Security Threat Model Review of the Apple Child Safety Features [pdf]
I strongly considered switching away from Apple products last weekend; but this document has convinced me otherwise.<p>The threats people identify have minimal risk. If a total stranger offers you a bottle of water, you may worry about it being spiked, but him having offered the bottle doesn&#x27;t make it more, or less, likely that he&#x27;ll stab you after you accept it. They&#x27;re separate events, no &quot;slippery slope&quot;. It&#x27;s very convincing that any alteration that would &quot;scan&quot; your whole phone would be caught eventually, and even if it&#x27;s not, the announcement of this feature has no bearing on it. If Apple has evil intent, or is being coerced by NSLs, they would (be forced to) implement the dangerous mechanism whether this Child Safety feature existed or not. The concept of backdoors is hardly foreign to governments, and Apple didn&#x27;t let any cats out of any bags. This document shows that Apple did go to great lengths to preserve privacy; including the necessity of hashes being verified in two juristictions, the fact that 
neither the phone nor Apple know if any images have been matched below the threshold; the lack of remote updates of this mechanism; the use of vouchers instead of sending the full image; the use of synthetic vouchers; and on and on.<p>Furthermore, the risks of the risks of this mechanism are lower than the existing PhotoDNA used by practically every competing service. Those have no thresholds; the human review process is obscure; there is no claim that other pictures won&#x27;t be looked at.<p>The controversy, the fact that it uses an on-device component. But PhotoDNA-solutions fail many of Apple&#x27;s design criterias, which require an on-device solution:<p>- database update transparency<p>- matching software correctness<p>- matching software transparency<p>- database and software universality<p>- data access restrictions.<p>What about the concerns that the hash databases could be altered to contain political images? PhotoDNA could be, too; but would be undetectable unlike with Apple&#x27;s solutions. Worse: with serverside solutions, the server admin could use an altered hash DB only for specific target users, causing harm without arousing suspicion. Apple&#x27;s design prevents this since the DB is verifiably universal to all users.<p>A rational look at every argument I&#x27;ve seen against Apple&#x27;s solution indicates that it is strictly superior to current solutions, and less of a threat to users. Cryptographically generating vouchers and comparing hashes is categorically not &quot;scanning people&#x27;s phones&quot; or a &quot;backdoor.&quot; I think the more people understand its technical underpinnings, the less they&#x27;ll see similarities with sinister dystopian cyberpunk aesthetics.