Comment by teitoklien | Hacker News Reader

Comment by teitoklien | Hacker News Reader

Parent Full thread

Hash collisions dont need grey images You can take a perfectly normal image , play around with a range of its individual pixels, to get collisions too.

So someone might forward you your personal pics from your meeting with them and its pixels might get edited by the messenger app you use to save the picture into your photos to specifically collide its hash with a csam image, while to you the image will look perfectly normal

This is one example , lets say you 100% trust every developer of every app that you download on apple’s phone.

Fine, but that’s already a lot of trust on a lot of people about something that can ruin your life.

Do you now trust every single image which might get auto downloaded to your gallery by a malicious actor , what if a random anon person messages you with 100 such colliding images , enough to cross threshold to get the authorities knocking your door ,

Is this “feature” really worth it , to have the inconvenience of authorities knocking your door and going through legal trouble ?

For an iphone ?

> So someone might forward you your personal pics from your meeting with them and its pixels might get edited by the messenger app you use to save the picture into your photos to specifically collide its hash with a csam image, while to you the image will look perfectly normal

Ok, but then that image is already not private, if I've been sending it to someone that could do that.

> This is one example , lets say you 100% trust every developer of every app that you download on apple’s phone.

I don't have to, they have to ask me before storing images in my photo library. I'm not going to give some fart generator app access to my library.

> Do you now trust every single image which might get auto downloaded to your gallery by a malicious actor , what if a random anon person messages you with 100 such colliding images , enough to cross threshold to get the authorities knocking your door

Beyond the fact that nothing writes images to my library automatically. If they sent me 100 images that are grey blobs or slightly manipulated normal images they dont get past the check anyway so no police. If they send me 100 CSAM images I'll be on the phone to the police anyway.

Great on you , But i dont see my parents disabling the auto feature , nor do my friends.

Youre right indeed , you can protect yourself from this , but all the measures you mentioned are settings which are non-default,

A lot of apps annoyingly turn it on by default , while HN users can turn it off , I doubt my grandparents will go through the same effort or understand it.

Question is , why should they ? Their phone was supposed to help them , not be a snitch and a snitch with flaws at that.

Why should my non-tech friends train to protect themselves from “their” phones.

Human society has always tried to place co-existence and trust on their fore frontier , their ideal wish for society.

This makes us and our devices act as snitches to each other.

Snitch for whom ? Apple ?

But yes youre right , that if its normal image it will stop at review level , (altho thats on the condition you trust apple employees who are reviewing them)

I just still dont think its a good idea to even reach till this step.

This just makes our computers feel more hostile

Ok so your fear is someone will target your grandparents with child porn?

If this was such a major problem why has no-one been targeted like this in the last decade when everyone else was scanning for it?

Here’s an example of exactly that

https://news.ycombinator.com/item?id=28221907

It's not an example though. Putting aside a lack of news report we'll assume it's true, it's got nothing to do with cloud scanning for images. A picture of someones children wouldn't trigger these systems at all.

> its got nothing to do with cloud scanning for images

Everyone else are cloud services scanning for images , cloud or on-device wont change the math, math stays same and here the math makes mistake

> A picture of someone’s children wouldn’t trigger these systems at all

The main post under which we are conversing , is about someone having generated a collision to trigger this system.

I feel we're circling the same issues here so I'll leave it after this. But what you're saying is the point I'm making, many clouds have been doing this for a decade and we've not seen the issues you're worried about. The one example you gave was a photo tech, so human developing photos, making a mistake. Not someone being targeted with material that would trigger google photos or Facebook to flag them, not algorithms making mistakes with photos of someones kids, none of it.

The post we're commenting under has created hash collisions with grey blob images, if you get 100 of these they won't get past the review step anyway. It'd be a pointless attack.

Like most of the outrage around this system it mostly seems to boil down to FUD.

Reply on news.ycombinator.com