Apple

They just launched a whole ad campaign based around imessages encryption as well... not supporting would be a bad look and a waste of ad dollars

Yep. Honestly, if there's a good profit motive to do the right thing, I trust companies far more to actually do the right thing. We WANT there to be profit in doing the right thing. When there isn't, they don't.

It depends on the type of hash. For the type of hashing used by checksums, a single byte is enough, because they're cryptographic hashes, and the intent is to identify whether files are exact matches.

However, the type of hashing used for CSAM is called a semantic hash. The intent of this type of hash is that similar content results in a similar (or identical) output. I can't walk you through exactly how the hash is done, but it is designed specifically so that minor alterations do not prevent identification.

That's a good question. First it's important to understand that hash functions for pirated games or other programs are actually different from hash functions used to detect media like pictures, movies, and sound recordings.

If you alter a piece of code or text from the original version the hashes will no longer match, but typically those hashes should match and some kind of alarm gets tripped if they don't.

With media files like music, movies, or pictures, it works the other way around. Detection tools are looking for something that is not necessarily an exact match, but a very close match, and when such a match is found, alarms get tripped (because it's CSAM, or a copyright violation, or something like that).

As to the techniques you mentioned for concealing a pirated game in a ZIP file with a bunch of junk TXT files, that's not going to work. The reason it doesn't work is that if you ZIP something, all that uses compression algorithms that change the contents of the ZIP file in predictable repeating patterns. It's easy to detect and compensate for. Now, if you use your ZIP/compression tool to actually encrypt the file with a good algorithm and a strong password, that's different, but then you don't need to pack it with junk. (And distributing the password securely will be a problem.)

Please, people who know more about hashing and media detection with hashing, let me know if I got something wrong, I probably did.

It’s on Apple’s website. Here’s the link: https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf

Yeah but his point stands. Here’s the summary:

• If you’re syncing iMessages via iCloud but don’t use iCloud backup without Advanced Data Protection, it’s E2E
• If you have iCloud backup enabled without Advanced Data Protection enabled, iMessage isn’t E2E encrypted
• If you have Advanced Data Protection turned on for iCloud and you’re using iCloud backup, iMessage is E2E encrypted however you look at it.

It’s generally good practice to not use iCloud backups but rather back it up yourself, however, most people don’t care enough.

It’s generally a question about what’s best for the user, your general user would likely be more mad losing all their messages because they forgot their password then they are calmed by the fact that no one else can read the data. Same for photos and files, however for sensitive categories such as health and passwords they are always end to end encrypted as it’s determined it’s worse for anyone else to get that data then it is for the user to lose it.

For anyone that truly cares to have complete encryption there is advanced data protection but for the general users the defaults are a good balance between security and ease of use.

Except “less bad” is better than bad when you have 2 choices. I’d love to know where apple had blown it on their privacy record. And don’t try to bring up the CSAM shit because they walked back on that when they realized their userbase didn’t want it.