!

https://www.hackerfactor.com/blog/index.php?/archives/955-NC...

Interesting, Apples privacy policy says that they can scan data you upload for illegal content and report it, news articles from when this blew up in the news said that Apple did for services like iMail (that upload in an unencrypted form). I can't speak towards what they actually currently do.

My understanding of iCloud photos is that they're encrypted, as in Apple can't scan them on the server, but I'd imagine across they're cloud services they ought to be seeing more unencrypted content than that.

I also don't care nearly as much about their servers scanning content that they are in possession of, as my device scanning content that I am in possession of... so I probably should have stayed out of this part of the argument a bit better. Oh well.

https://www.apple.com/legal/privacy/en-ww/ (See Apple's Use of Personal Data)

https://9to5mac.com/2021/08/23/apple-scans-icloud-mail-for-c...

> My understanding of iCloud photos is that they're encrypted, as in Apple can't scan them on the server

iCloud Photos currently aren't encrypted this way, just "in transit and on server" [1].

> iCloud secures your information by encrypting it when it’s in transit, storing it in an encrypted format, and securing your encryption keys in Apple data centers. Both Apple and third-party data centers may be used to store and process your data.

This contrasts with services marked "end-to-end" where Apple doesn't have the key.

[1] https://support.apple.com/en-us/HT202303

With a court order, Apple will hand over the contents of an iCloud drive without any encryption to law enforcement. So they could do Google style preemptive scanning of everything uploaded.

Adding an encrypted hash to every photo instead seems way better than having access to every photo on iCloud without any encryption.

Apple devices are worse because they makes you use Apple services. Android devices let you use your own services. Google has to build its apps using the same APIs as everybody else.

It does if you select Google Backup, which is exactly the same situation with Apple.

It’s something of a tradeoff as encrypting backups on device runs into issues if you lose the device. However, if companies have unencrypted data the US government and possibly others will require them to check for specific things.

This comment is pretty incoherent but I assume you're talking about CSAM.

In which case, (a) you are not required to use iCloud Photos and (b) it is not out of the ordinary for US-based photo hosting services to scan for CSAM.

There is no evidence otherwise that Apple is "spying on you" whatever that specifically means.

> spy on you and report you to the authorities if you do bad things

Pedantic correction: while the phone would spy on you to pre-calculate + embed "you are a bad guy doing a bad thing" metadata into photos, the phone wouldn't then report you to the authorities. You had to choose to sync your photos into iCloud Photos (i.e. expose them in cleartext to Apple), for Apple to then discover the embedded "you are a bad guy" metadata out of them, and use it to report you to the authorities.

Apple also couldn’t tell if you were a bad guy until 10 such photos were uploaded.

This comment has predictably spawned a back-and-forth about which shitty privacy violating phone is 10% less shitty, but if you care about privacy the discussion you should be having is how to eliminate smartphone usage as much as possible.

Eliminating computer usage isn't a valid solution. Computers are too useful to simply stop using them. Maybe computers were a mistake that will eventually destroy society but for now they're here to stay especially mobile computers with built in archaic telephony.

So the question is how to improve privacy and control while using computers.

The solution is easy. You purchase a general purpose computer and use it. A smartphone is not a general computer, it's more of an appliance, and correspondingly Android and iOS have a variety of limitations.

A smartphone is also not something you really need to use a lot to get by in life -- sure, it adds a lot of convenience, but almost everything it does can be replaced by a dumbphone and a general purpose computer. Personally I still use one but if I find myself using it for anything other than calls, texts or food delivery apps I usually set it down and walk over to my Linux PC where I can do it equally well.

>> how to eliminate smartphone usage as much as possible.

>Eliminating computer usage isn't a valid solution.

Computer's promise is to be bicycle for mind. Computer usage does not deserve to be eliminated. Smartphone is something different. For me it feels that the promise of smartphone is to gather all your personal data which is possible.

As I'm sure you are aware, the proposed change was for files synced to iCloud. This puts it in the same boat as the recent Google Photos incident which you appear to be ok with.

But, as you noted, Apple backed down on the proposal, so assuming that you still hold that cloud scanning is ok, Apple's approach, at least in this regard is at worst equal.

Apple’s solution was not like Google’s.

Google used AI to try to find CSAM, thus it flagged the father’s picture taken to send to a doctor.

Apple’s solution was to check against a database of known abuse images. It would not be capable of flagging a new photo someone took.

Of the two solutions Google’s may find more offenders, but it would clearly find FAR more false positives.

The only way for a false positive in the Apple system is for two unrelated images to have identical perceptual hashes (with multiple algorithms?). Plus there was no reporting until a threshold of multiple (10+) matches were found, so one false positive wouldn’t do it.

> Plus there was no reporting until a threshold of multiple (10+) matches were found, so one false positive wouldn’t do it

Not even that, the photos were not visible to some trusted human party until 10+ matches were found. That is, photos were not auto reported, they were only decryptable after the threshold was crossed and then they are reported after being reviewed by a human

Apple doesn't seem to do any cloud CSAM scanning of iCloud Photos, at least according to Hacker Factor:

note: later on they say:

> Granted, Apple only rolled out this new functionality in mid-December 2021. However, based on their volume of traffic, I would expect them to (at minimum) submit a few hundred reports to NCMEC each week. I cannot fathom any legal or technical reason why Apple is not submitting more reports to NCMEC. It's as if these laws apply to everyone except Apple.

https://www.hackerfactor.com/blog/index.php?/archives/955-NC...

I'm fundamentally not ok with my device acting against my interests.

This doesn't happen with Google, my android phone does not act against my interests. Meanwhile Google's servers do act against my interests (as do Apples servers - though not as effectively since more content is encrypted), but I don't own them, so what can I really expect?

Apple only backed down temporarily, their communication has been "we still plan to do this, but later". Given the nature of OS updates, that means you can't buy an IPhone today and be confident that it won't decide to start spying on you tomorrow.

While I don’t agree with their plan, the only reason it was proposed is a tradeoff between allowing e2e encrypted cloud backups and upholding the law regarding no child porn on their servers. If you have a better idea then I’m sure they are happy to hear it!

Can you provide some sources?

https://arstechnica.com/tech-policy/2021/08/apple-photo-scan...

Generally search "CSAM apple" and you'll find endless articles about this.

link for “iOS report photos to police”

https://duckduckgo.com/?q=ios+report+photos+to+police&t=fpas...

https://arstechnica.com/tech-policy/2021/08/apple-explains-h...

You do understand that they only proposed to scan photos that were going to be synced to iCloud Photos.

Which is an entirely optional and opt-in service.

Also they were only scanning for known abuse images, not trying to find new ones to report with AI like Google did.

If they're only going to scan photos that will sync to iCloud Photos, why wouldn't they just keep doing it server-side? As far as it's publicly known, no one asked Apple to do this.

> no one asked Apple to do this

Apple is very pro-privacy and probably doesn’t like having access to unencrypted customer photos. But if they just encrypted everything it would be a child abuser’s dream because suddenly they’d be safe on iOS, and when people found out Apple started protecting them it would be a disaster for PR and law enforcement.

After much consultation their solution was to scan for known abuse images on device so they could be kept in the cloud in an encrypted form without providing abusers a safe haven.

> why wouldn't they just keep doing it server-side

Because they want to scan files that will be encrypted on your device and not transferred to the server as plaintext. No doubt they'll continue to scan unencrypted files server side.

> no one asked Apple to do this.

If someone asked them to it would turn it into a warrantless search with Apple acting as the state agents to search your possessions. It would almost certainly result in the evidence being tossed by any US court. This kind of warrantless search only works if Apple does it of their own accord, instead of on the governments behalf.

Note that this doesn't apply to searches done on Apples servers to data you uploaded, there it's their possessions that they're searching, not yours.

Reply on news.ycombinator.com