Matthew Green

Follow @matthew_d_green

10 Jan, 4 tweets, 1 min read

Facebook (ugh must we call them Meta) is deploying an image scanning system to detect revenge porn. The novelty is that the people reporting the images never have to show the originals to Facebook. about.fb.com/news/2021/12/s…

I’m sure this has been carefully thought out. I hope it has. Because as described in the post it seems fairly ripe for abuse.

In any case, it’s worth flagging this just in case you thought this image scanning tech would stop with child sexual abuse media. There is a whole library of content that people want to censor and surveil: often for perfectly benign reasons.

A friend tried to upload Tank Man and the platform didn’t seem to object.

• • •

Missing some Tweet in this thread? You can try to force a refresh

　

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @matthew_d_green

Matthew Green

@matthew_d_green

12 Jan

I decided to look at MetaMask’s crypto, and oh wow I wish I could unlook.

To be clear I didn’t even make it to a lot of the core routines yet. Just hunting through piles of poorly-commented JS and *hoping* the particular GitHub repo I’m looking at is actually the right one.

Reached a point where I was in someone’s personal GitHub repo and I was like “I think this is the right code” but honestly I dunno.

Matthew Green

@matthew_d_green

11 Jan

I am of the opinion that NFTs are going to be important. But I am also sympathetic to the take below. Don’t mistake *believing in the significance* of a technology for accepting and supporting all of its downsides.

https://twitter.com/JimSterling/status/1480842617256660997

One of the dumbest lessons I’ve learned in my career is that you should never disregard something that has hype behind it, even if you don’t think the tech makes sense.

Most “tech adoption” problems are really human coordination problems. Hype solves those. It doesn’t matter if you have a better solution, or that you think the proposed solution is stupid.

Matthew Green

@matthew_d_green

6 Jan

I’ve belatedly come to believe that we blew it by focusing on secure messaging, while Silicon Valley quietly built their unencrypted backup infrastructure and doomed most of our efforts.

https://twitter.com/andreavbasso/status/1479143532342517765

I think people at Apple knew this back in ~2014, which is why they threw so much effort into an (ultimately doomed) effort to deploy end-to-end encrypted iCloud backup. But they were too late.

By the time they got close to deploying it, governments had realized the value of what Apple (and Google) had built. There was no way they were going to let that resource be taken from them.

Matthew Green

@matthew_d_green

6 Jan

I think this a very worrying idea, and one I’ve seen from many thoughtful policy experts: namely that laws are the only solution to the surveillance nightmare we’ve created with newer technologies.

https://twitter.com/valkenburgh/status/1479094123319771136

The problem today is that we’ve opened up a virtually infinite feed of potential surveillance data, then centralized that data in a few poorly-secured centralized repositories. Governments can’t resist accessing this data, don’t ask them to try.

There is this idea among policymakers that if we just democracy harder, we can somehow bring digital privacy expectations back to where it was in the 1980s (or even the early 2000s.) But even if we had a working democracy, we can’t. It’s too late.

Matthew Green

@matthew_d_green

30 Dec 21

Moms are the real tracking threat.

https://twitter.com/rmac18/status/1476651167220330509

A friend recently lost his wallet with a Tile inside it, and rather than get the thing back we’ve been watching it wander around Baltimore for the last three weeks.

It turns out that knocking on random doors in Fells Point is a very bad strategy for recovering lost things.

Matthew Green

@matthew_d_green

27 Dec 21

Apropos Moxie’s thread, Telegram’s E2E is so obviously homebrewed, it’s like sending a chat to the late 1990s.

https://twitter.com/moxie/status/1474067555278999553

So the remote client picks the DH parameters (why!) and sends them to you, where you have to carefully check that they’re constructed correctly (pretty sure these checks were added later.)

Then there’s this weird thing about the server picking randomness, which used to be a total security vulnerability since it allowed the server to pick the DH secret (now fixed, I think) and still more complicated group membership checks.

Follow Us on Twitter!