HNHacker News
TopNewBestAskShowJobs

fortenforge

769 karma · joined March 12, 2015

submissionscomments
fortenforge··on The deceptive PR behind Apple’s “expanded protections for children”
Apple has stated point-blank that the only source of CSAM content to generate the hash list will be NCMEC and other child safety organizations.

While I fully admit that NCMEC could do a better job with transparency and auditing, they are currently being used by several other platforms right now (Facebook, Google, Microsoft) without issue.

Could bad actors inject hashes of non-CSAM content into the database somehow? Well even if they could do this, Apple employes human reviewers who must visually confirm that the flagged photo contains actual CSAM before they report the image. If the image does not contain CSAM, Apple is under no legal obligation to report it.

More information here: https://twitter.com/AlexMartin/status/1424703642913935374/ph...

fortenforge··on The deceptive PR behind Apple’s “expanded protections for children”
Apple previously stored photo backups in their cloud in cleartext. The door was always open. At some point if you are providing your personal images for Apple to store, you have to exercise a modicum of trust in the company. If you don't trust Apple, I suggest you don't use an iPhone.
fortenforge··on The deceptive PR behind Apple’s “expanded protections for children”
There are numerous incorrect statements in your comment.

First: Apple has disclosed who gets to curate the hash list. The answer is NCMEC and other child safety organizations. https://twitter.com/AlexMartin/status/1424703642913935374/ph...

Apple states point-blank that they will refuse any demands to add non-CSAM content to the lists.

Second: Why can't the FBI / CCCP inject a hash into the list. Here's a tweet thread gamifying that scenario: https://twitter.com/pwnallthethings/status/14248736290037022...

The short answer is that at some point an Apple employee must visually review the flagged photo, and confirm that it does represent CSAM content. If it does not, then Apple is under no legal obligation to report it.

Third: You claim that abusers will simply opt not to use iPhones to distribute their CSAM content rendering the feature useless. This is in fact not how things have played out on other platforms like Google and Facebook that do already scan for CSAM. These organizations report on the order of millions of flagged images per year. [1] Clearly the abusers have simply not moved on to a different platform.

[1] https://www.businessinsider.com/facebook-instagram-report-20...

fortenforge··on The deceptive PR behind Apple’s “expanded protections for children”
These illegal photos are not trivial to obtain. Possessing (and here, the printing step necessitates possession) these illegal photos is in and of itself a crime in most relevant jurisdictions.

But OK, let's say that you've found a way to get the photos and you're comfortable with the criminal implications of that. At that point why don't you just hide the printed photos in your coworker's desk? My point is that if you have a disgruntled coworker who's willing to resort to heinous crimes in order to screw you over, there's many different things they could do that are less convoluted.

fortenforge··on The deceptive PR behind Apple’s “expanded protections for children”
It's a good question. The only explanation that makes sense is that this now allows them to begin end-to-end encryption of iCloud photos. I see that many commentators are claiming that they could already have started e2e encryption without introducing this "backdoor." While this is true, Apple would then be creating a perfect environment for child abusers to house their CSAM content on Apple's own servers. You can understand why Apple might not want to do that.

This allows Apple to get to what is in their mind the best of both worlds: a truly private cloud for their valued users while not creating a safe haven for child abusers.

fortenforge··on The deceptive PR behind Apple’s “expanded protections for children”
Lots of people responding to this seem to not understand how perceptual hashing / PhotoDNA works. It's true that they're not cryptographic hashes, but the false positive rate is vanishingly small. Apple claims it's 1 in a trillion [1], but suppose that you don't believe them. Google and Facebook and Microsoft are all using PhotoDNA (or equivalent perceptual hashing schemes) right now. Have you heard of some massive issue with false positives?

The fact of the matter is that unless you possess a photo that exists in the NCMEC database, your photos simply will not be flagged to Apple. Photos of your own kids won't trigger it, nude photos of adults won't trigger it; only photos of already known CSAM content will trigger (and that too, Apple requires a specific threshold of matches before a report is triggered).

[1] "The threshold is selected to provide an extremely low (1 in 1 trillion) probability of incorrectly flagging a given account." Page 4 of https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...

fortenforge··on “Older unlisted videos will be made private unless you opt out”
yes
fortenforge··on Lina Khan, Big Tech Critic, Will Lead the FTC
What? The whole point of "Amazon's Antitrust Paradox" is that we should abandon the "consumer welfare" standard. Meaning that we should gut Amazon even though it provides enormous benefits to consumers in the form of low prices. Lina Khan may represent the interests of Amazon's competitors, but she certainly doesn't represent the interests of consumers.
fortenforge··on Nassim Taleb vs. Nate Silver: who is right about election forecasting?
> I believe Nate Silver is answering a subtly different question with his election forecasts. Each data point that Silver produces is answering the question: if the election were to happen today, what is the probability of each candidate winning?

As others have pointed out, this is definitely not what Nate's model was doing. In fact, he did have a version of the model that did exactly this, the so called "Now-Cast" and as expected it was even more volatile than the real model:

https://projects.fivethirtyeight.com/2016-election-forecast/...

fortenforge··on DKIM: Show Your Privates
Of course, this scheme only works if the leaked emails are published at least 10 days after the day the email was sent. If we build non-repudiation into the DKIM framework itself we can do better, as this paper does.

https://www.mit.edu/~specter/assets/pdf/sec21KF.pdf

fortenforge··on Vitamin D, part 3 – The Evidence
It's interesting that you mention Vitamin C! Do you know many people who take Vitamin C supplements? Did you know that Vitamin C had its own supplementation hype cycle in the 70s and 80s? It's out of fashion now, mostly because people understand now that it's not a miracle drug. I suspect the same thing will happen with Vitamin D.

TFA isn't saying that you don't need vitamin D, or that it can't be used to treat Ricketts or osteomalacia (which, like scurvy, are relatively rare conditions). It's simply saying that widespread supplementation on people who have normal levels or minor deficiencies isn't supported by the evidence.

fortenforge··on OneLook – Dictionary Search with Wildcards
Do you see spikes in usage during large puzzlehunt events?
fortenforge··on How does the Gmail unsubscribe button work?
This used to be the case but was fixed earlier this year. You can now disable images in the Gmail iOS app: https://support.google.com/mail/answer/145919?co=GENIE.Platf...
fortenforge··on Andrew Yang’s math on the robot takeover doesn’t check out
This article was published prior to Bloomberg's candidacy announcement.
fortenforge··on Banks, Arbitrary Password Restrictions and Why They Don't Matter
How on earth is that relevant? Equifax's breach had nothing to do with password authentication whatsoever.
fortenforge··on Robinhood Stored Passwords in Plaintext
If you hash the password on the client, then the hash essentially becomes the new password and you haven't solved anything. What you're looking for is a password authenticated key agreement in which one party authenticates to another without an eavesdropper learning any secret [1]. For whatever reason, no major websites use PAKEs today.

[1] https://blog.cryptographyengineering.com/2018/10/19/lets-tal...

fortenforge··on Belgian programmer solves MIT’s 20-year-old time capsule cryptographic puzzle
It seems like no one has answered your question so I'll give it my best shot.

We want to find the value of 2^(2^t) mod n where n = pq. It's a well known number-theoretic fact that 2^phi(n) mod n = 1, where phi is the Euler totient function (https://en.wikipedia.org/wiki/Euler%27s_totient_function).

This theorem is called Euler's theorem (https://en.wikipedia.org/wiki/Euler%27s_theorem). For n = pq, phi(n) = (p-1)(q-1)

So if 2^phi(n) = 1, then 2^(2 * phi(n)) = 1 and 2^(3 * phi(n)) = 1 and so on, so we really only need to know the value of 2^t mod phi(n). We can compute this value in O(log(t)) operations via repeated squaring, and once we know this value (let's call it k), then we just need to compute 2^k mod n to finish, which again, can be done quickly using repeated squaring.

Here's a quick demo in python:

  $ python
  >>> p = 8721676787107355947610787701585837629266743108012786178142468507932506290346645194233003705268505408163930982434418938387386290453411395078603729114734341
  >>> q = 8903989072246145056499086678843460912573461209473391355874543630090691433843393509873230695095738299681258115825746186699033768361727241007153178256782969
  >>> n = p * q
  >>> phi = (p - 1)*(q - 1)
  >>> t = 1000
  >>> x = 2
  >>> for _ in range(t):
  ...     x = (x*x) % n
  ... 
  >>> x
  71836162857086924742436011377120654460634075903529962708552402169419490230741381078707287421912274480993140536800209014695404113617083557073377609336198536584108952782855884250603887258689220754542881131492565231964253742236040236745851352559544932355488898852071685626631281275266638607487563485757328752568L
  >>> k = pow(2, t, phi)
  >>> y = pow(2, k, n)
  >>> y
  71836162857086924742436011377120654460634075903529962708552402169419490230741381078707287421912274480993140536800209014695404113617083557073377609336198536584108952782855884250603887258689220754542881131492565231964253742236040236745851352559544932355488898852071685626631281275266638607487563485757328752568L
  >>> x == y
  True
  >>>
The key here (as in the RSA cryptosystem) is that we have no way of computing phi(n) without knowing the factorization of n.
fortenforge··on Malware researcher Marcus Hutchins, known as ’MalwareTech’, pleads guilty
He's also posted a statement on his website admitting to the crime. https://www.malwaretech.com/public-statement
fortenforge··on Hacking Google ReCAPTCHA v3 Using Reinforcement Learning
this is ReCAPTCHA v3 which does not include any of the image recognition tasks. It's just a matter of clicking the checkbox
fortenforge··on Elizabeth Warren Proposes Breaking Up Tech Giants Like Amazon
The FTC looked into the same issue and ruled in 2013 that Google did not violate US antitrust laws: https://www.ftc.gov/sites/default/files/documents/public_sta...
fortenforge··on You Do Not Need Blockchain: Popular Use Cases and Why They Do Not Work
You probably want to read https://www.blockcerts.org/guide/
fortenforge··on Facebook to integrate the infrastructure for WhatsApp, Instagram and Messenger
What application would you say has "real" e2e encryption? Signal and all the other apps have exactly the same problem right? If you don't compare your keys offline, you're always at risk for this attack. You can't build cryptography out of sand.
fortenforge··on Strongest opponents of GM foods know the least but think they know the most
Could you explain why you feel that genetically modifying crops to be pesticide resistant is a problem?
fortenforge··on Ask HN: Best things in your bash_profile/aliases?

  alias search='set -f;search';search() { find . ${2:+-name "$2"} -type f -print0 | xargs -0 grep --color=auto "$1"; }

Recursively searches the files in the current directory for string matches. You can optionally provide a second glob argument to restrict what files to search. This is basically a dumber version of ack-grep, but I wrote it before I learned about ack.
fortenforge··on NSA to Release Their Reverse Engineering Framework GHIDRA to Public at RSA
Surely you can see how something that combines the best of both worlds (FOSS like r2 and feature-rich / has a working decompiler like IDA / binja) would be of interest to people right?
fortenforge··on Food Scientists Are Getting Fed Up with Picky Eaters
What exactly is the benefit of replacing Red #40 with red cabbage extract?
fortenforge··on Google has been letting app developers read users’ Gmail
The part that you're missing is that you can't just "click through" a permissions request since it explicitly would include the line "This app can read all your emails". https://1.bp.blogspot.com/-DiGeWx5UEVQ/WzswMQ9VV1I/AAAAAAAAx...
fortenforge··on Understanding Ethereum Smart Contracts
> Bitcoin transactions are pretty simple in what they do. You can do one single thing. One type of transaction. Skipping some details, it all boils down to TO (who is receiving money), FROM (who is sending money) and AMOUNT (how much money). This let’s bitcoin be a store of value with the capability to transfer the value between participants in the network.

Doesn't Bitcoin script allow you to do far more complex things than just send btc from person A to person B?

fortenforge··on My Google job was tedious and pointless
The Washington Post is not owned by Amazon. It is owned by Jeff Bezos, who also is CEO of Amazon.
fortenforge··on Building a tiny blockchain
Because the "difficulty" rate (essentially the number of leading 0's needed for the proof of work) can change dynamically, the longest chain is not always the chain with the most work.
← PreviousPage 2 of 3Next →