Thanks for the read. Pretty cool. The following is my layman's understanding, mostly because it helps me to understand things by typing. Please criticize if I miss stuff.<p>Noteworthy is Dan Boneh's contribution on this. Given his reputation in the crypto community, it seems he really does believe in this, despite all the controversy as of recent.<p>They discuss and build upon several security properties, but the most contentious point-- privacy/leakage/scanning of your photos-- is addressed as follows:<p>Firstly some background-- the private set intersection[1] (PSI) technique in general permits 2 sets to be compared with both parties learning *only* the intersections. In a nut shell, Apple uses this concept such that, if the number of intersecting elements is greater than a threshhold, they're notified.<p>There are several modifications (Shamir's secret sharing, Cuckoo tables, PKI-ish schemes) to create what Apple calls a ftPSI-AD protocol to optimize desired properties-- performance, integrity, and most notably to me, <i>zero</i> false passes. That is, innocent people will be minimized at the cost of real child-pornographic images slipping by.<p>Couple noteworthy things that still raise red-flags--<p>1) they prove that, for honest servers <--> malicious clients, and vice-versa, privacy is not violated for either party, but to me this considers the client as the phone and Apple the server. I'd argue that the phone is actually "Mallory", and <i>you</i> are the client.<p>You might be honest, but how do you trust the Apple + phone short of reverse engineering it? This is the biggest hole to me, and so I don't fully understand this proof (or, perhaps I have the parties mixed up).<p>2) Several things are handwaved and/or left "variable to implementation". E.g. Section 5, on "near-duplicate images" that may count twice to this threshhold--<p>>> Several solutions to this were considered, but ultimately, this issue is addressed by a mechanism
outside of the cryptographic protocol<p>What the?? Hello?? Perhaps this is addressed in another whitepaper, given this is a theory/protocol heavy paper, but this does not instill confidence.<p>Or, take this bit from remark 3--<p>>> If needed, these false negatives can be eliminated with
a tweak to the data structure used<p>Uh, I thought not sending innocent people to jail was a pretty critical property. You're telling me the server/Apple, who <i>controls</i> the Cuckoo table, can just change this on a whim? How would I hold them responsible/be notified of this?<p>These "variations" are remarked on several times in the paper. Again, not exactly confidence building.<p>Overall, while I really applaud this effort, and I'm not as outraged as I initially was, I'm only slightly less so and have a handful of more questions than before.<p>Again, please correct me if my annoyance might be misguided, given these technical details.<p>[1]: <a href="https://en.wikipedia.org/wiki/Private_set_intersection" rel="nofollow">https://en.wikipedia.org/wiki/Private_set_intersection</a>