Facebook's Former Security Chief Discusses Controversy Around Apple's Planned Child Safety Features

[Apple_Robert]

iMessage isn’t a social media platform…. It doesn’t need a report function.

“I also don't understand why Apple is pushing the CSAM scanning for iCloud into the device, unless it is in preparation for real encryption of iCloud backups.”

Bingo, in my opinion.

In preparation? Apple could have already encrypted iCloud without this new feature being in place.

Truly end to end encryption is wishful thinking. I don't think Apple is going to give up it's current access to user data in the cloud.

 

[LovePeace]

The future of personal computing devices looks bleak. Enjoy your iOS 9 device while it still works

Yes! Completely agree

 

[huge_apple_fangirl]

You do what you want, but it’s the closest thing the US government (and/or FCACSE) is going to let you get to end to end encryption for cloud photo storage, at least with a large company like Apple (or Google, Microsoft, etc.)

You could also just turn off iCloud photos, which seems way more reasonable.

Turning off iCloud Photos won't change the fact that these hashes are being included at the OS level. Currently they only detect CSAM, and only inform Apple/police once the photos are uploaded to iCloud. There is nothing stopping Apple making changes in the future so the hashes are for more than CSAM, or so that they report people without being uploaded to iCloud. Before, if you stored your photos in iCloud, they were unencrypted and could be checked for content. That's not ideal, but at least you could be assured that your own device's storage was secure. Now Apple is including what essentially amounts to OS level spyware in iPhones, and the only thing holding them back from letting it be abused is "we will refuse". If the FBI wouldn't let Apple encrypt iCloud, and they complied, what makes anyone think they will be able to "refuse" the next PRISM program? Frankly, the fact that Apple is even releasing a noxious "feature" like this should raise deep questions about their trustworthiness.

 

[Max Webb]

Stamos highlighted that Facebook caught 4.5 million users posting child abuse images

This is the real tragedy. That there is so many who commit this act... this is beyond disgusting, beyond human. What has our human race become, sick and twisted.

We need to root out these evil people and use capital punishment for offenders. We need to do more and I support Apple for doing that. Snowdon is probably a nonce he lives on the dark web, prob into weird **** which is why he is so against this. If you have nothing to hide then you should not be afraid.

 

[keithdoc]

He brings up a valid point that I’ve been asking. If the local photos library on the device is identical to the iCloud Photo Library (they should be if you are using photos in the cloud), why is there anything happening on the device side to begin with? They probably (hopefully) already scan user’s photos on their own servers for CSAM. Why break the user’s trust and do it on the client side as well?

The automatic filtering of explicit photos for kids with parental controls is a good idea though.

How else are you going to get curated moments, searchable photos, image recognition, PRIVATELY, from your own photos, if not implemented client side?

We bitch about how poorly Siri executes. That's because she's walled off and locked down.
I EXPECT/hope/pray same type of thing is going on here (walled garden) and part of bigger picture of privacy protection.

Agree that Apple has stood up to privacy challenges better than others.

AS a parent, I'm very much in favor of how this is supposed to work within messages when sending (or receiving) a picture with questionable content. I'd prefer a bit more discretion in the age, but I'm not complaining. Let's keep an open mind and a watchful eye.

 

[turbineseaplane]

How else are you going to get curated moments, searchable photos, image recognition, PRIVATELY, from your own photos, if not implemented client side?

None of that is running comparisons of your on device content against a third party external database (one that is opaque to Apple itself by the way )

 

[keithdoc]

Turning off iCloud Photos won't change the fact that these hashes are being included at the OS level. Currently they only detect CSAM, and only inform Apple/police once the photos are uploaded to iCloud. There is nothing stopping Apple making changes in the future so the hashes are for more than CSAM, or so that they report people without being uploaded to iCloud. Before, if you stored your photos in iCloud, they were unencrypted and could be checked for content. That's not ideal, but at least you could be assured that your own device's storage was secure. Now Apple is including what essentially amounts to OS level spyware in iPhones, and the only thing holding them back from letting it be abused is "we will refuse". If the FBI wouldn't let Apple encrypt iCloud, and they complied, what makes anyone think they will be able to "refuse" the next PRISM program? Frankly, the fact that Apple is even releasing a noxious "feature" like this should raise deep questions about their trustworthiness.

That was my first concern as well. You're right, it's a slippery slope. We're not naive or paranoid.
Sure they caved to FBI, and they can't say no forever . . . but they can create something that is minimally intrusive, can be bypassed, and provides some protections for the future.

They could have handled the messaging / delivery better.

From my perspective Apple has consistently put consumer privacy at the forethought of their design / implementations for the past 15-20 years.

Lets hope they keep the course!

 

[0924487]

Obviously Stamos doesn’t actually use iMessage, Yes there is a mechanism to report spam within iMessage, Many times I have marked a particular iMessage as spam, And when Apple receives enough reports they block that particular iCloud account.

There is not one for “hate speech” as he mentioned also. That SPAM is for ads.

 

[0924487]

But you can opt out of it and turn it off. Isn't that win-win?

It should be opt-in with cool-down period with double opt-in confirmation.

 

[Philip_S]

But you can opt out of it and turn it off. Isn't that win-win?

You can, but you’d lose features you have now. It’s not a problem for me as
I don’t use it anyway, but if I did I’d be annoyed.

 

[huge_apple_fangirl]

You can, but you’d lose features you have now. It’s not a problem for me as
I don’t use it anyway, but if I did I’d be annoyed.

You can't opt out of spyware that's included as part of the OS. There is no option to NOT download the hashes and NOT have scans. You can disable iCloud, which means Apple won't see the photos- for now. There's nothing stopping Apple technologically speaking, from making this feature work without iCloud in the future. The groundwork is all there.

 

[thefourthpope]

If you read the story, the fact he left and why might answer your question.

My post was more about agreeing with the idea that someone could both care about security and have a prior relationship with Facebook.

The MR article doesn’t specify his reasons for leaving and it’s true I haven’t bothered reading all of the 10+ links. Maybe you’d like to enlighten me if I’m wrong in my general assessment?

 

[Philip_S]

You can't opt out of spyware that's included as part of the OS. There is no option to NOT download the hashes and NOT have scans. You can disable iCloud, which means Apple won't see the photos- for now. There's nothing stopping Apple technologically speaking, from making this feature work without iCloud in the future. The groundwork is all there.

Yes, and I’m against it for that reason, but they have now claimed that it only runs if you have iCloud photos turned on.

 

[George Dawes]

Another option is NOT allowing kids under say 12 access to iphones , or is that just too much like common sense ?

What on earth does a 10 year old need an iPhone for anyway ??

 

[huge_apple_fangirl]

Yes, and I’m against it for that reason, but they have now claimed that it only runs if you have iCloud photos turned on.

Currently. But it still runs locally, and the technology is included regardless of whether you use iCloud, and could be used without it at a later day. And frankly, if I do want to use iCloud I shouldn’t have to contend with my phone becoming a surveillance device. What Apple scans in their servers is in them, but my iPhone should never be involved.

 

[expectdelay]

... Facebook's former security chief, Alex Stamos,

Um, yeah no thanks.

 

[expectdelay]

Wow, it's like a mini cancel-culture starting to form here... "he's from Facebook so his views should be mocked with a snide comment and disregarded"... you learn by listening, not by shutting down conversations.

People also choose which conversations to engage in, since they cannot physically engage in every single one. And since FB is a dumpster fire of racism, sexism and child porn, and has a track record full of poor choices re: security, they are making an informed decision to maybe get better security related information from someone else. That's not "cancel culture", that is logical informed decision making.

 

[ouimetnick]

How else are you going to get curated moments, searchable photos, image recognition, PRIVATELY, from your own photos, if not implemented client side?

We bitch about how poorly Siri executes. That's because she's walled off and locked down.
I EXPECT/hope/pray same type of thing is going on here (walled garden) and part of bigger picture of privacy protection.

Agree that Apple has stood up to privacy challenges better than others.

AS a parent, I'm very much in favor of how this is supposed to work within messages when sending (or receiving) a picture with questionable content. I'd prefer a bit more discretion in the age, but I'm not complaining. Let's keep an open mind and a watchful eye.

Those curated moments are from AI done on device that doesn’t involve internet connection. The CSAM check matching does.

Still excited to upgrade to iOS 15 for FaceTime upgrades though.