Apple's plan to “think different” about encryption opens a backdoor to your life (eff.org)

You want to not suffer through political memes? And jump to scanning private messages for dissent, by authoritarian governments being okay!?

What?!

But from the looks of his numbers ( https://upload.wikimedia.org/wikipedia/commons/8/83/IRC_top_... ) he's doing a real bang-up job!

Yeah, it's a dependency... as much as the Google Maps APK needing to run on Android itself.

The only slight dowbside is that I haven't figured out how to auto update appd, so your apps will get out of date without you being notified and you have to manually do it. This problem might literally be solved by a simple setting thay I haven't bothered to look for, IDK.

On the plus side it includes all the official play store apps, along side some that aren't allowed by play store.

For examples, Newpipe, the superior replacement YouTube app that isn't allowed on play store due to it subverting advertisements and allowing a few features that are useful for downloading certain things.

Also, the Signal does not give any warnings or indication that chat partner identify is manually verified. Users are supposed to trust Signal and not ask difficult questions

Aside: Signal data never touches iCloud Backup (https://support.signal.org/hc/en-us/articles/360007059752-Ba...). That’s an improvement over a lot of apps.

I shouldn't have to choose between keeping full control over my device and being able to use it to access the modern world.

This is not accurate. Pixels that come from Verizon have bootloaders that cannot be fully unlocked.

Except, uh, GPS. Even for third party navigation apps.

Yes, I know about microG, but the fact that there had to be a third party reimplementation of what should be a standard system API is still a problem.

True but misleading. If you unlock your bootloader, you can no longer use a lot of apps, including Snapchat, Netflix, Pokemon Go, Super Mario Run, Android Pay, and most banking apps. And before you say this isn't Google's fault, know that they provide the SafetyNet API, which has no legitimate, ethical use cases, and is what allows all of the aforementioned apps to detect whether the device has been modified, even if the owner doesn't want that.

If you wanted to do a WSL but for Android, SafetyNet guarantees many apps won't work.

It also puts alternative Linux-based mobile operating systems, like SailfishOS or postmarketOS, at a disadvantage because they won't be able to run certain Android apps for no real technical reason other than the protection of Google's money firehouse.

That is good, but unless a system like this is fully open source and runs only signed code there really aren't many protections against abuse.

It would be easy to extend this to scan for 'wrongthink'.

Next logical steps would be to scan for: confidential government documents, piracy, sensitive items, porn in some countries, LGBT content in countries where it's illegal, etc... (and not just on icloud backed up files, everything)

This could come either via Apple selling this as a product or forced by governments...

That's the irony in this: This move arguably improves privacy by removing the requirement that images be decrypted on the server to run a check against the NCMEC database. While iCloud Photo Library is of course not E2E, in theory images should no longer have to be decrypted anywhere other than on the client under normal circumstances.

And yet – by moving the check to the client, something that was once a clear distinction has been blurred. I entirely understand (and share) the discomfort around what is essentially a surveillance technology now running on hardware I own rather than on a server I connect to, even if it's the exact same software doing the exact same thing.

Objectively, I see the advantage to Apple's client-side approach. Subjectively, I'm not so sure.

Well the obvious response is that these systems don't have to be designed. Child abuse is a convenient red herring to expand surveillance capabilities. Anyone opposing the capability is branded a child molester. This is the oldest trick in the book.

I mean the capability to spy on your kid can easily be used to abuse them. Apple could very well end up making children's lives worse.

This will be the statement they increase the scope the next time.

Hard to imagine that Tim Cook would have scanned Epsteins photos...

Rather than reassuring me, this sounds like an achievable set of steps for an abuser to carry out.

The most annoying thing about Apple Family sharing is that in order to create accounts for people you must specify that they are under 13 (source: https://www.apple.com/lae/family-sharing) - otherwise the only other option is for your "family member" to link their account to the Apple Family which is under your purview, which understandably many people might be hesitant to do because of privacy concerns (as opposed to logging into the child account on a Windows computer exclusively to listen to Apple Music - which doesn't tie the entire machine to that Apple ID as long as it's not a mac).

And so in my case, I have zero actual family members in my Apple Family (they're more interested in my Netflix family account). It begs the question, why does Apple insist on having people be family members in order to share Apple Music? We have five slots to share, and they get our money either way. They also don't let you remove family members - which may be the original intent for insisting on such a ridiculous thing - as if they're trying to take the moral high ground and guilt trip us for disowning a family member when in fact it simply benefits them when a fallout occurs between non-family members, because there's a good chance that the person in question will stop using the service due to privacy concerns, and that's less traffic for Apple.

It's actually kind of humorous to think that I still have my ex-ex-ex-girlfriend in my Apple Family account, and according to Apple she's 11 now (in reality, she's in her 30s). I can't remove her until another 7 years pass (and even then it’s questionable if they’ll allow it, because they might insist that I can’t divorce my “children”). And honestly, at this point I wouldn’t even remove her if I could, she has a newborn baby and a partner now, and I’m happy to provide that account, and I still have two unused slots to give away. I’ve never been the type of person who has a lot of friends, I have a few friends, and one girlfriend at a time. But the thing is she’s never been a music person and I assume that she isn’t even using it - and so even if I made a new best friend or two and reached out to her to let her know that I wanted to add them, Apple currently wouldn’t let me remove her to make room for those theoretical friends. While I'm a big fan of Apple hardware, it really bothers me that a group of sleazy people sat around a table trying to figure out how to maximize income and minimize network traffic, and this is what they came up with.

This is an argument for me to not start using iCloud keychain. If Apple flags my account, I don't want to lose access to literally all my other accounts.

Register your kids with a corporate behemoth! Why not!? Get them hooked on Apple right from childhood, get their entire life in iCloud, and see if they'll ever break out of the walled garden.

Also, a father would only land in a national registry of their child’s photos are known to be CSAM. Simply taking a photo of your child wouldn’t trigger it.

This seems fine as it's (a) being done on iCloud-uploaded photos and (b) replacing a server-side function with a client-side one. If Apple were doing this to locally-stored photos on iCloud-disconnected devices, it would be nuts. Once the tool is built, expanding the database to include any number of other hashes is a much shorter leap than compelling Apple to build the tool.

> it seems easy enough to clear that one up

Would it be? One would be starting from the point of a documented suspicion of possession of child pornography.

"But it only impacts iCloud Photos". Valid! So why not run the scanner in iCloud and not on MY PHONE that I paid OVER A THOUSAND DOLLARS for? Because of end-to-end encryption. Apple wants to have their cake and eat it too. They can say they have E2EE, but also give users no way to opt-out of code, running on 100% of the "end" devices in that "end-to-end encryption" system, which subverts the E2EE. A beautiful little system they've created. "E2EE" means different things on Apple devices, for sure!

And you're ignoring (or didn't read) the central, valid point of the EFF article: Maybe you can justify this in the US. Most countries are far, far worse than the US when it comes to privacy and human rights. The technology exists. The policy has been drafted and enacted; Apple is now alright with subverting E2EE. We start with hashes of images of child exploitation. What's next? Tank man in China? Photos of naked adult women, in conservative parts of the world? A meme criticizing your country's leader? I want to believe that Apple will, AT LEAST, stop at child exploitation, but Apple has already estroyed the faith I held in them, only yesterday, in their fight for privacy as a right.

This isn't an issue you can hold a middleground position on. Encryption doesn't only kinda-sorta work in a half-ass implementation; it doesn't work at all.

I prefer not having my door busted in at 6 am and my dog shot in the head because of a hash collision

  -if (photo.isCloudSynced && scanForIllegalContent(photo)){
  +if (photo.isCloudSynced & scanForIllegalContent(photo)) {
       reportUserToPolice();
   }

Then there is tumblr, which is all but dead - explicitly for a "think of the children" concern from apple.

Imagine if you were a Czech child who was old enough to read but not old enough to disassociate the locality of the spellings... that would be odd.

My physical device, on the other hand, is (supposed to be) mine and mine alone.

Some people might disagree with you.

There are people out there who are revolted by the "obviously okay" case of 2 fully-consenting teenagers sending each other nude pics, without any coercion, social pressure, etc.

Not to mention all the gray areas and "obviously not okay" combinations of ages, circumstances, number of people involved, etc.

I know several parents in just my extended circle alone that would welcome the feature, so... I just don't think I agree with this statement. These parents already resort to other methods to try and monitor their kids but it's increasingly (or already) impossible to do so.

I suppose we should also take issue with Apple letting parents watch their kids location...?

If someone sends nude pics there is still no way to tell that it's a nude pic.

I suspect a lot of how people feel about this will come down to whether they have kids or not.

1. I reserve the right to change my mind as things are revealed/developed.

Current society is pushing a lot of adult behavior into kids, and they don’t always understand the consequences of their actions.

Parents can’t inform their kids if they aren’t aware.

Furthermore, if Apple is deliberately, by design resending them to additional people beyond the addressee, as a feature it markets to the people that will be receiving them, that seems to...raise problematic issues.

Anyway, that wasn't my stated position. I simply pointed out that this is done for a subset of users (where there's already existing reasons to do so, sub-13 and all) and that on syncing to iCloud this _already happens anyway_.

I would gladly take this if it removes a barrier to making iCloud E2E encrypted; they are likely bound to do this type of detection, but doing it client-side before syncing feels like a sane way to do it.

So I would ask US Lawmakers why cannot the phone companies make the same commitments? As the reason seems to be we have bad people doing crime using digital communication devices.

Last time I checked the digital pipeline ie phone lines is still under FFC rules is it not?

If they answer that its to hard tech wise then why cannot Apple make the same argument ot law makers?

This handles that client-side instead of server side, and if you don't use iCloud photos, it doesn't even affect you. If syncing? Sure, decrypt it on device and check it before uploading - it's going to their servers after all.

Don't want to even go near this? Don't use Message or iCloud, I guess. Very possible to use iOS/iDevices in a contained manner.

It runs only on a subset of situations, as previously noted - and I would be _shocked_ if this used more battery than half the crap running on devices today.

Do you complain that Apple runs code to find moments in photos to present to you periodically...?

How is this situation different from an oppressive government "asking" (which is a weird way we now use to describe compliance with laws/regulations) for this sort of scanning in the future?

Apple's legal liability and social concerns would remain the same. So would the concerns of people under the regime. Presumably the same level of notification and ability of people to fight this new regulation would also be present in both cases.

Also, how is this feature worse than other providers which already do this sort of scanning on the other side of the client/server divide? Presumably Apple does it this way so that the photos remain encrypted on the server, and release of data encryption keys is a controlled/auditable event.

You would think the EFF would understand that you can't use technical measures to either fully enforce or successfully defeat regulatory measures.

The only thing I'm going to respond to otherwise is this:

>Fourth, but that's only because I slightly am a maniac, how can anyone unilaterally decide to waste the computing power, battery life and data plan of a device I paid for without my say so? (probably one of my main gripes with ads)

This is how iOS and apps in general work - you don't really control the amount of data you're using, and you never did. Downloading a changeset of a hash database is not a big deal; I'd wager you get more push notifications with data payloads in a day than this would be.

Battery life... I've never found Apple's on-device approaches to be the culprit of battery issues for my devices.

I think I'd add to your list of points: what happens when Google inevitably copies this in six months? There really is no competing platform that comes close.

You can be certain what Apple's scanning is going to be used for is going to widen over time. That's one of the few obvious certainties with this. These things are a Nixonian wet dream. The next Trump type might not be so politically ineffectual; more likely that person will be part of the system and understand how to abuse & leverage it to their advantage by complying with it rather than threatening its power as an outsider. Trump had that opportunity, to give the system what it wanted, he was too obtuse and rigid, to understand he had to adapt or the machine would grind him up (once he started removing the military aparatus that was surrounding him, like Kelly and Mattis, it was obvious he would never be allowed to win a second term; you can't keep that office while being set against all of the military industrial complex including the intelligence community, it'll trip you up on purpose at every step).

The US keeps getting more authoritarian over time. As the government gets larger and more invasive, reaching ever deeper into our lives, that trend will continue. One of the great, foolish mistakes that people make about the US is thinking it can be soft and cuddly like Finland. Nations and their governments are a product of their culture. So that's not what you're going to get if you make the government in the US omnipotent. You're going to get either violent Latin American Socialism (left becomes dominant) or violent European Fascism (right becomes dominant). There's some kind of absurd thinking that Trump was right-wing, as in anti-government or libertarian; Trump is a proponent of big government, just as Bush was, that's why they had no qualms about spending like crazy (look at the vast expansion of the government under Bush); what they are is the forerunners to fascism (which is part of what their corporatism is), they're right wingers that love big government, a super dangerous cocktail. It facilitates a chain of enabling over decades; they open up pandora boxes and hand power to the next authoritarian. Keep doing that and eventually you're going to get a really bad outcome (Erdogan, Chavez, Putin, etc) and that new leadership will have extraordinary tools of suppression.

Supposed political extremists are more likely to be the real target of what Apple is doing. Just as is the case with social media targeting & censoring those people. The entrenched power base has zero interest in change, you can see that in their reaction to both Trump and Sanders. Their interest is in maintaining their power, what they've built up in the post WW2 era. Trump and Sanders, in their own ways, both threatened what they constructed. Trump's chaos threatened their built-up system, so the globalists in DC are fighting back, they're going to target what they perceive as domestic threats to their system, via their new War on Domestic Terrorism (which will actually be a domestic war on anyone that threatens their agenda). Their goal is to put systems in place to ensure another outsider, anyone outside of their system, can never win the Presidency (they don't care about left/right, that's a delusion for the voting class to concern themselves about; the people that run DC across decades only care if the left/right winner complies with their agenda; that's why the Obamas and Clintons are able to be so friendly with the Bushes (what Bush did during his Presidency,...

This stirs up all sorts of questions about location and the prevailing standards in the jurisdiction you're in. Does the set of hashes used to scan change if you cross an international border? Is the set locked to whichever country you activate the phone in? This could be a travel nightmare.

it's only in the US. not in Europe or ROW.

Apple has shown that they prefer pushing things to be done on-device, and in general I think they've shown it to be a better approach.

If you don't want to use cloud photo services because you don't like the implications, they are very upfront; disable iCloud photos. But every major cloud photo hosting service is doing this already on your images.

What you are missing is the behind the scenes pressure for DOJ, FBI and congress. Apple is trying their best to thread the needle, providing as much privacy as possible while plausibly covering their bases so congress won't pass onerous and privacy stripping laws.

Anyway, it's not surprising to me that Apple is not living up to its lofty rhetoric around privacy.

Whew! I was worried there for a minute. Maybe for extra safety I could say "SIRI I DISAVOW OF THIS MESSAGE!"??

Ie unless you're replying to purely the swatting part, the article seems to support this. Specifically a prediction that governments will creep on legally requiring Apple to push custom classifiers:

> Apple’s changes would enable such screening, takedown, and reporting in its end-to-end messaging. The abuse cases are easy to imagine: governments that outlaw homosexuality might require the classifier to be trained to restrict apparent LGBTQ+ content, or an authoritarian regime might demand the classifier be able to spot popular satirical images or protest flyers.

> This feature can be turned on or off by parents.

This is technically possible now but requires you to actually have access to seriously illegal material. A feasible collision process would make it a lot easier for someone to avoid having something which could directly result in a jail sentence.

Yet. The point is the new system makes it feasible.

Or so they say? Did you see the source code?

Anyway that's not the issue.

The issue is what they are going to do next without telling you.

The issue is installation of spyware engine, not it's current usage.

How many people in the world can certify that it only contains CSAM? I wonder if there are images of US troops committing warcrimes, or politicians doing cocaine, or honeypot intel op blackmail images in there too. Lots of powerful people would love to have an early warning system for leaks of embarrassing non-CSAM images.

How do we know it hasn't? Maybe the people who have seen these situations have received to national security letters that claim to prevent them from even talking to a lawyer about the non-CSAM classified images they've seen in the course of the investigation?

Yes, of course, it's "unsubstantiated speculation", but how do you suppose the speculation be substantiated if the entire process and database are not available for audit? That's exactly the problem with this.

Also, I pay for iCloud... but they're not paying me for using my phone and bandwidth. I never agreed to that.

They can't just pull the rug out from me after we already have an agreement. I mean they can, because I probably "agreed" to it and some fine print garbage EULA, but those fall apart in a court of law.

> it looks like the thin end of a wedge, it sucks and I'm not happy about it.

But you just said that you can disable it. So, you can be upset about a possible future but I'm the one being melodramatic? That's a good one! You chose to run the OS. So by your logic that gives you no right to complain either.

I do understand that I can disable iCloud for my photos and I will do that. We'll see how long that lasts until they decide to tie the next feature and the next one and the next one to something that I don't like. Because that's how this works. Every time they do something that they know people won't like, they simply make it so that you lose access to something else if you decide to stand up for your principles.

I understand why this shielding is necessary for the system to work. My point is the crypto is being used to protect law enforcement, not the user.

Is this a legal obligation for all countries that iPhones operate in? I wasn't able to find a law via a quick google search for the US.

For US law, are there protections for people that report the contraband? I'm not sure if good samaritan or whistle blower laws protect you.