Network Connections From mediaanalysisd
Imagine my surprise when browsing these images in the Finder, Little Snitch told me that macOS is now connecting to Apple APIs via a program named
mediaanalysisd(Media Analysis Daemon - a background process for analyzing media files).[…]
Apple has repeatedly declared in their marketing materials that “privacy is a human right”, yet they offered no explanation whatsoever as to why those of us who do not traffic in child pornography might wish to have such privacy-violating software running on our devices.
[…]
Integrate this data and remember it: macOS now contains network-based spyware even with all Apple services disabled. It cannot be disabled via controls within the OS: you must used third party network filtering software (or external devices) to prevent it.
Contrary to this post, I think Apple did clearly state that it has abandoned local CSAM detection. And he doesn’t seem to have evidence that his data is being improperly sent to Apple. Still, it’s not clear exactly what mediaanalysisd is doing with the network.
There is no evidence that local images on a Mac have identifiers computed and uploaded to Apple’s servers when viewed in Finder windows.
[…]
Images viewed in apps supporting VLU have neural hashes computed, and those are uploaded to Apple’s servers to perform look up and return its results to the user, as previously detailed.
VLU can be disabled by disabling Siri Suggestions in System Settings > Siri & Spotlight, as previously explained.
Mysk:
No, macOS doesn’t send info about your local photos to Apple We analyzed
mediaanalysisdafter an extraordinary claim by Jeffrey Paul that it scans local photos and secretly sends the results to an Apple server.[…]
We analyzed the network traffic sent and received by
mediaanalysisd. Well, the call is literally empty. We decrypted it. No headers, no IDs, nothing. Just a simple GET request to this endpoint that returns nothing. Honestly, it looks like it is a bug.
Mysk:
The issue was indeed a bug and it has been fixed in macOS 13.2. The process no longer makes calls to Apple servers.
Was it also a bug that this happened even though Paul had opted out of everything? Or is there no setting for this? Or did he miss a setting?
Ok, that may well be. But when my OS was phoning home on my photos yesterday and happens to not be phoning home on them today… that doesn’t really build trust. Intent matters, and we know what Apple’s intent is because they told us. Code matters, and we are not allowed to see Apple’s code.
Maybe the fact that it phoned home with a null response is only because the test photos didn’t match some magic neural net -- congratulations, Apple didn’t report your test images to the FBI.
We cannot know. But suspicion and mistrust are absolutely justified. Apple is examining your photos and then phoning home. The onus is on them to explain -- and prove -- what they are doing and why.
Previously:
- macOS 13.2
- Apple Abandons CSAM Scanning
- Analytics in Apple Apps
- Apple Reneged on OCSP Privacy
- Monterey’s Visual Look Up
- Siri Suggestions and Privacy
Update (2023-01-27): Howard Oakley:
Just checked this evening: this hasn’t changed in 13.2.
This bug violated users’ trust. The last time something like this happened was with the OCSP fiasco, when Apple promised a way to opt out of Gatekeeper checks by the end of 2021. As of writing, any such option remains unavailable.
[…]
At the same time, it is unwise to trust alarmist reports like these, either. These are extraordinary claims made without evidence, and they can be dismissed unless proven.
Live Text analysis doesn’t generate neural hashes or other identifiers for an image, in the way that Visual Look Up does.
Any connection to Apple’s servers during Live Text analysis is performed before the image has been analysed, and before the extraction of any text. It cannot, therefore, send Apple any image identifiers or extracted text.
Live Text relies on language asset files, which may need to be augmented or updated over a network connection during text recognition.
macOS 13.1 and 13.2 perform Live Text essentially the same, and will both attempt to connect to Apple’s servers in the event that they need to update language asset files.
4 Comments RSS · Twitter · Mastodon
> Maybe the fact that it phoned home with a null response is only because the test photos didn’t match some magic neural net
This is FUD. If the request was a GET, it means mediaanalysisd was no sending anything.
@Jean-Daniel It probably is just a bug, but neural hashes are really small and so could fit into the URL or a request header.
So just my two cents, but ....
(1) A simple Google search revealed complaints about mediaanalysisd going back to at least 2017;
(2) The process just fired on my machine less than two days ago, according to Little Snitch it contacted an "apple server" somewhere in the Washington D.C. area.
It's clear that this program has been running in the background for longer than the current period of concern. It's also clear that it was not "fixed" by the latest update. I am not the kind of person that has anything to do with CSAM content. However, the metro Washington destination of the program's data has me worried this is broad-based government spying masqarading as private-sector spying. Would not be the first time this has happened.
It is really unreasonable to assume that content scanning has to send results to Apple servers.
If hash matches the pre-set conditions, message can be sent only then, and evenlthrough the mesh network together with Find My messages which will not show up in any "analysis".
