Facebook To Fight Revenge Porn by Letting Potential Victims Upload Nudes in Advance (bleepingcomputer.com)

Catalin Cimpanu, writing for BleepingComputer: Facebook is testing new technology that is designed to help victims of revenge porn acts. It works on a database of file hashes, a cryptographic signature computed for each file. Facebook says that once an abuser tries to upload an image marked as "revenge porn" in its database, its system will block the upload process. This will work for images shared on the main Facebook service, but also for images shared privately via Messenger, Facebook's IM app. The weird thing is that in order to build a database of "revenge porn" file hashes, Facebook will rely on potential victims uploading a copy of the nude photo in advance. This process involves the victim sending a copy of the nude photo to his own account, via Facebook Messenger. This implies uploading a copy of the nude photo on Facebook Messenger, the very same act the victim is trying to prevent. The victim can then report the photo to Facebook, which will create a hash of the image that the social network will use to block further uploads of the same photo.

Comments

What could possibly go wrong?

[Major_Disorder]

I know they "claim" they will not keep the pictures, but only a hash of the image. But do you really trust Facebook that much?

Why not compute hash locally?

[pz]

The public reaction to this is understandably somewhat muted and off-put. Why upload nude photos to Facebook, indeed? The claim is that they will compute a hash of the image, and store that to prevent future uploads.

If that is really the case, when why not compute the hash locally on the user's machine, and upload only the hash? Surely that can be done on essentially all modern hardware from cell phone to desktop in a reasonable amount of time.

Re:Why not compute hash locally?

[swillden]

If that is really the case, when why not compute the hash locally on the user's machine, and upload only the hash?

Cool. I hate CNN's fake news. I'm going to write a script that takes every image from every CNN story and uploads the hashes. Sharing of CNN stories on Facebook is going to be shut down.

s/CNN/whatever you hate/

The obvious corollary here is that Facebook needs not just the hashes but also the original image, so they can determine whether it's a real nude photo. Algorithms can do that pretty well, so Facebook may be able to arrange that no human ever needs to see the image... but there's no way for the uploader to be certain that's what they're doing.

Also, the "hash" probably needs to be something a bit more image-focused than, say, SHA256. Otherwise any trivial modification of the image would change the hash. So it's got to be something that survives scaling, cropping, resolution changes, watermarking, etc. Which means that if the exact algorithm leaks, people can reverse engineer it to figure out how to work around it. That's another reason they need to do the hashing on their end.

Re:This is already avaliable

[cayenne8]

I have a QUICK solution to all this, works 100%.

Don't fucking let someone take pictures or video of you naked and/or having sex!!!!

Sheesh....when did something like common sense about not letting someone take pics of you in compromising situations go out the fucking door?

Re:This is already avaliable

[Tuidjy]

I would also take you up on that offer. But could you please explain to me, first, how you deal with the things with which Facebook clearly does not:
- how do you avoid charges of moving and storing child porn if the user is underage?
- how do you make sure that minor changes to the original picture do not produce completely different signatures?
- how do you make sure that none of your employees have access to the originals?
- how do you make sure people upload only pictures in which they are the subject?
- how do you make sure that the mechanism is not used to suppress legitimate pictures?
- etc, etc, etc.

What could possibly go wrong?!