Hash matching proposals for the Online Safety Act's implementation are dangerous | Hacker News Reader

Hash matching proposals for the Online Safety Act's implementation are dangerous

proton.me

53 pointsolestr17 comments

Not just false positives. You won't get the original images with the hashes of course, so no problem for a hostile state to slip in a few hashes of other things it doesn't like: document on off-colour politics, criticism of the prime-minister, ...

There’s no such thing as “similar enough” with a hash. One bit change in the source imagine creates as large a Hamming distance as possible in the hash bits - that’s literally the point. Unless I’m missing something that seems ludicrous to consider a hash as close enough to be a reason for probably cause.

Fuzzy hashing is a thing ...

Wait until they find out about fuzzy logic

Locality Sensitive Hashing and other sim-hash setups.

Then you'd run into a lot more false positives, which ought to make LSH a non-starter for this application.

In this case, a false positive might be a good thing from their perspective. If they can show that you have a close match it means they have an excuse to investigate you more thoroughly should they desire even if the real reason is that they suspect you of something else.

That's fascinating. Thanks. I've only encountered cryptographic hashes, or hashes for data structures that are limited by address size.

This reminds me that I should really publish that blog post about using hashes to send documents "into the future" (really just to prove you wrote them at an earlier date) at some point.

>Hash matching, or hash scanning, compares certain pieces of content such as videos, pictures or text, to a database of illegal content. It is done by turning the content into “hashes”, a sample of the content a bit like a fingerprint. The hashes of content stored or shared by a specific user are then compared to the hashes of known illegal content in a database and result in a match if the software deems that the hashes are identical or similar enough.

Because one of the things I realized while writing it is that there's an interesting contrapositive to keeping your own public list of hashes online somewhere:

1. By putting a hash on your public hash list, you are making a claim that you have access to a particular document at a particular time.

2. If someone else posts a hash on your hash list, say to a well-known document like the HTML source of example.com, they have in effect proven that you are not the sole person who can edit that hash list, and

3. Therefore your claim to access of anything on that hash list is repudiable and hence the entire list must be thrown out.

So... Maybe there's a similar counterjamming method available here? E.g. stuff the hash of "Hello world" into one of these illegal databases, then show it's there, to call into question the idea that everything on these databases is illegal and thereby get them thrown out of court.

(P.S., I'm almost positive you can use keypair encryption to get around this, but I haven't taken a bus ride long enough to puzzle out the details of how yet.)

Looks like you're not familiar with how these sorts of government databases are usually run.

It is as follows:

1. nothing ever gets deleted for any reasonable reason.

2. bribes and connections will suffice to delete or include anything

3. even so, it's a slow-as-molasses mess that just gets in everyone's way

4. but still it can't be uprooted because budgets won't spend themselves

IDK what UK wants with this shit. As the examples of China and lately Russia show, this just does not work against the savvy, and the rest are adequately blinded with conventional propaganda already, so what's the point?

Right, but what I'm saying is #1 and #2 could easily make any evidence from these databases inadmissible in court. It's a straightforward argument for any lawyer to make.

"Your honor the defendant's self-maintained list of hashes is obviously inadmissible because if authentic, it won't be incriminating, and if tampered with, it must be disregarded. This has no relevance to the hashes independently discovered in his possession, which were found to be on Ofcom's list of illegal hashes."

"Agreed, motion to exclude granted, the case will proceed to trial."

Alright, my bad for not being more concrete. Let me try: "Your honor, the hash 6f5902ac237024bdd0c176cb93063dc4 was found in Ofcom's illegal hash list, which is the MD5 hash for 'hello world' all lowercase. 'hello world' is obviously not illegal. Someone must have found a way to put it in there, perhaps maliciously, perhaps by accident, perhaps due to a bribe [per the parent comment], perhaps as an act of protest. Ether way, it proves not every hash in the hash dump is illegal, and we have no way of knowing whether the legal ones outnumber the illegal ones by 1 to 10, or 10 to 1, or 1 million to 1. Indeed we have good reason to believe malicious actors would want to fill this database up with meaningless hashes as much as possible if any backdoor was found. Therefore evidence from Ofcam's database must be considered inadmissible."

Eh how do you think this hash database would work?

More likely it would be... without you or your lawyer present.."device X owned by person Y had a hash hit register to child pornography, we would like a search warrant for this device"

Judge "granted"

Wishful thinking.

To admit that the stuff is inadmissible is to admit that the whole narrative pushed by very important persons was bullshit and that the resulting budgets were misallocated, and we can't have that, can we?

Edit:

It's like it is with the TSA -- everyone agrees that it's a useless money sink, but there is no way to get rid of it.

The UK state thinks "I have the ability to control X, then it's my duty to control X, for that's the reason I exist." The state probably believes that it is the brain of the nation and the people is its body. From this logic, it follows naturally what the arrangement should be.

The example they provide for false positives is haunting

Reply on news.ycombinator.com