Google’s ‘Secret’ Update Scans All Your Photos

Comments

• DuskyRo@lemmy.world ⁨1⁩ ⁨month⁩ ago

  SafetyCore Placeholder so if it ever tries to reinstall itself it will fail due to signature mismatch.

  source

  • moncharleskey@lemmy.zip ⁨1⁩ ⁨month⁩ ago

    I struggle with GitHub sometimes. It says to download the apk but I don’t see it in the file list. Anyone care to point me in the right direction?

    source

    • fushuan@lemm.ee ⁨1⁩ ⁨month⁩ ago

      There’s an app called obtainium that let’s you link the main page of github apps and manages both the download, the instalation and the updates of those apps.

      Great if you want the latest software directly from the source.

      source

      • -> View More Comments
    • dafta@lemmy.blahaj.zone ⁨1⁩ ⁨month⁩ ago

      Scroll down to releases.

      source

      • -> View More Comments
    • Smc87@lemmy.sdf.org ⁨1⁩ ⁨month⁩ ago

      github.com/daboynb/…/Safetycore-placeholder.apk

      source
    • wizardbeard@lemmy.dbzer0.com ⁨1⁩ ⁨month⁩ ago

      Under the end of the readme, the section labelled releases.

      source

      • -> View More Comments
    • rocci@lemmy.ml ⁨1⁩ ⁨month⁩ ago

      At the bottom of the page, it says releases - click on the release that’s there, and that’s where you’ll find the all.

      I haven’t been able to install it though due to signature mismatch, I’m not sure why…

      source

      • -> View More Comments
    • thisistricky@lemm.ee ⁨1⁩ ⁨month⁩ ago

      Click on the “releases” link

      source
  • AnExerciseInFalling@programming.dev ⁨1⁩ ⁨month⁩ ago

    Wow that’s actually genius thank you

    source
  • v4ld1z@lemmy.zip ⁨1⁩ ⁨month⁩ ago

    Amazing, thank you. I have uninstalled this bs twice now and have so far been spared by another force install. I hope this works

    source
  • kertain@sh.itjust.works ⁨1⁩ ⁨month⁩ ago

    Thank you for sharing!

    source
  • K4mpfie@feddit.org ⁨1⁩ ⁨month⁩ ago

    And what exactly does the github App do?

    Is suppose it’s not the same as the Google App?

    source

    • ziggurat@lemmy.world ⁨1⁩ ⁨month⁩ ago

      It doesn’t do anything. The only reason to consider installing it is that this is cryptographically signed by another developer, so if Google tries to install safety core again, it will fail because googled signature is different. It also has a super high version number, so that Google hopefully will not think to try to install the software.

      source
• SavageCoconut@lemmy.world ⁨1⁩ ⁨month⁩ ago

  Google says that SafetyCore “provides on-device infrastructure for securely and privately performing classification to help users detect unwanted content. Users control SafetyCore, and SafetyCore only classifies specific content when an app requests it through an optionally enabled feature.”

  GrapheneOS — an Android security developer — provides some comfort, that SafetyCore “doesn’t provide client-side scanning used to report things to Google or anyone else. It provides on-device machine learning models usable by applications to classify content as being spam, scams, malware, etc. This allows apps to check content locally without sharing it with a service and mark it with warnings for users.”

  But GrapheneOS also points out that “it’s unfortunate that it’s not open source and released as part of the Android Open Source Project and the models also aren’t open let alone open source… We’d have no problem with having local neural network features for users, but they’d have to be open source.” Which gets to transparency again.

  source

  • FauxLiving@lemmy.world ⁨1⁩ ⁨month⁩ ago

    Graphene could easily allow for open source solutions to emulate the SafetyCore interface. Like how it handles Google’s location services.

    There’s plenty of open source libraries and models for running local AI, seems like this is something that could be easily replicated in the FOSS world.

    source
• TK420@lemmy.world ⁨1⁩ ⁨month⁩ ago

  [deleted]

  source

  • ad_on_is@lemm.ee ⁨1⁩ ⁨month⁩ ago

    if there was something that could run android apps virtualized, I’d switch in a heartbeat

    source

    • prole@lemmy.blahaj.zone ⁨1⁩ ⁨month⁩ ago

      Waydroid?

      To be clear, I haven’t used it at all and have no idea how well it works.

      source

      • -> View More Comments
    • refurbishedrefurbisher@lemmy.sdf.org ⁨1⁩ ⁨month⁩ ago

      There are two solutions for that. One is Waydroid, which is basically what you’re describing. Another is android_translation_layer, which is closer to WINE in that it translates API calls to more native Linux ones, although that project is still in the alpha stages.

      source

      • -> View More Comments
    • bdonvr@thelemmy.club ⁨1⁩ ⁨month⁩ ago

      Every one of them can, AFAIK. I have a second cheap used phone I picked up to play with Ubuntu Touch and it has a system called Waydroid for this. Not quite seamless and you’ll want to use native when possible but it does work.

      SailfishOS, PostmarketOS, Mobian, etc all also can use Waydroid or a similar thing

      source
    • deadcade@lemmy.deadca.de ⁨1⁩ ⁨month⁩ ago

      I have used Waydroid, mainly with FOSS apps, and although it has some rough edges, it does often work for just having one or two Android apps functionality.

      Linux on mobile as a whole isn’t daily driver ready yet in my opinion. I’ve only tried pmOS on a OP6, but that seems to be a leading project on a well-supported phone (compared to the rest).

      source
    • StefanT@lemmy.world ⁨1⁩ ⁨month⁩ ago

      Do you mean sandboxed?

      source

      • -> View More Comments
  • ilinamorato@lemmy.world ⁨1⁩ ⁨month⁩ ago

    The Firefox Phone should’ve been a real contender. I just want a phone that takes good pictures and plays podcasts.

    source

    • StefanT@lemmy.world ⁨1⁩ ⁨month⁩ ago

      Unfortunately Mozilla is going the enshittification route more and more. Or good in this case that the Firefox Phone did not take of.

      source

      • -> View More Comments
  • DegenerateSupreme@lemmy.zip ⁨1⁩ ⁨month⁩ ago

    I just gave up and pre-ordered the Light Phone 3. Anytime I truly need a mobile app, I can just use an old iPhone and a WiFi connection.

    source
• mp04610@lemm.ee ⁨1⁩ ⁨month⁩ ago

  The app can be found here: play.google.com/store/apps/details?id=com.google.…

  The app reviews are a good read.

  source

  • hector@sh.itjust.works ⁨1⁩ ⁨month⁩ ago

    Thanks for the link, this is impressive because this really has all the trait of spyware; apparently it installs without asking for permission ?

    source

    • Moose@moose.best ⁨1⁩ ⁨month⁩ ago

      Yup, heard about it a week or two ago. Found it installed on my Samsung phone, it never asked for permissions or gave any info that it was added to my phone.

      source
  • DuskyRo@lemmy.world ⁨1⁩ ⁨month⁩ ago

    Smartest Google Defender

    Image

    source

    • Ledericas@lemm.ee ⁨1⁩ ⁨month⁩ ago

      broken english too, probably from a paid indian reviewer.

      source
  • Raiderkev@lemmy.world ⁨1⁩ ⁨month⁩ ago

    Thanks. Uninstalled. Not that it matters, they already got what they wanted from me most likely.

    source
  • lka1988@lemmy.dbzer0.com ⁨1⁩ ⁨month⁩ ago

    Thanks. Uninstalled and reported. Hopefully they’ll get the hint. I love my Android, but this is pushing me towards Graphene/Calyx.

    source

    • Ledericas@lemm.ee ⁨1⁩ ⁨month⁩ ago

      they will probably hide it better, and make uninstallable in the future.

      source

      • -> View More Comments
  • win95@lemmy.zip ⁨1⁩ ⁨month⁩ ago

    Apparently I’m a beta tester? How, what? Thanks for the link!

    source
  • redwattlebird@lemmings.world ⁨1⁩ ⁨month⁩ ago

    The 5 star reviews are whack

    source
  • x4740N@lemm.ee ⁨1⁩ ⁨month⁩ ago

    Apparently I’m a beta tester for it, don’t recall signing up for beta tests with it

    source
• Armand1@lemmy.world ⁨1⁩ ⁨month⁩ ago

  For people who have not read the article:

  Forbes states that there is no indication that this app can or will “phone home”.

  It’s stated use is for other apps to scan an image they have access to find out what kind of thing it is (known as "classification"). For example, to find out if the picture you’ve been sent is a dick-pick so the app can blur it.

  My understanding is that, if this is implemented correctly (a big ‘if’) this can be completely safe.

  Apps requesting classification could be limited to only classifying files that they already have access to. Remember that android has a concept of “scoped storage” nowadays that let you restrict folder access. If this is the case, we’ll it’s no less safe than not having SafetyCore at all. It just saves you space as companies like Signal, WhatsApp etc. no longer need to train and ship their own machine learning models inside their apps, as it becomes a common library / API any app can use.

  It could, of course, if implemented incorrectly, allow apps to snoop without asking for file access. I don’t know enough to say.

  Besides, you think that Google isn’t already scanning for things like CSAM? It’s been confirmed to be done on platforms like Google Photos well before SafetyCore was introduced, though I’ve not seen anything about it being done on devices yet (correct me if I’m wrong).

  source

  • Ulrich@feddit.org ⁨1⁩ ⁨month⁩ ago

    Forbes states that there is no indication that this app can or will “phone home”.

    That doesn’t mean that it doesn’t. If it were open source, we could verify it. As is, it should not be trusted.

    source
  • Opinionhaver@feddit.uk ⁨1⁩ ⁨month⁩ ago

    Doing the scanning on-device doesn’t mean that the findings cannot be reported further. I don’t want others going thru my private stuff without asking - not even machine learning.

    source
  • lepinkainen@lemmy.world ⁨1⁩ ⁨month⁩ ago

    This is EXACTLY what Apple tried to do with their on-device CSAM detection, it had a ridiculous amount of safeties to protect people’s privacy and still it got shouted down

    I’m interested in seeing what happens when Holy Google, for which most nerds have a blind spot, does the exact same thing

    source

    • noxypaws@pawb.social ⁨1⁩ ⁨month⁩ ago

      it had a ridiculous amount of safeties to protect people’s privacy

      The hell it did, that shit was gonna snitch on its users to law enforcement.

      source

      • -> View More Comments
    • lka1988@lemmy.dbzer0.com ⁨1⁩ ⁨month⁩ ago

      I have 5 kids. I’m almost certain my photo library of 15 years has a few completely innocent pictures where a naked infant/toddler might be present. I do not have the time to search 10,000+ pics for material that could be taken completely out of context and reported to authorities without my knowledge.

      source
    • Ulrich@feddit.org ⁨1⁩ ⁨month⁩ ago

      Google did end up doing exactly that, and what happened was, predictably, people were falsely accused of child abuse and CSAM.

      source

      • -> View More Comments
    • Natanael@infosec.pub ⁨1⁩ ⁨month⁩ ago

      Apple had it report suspected matches, rather than warning locally

      source

      • -> View More Comments
    • Modern_medicine_isnt@lemmy.world ⁨1⁩ ⁨month⁩ ago

      Overall, I think this needs to be done by a neutral 3rd party. I just have no idea how such a 3rd party could stay neutral. Some with social media content moderation.

      source
  • ZILtoid1991@lemmy.world ⁨1⁩ ⁨month⁩ ago

    Issue is, a certain cult (christian dominionists), with the help of many billionaires (including Muskrat) have installed a fucking dictator in the USA, who are doing their vow to “save every soul on Earth from hell”. If you get a porn ban, it’ll phone not only home, but directly to the FBI’s new “moral police” unit.

    source

    • Ledericas@lemm.ee ⁨1⁩ ⁨month⁩ ago

      the police of vice and virtue, just like SA has.

      source
• teohhanhui@lemmy.world ⁨1⁩ ⁨month⁩ ago

  Per one tech forum this week

  Stop spreading misinformation.

  • grapheneos.social/@GrapheneOS/113969399311251057
  • grapheneos.social/@GrapheneOS/113969401014384221
  • grapheneos.social/@GrapheneOS/113979779852809361

  source

  • kattfisk@lemmy.dbzer0.com ⁨1⁩ ⁨month⁩ ago

    To quote the most salient post

    The app doesn’t provide client-side scanning used to report things to Google or anyone else. It provides on-device machine learning models usable by applications to classify content as being spam, scams, malware, etc. This allows apps to check content locally without sharing it with a service and mark it with warnings for users.

    Which is a sorely needed feature to tackle problems like SMS scams

    source

    • throwback3090@lemmy.nz ⁨1⁩ ⁨month⁩ ago

      Why do you need machine learning for detecting scams?

      Is someone in 2025 trying to help you out of the goodness of their heart? No. Move on.

      source

      • -> View More Comments
    • desktop_user@lemmy.blahaj.zone ⁨1⁩ ⁨month⁩ ago

      if the cellular carriers were forced to verify that caller-ID (or SMS equivalent) was accurate SMS scams would disappear (or at least be weaker). Google shouldn’t have to do the job of the carriers, and if they wanted to implement this anyway they should let the user choose what service they want to perform the task similar to how they let the user choose which “Android system WebView” should be used.

      source

      • -> View More Comments
    • cley_faye@lemmy.world ⁨1⁩ ⁨month⁩ ago

      You don’t need advanced scanning technology running on every device with access to every single bit of data you ever seen to detect scam. You need telco operator to stop forwarding forged messages headers and… that’s it. Cheap, efficient, zero risk related to invasion of privacy through a piece of software you did not need but was put there “for your own good”.

      source

      • -> View More Comments
  • Spaniard@lemmy.world ⁨1⁩ ⁨month⁩ ago

    If the app did what op is claiming then the EU would have a field day fining google.

    source
  • throwback3090@lemmy.nz ⁨1⁩ ⁨month⁩ ago

    graphene folks have a real love for the word misinformation. That’s not you under there👻, Daniel, is it?

    source
  • dan@upvote.au ⁨1⁩ ⁨month⁩ ago

    So is this really just a local AI model? Or is it something bigger? My S25 Ultra has the app but it hasn’t used any battery or data.

    source

    • Auli@lemmy.ca ⁨1⁩ ⁨month⁩ ago

      I mean the grapheneos devs say it is. Are they going to lie.

      source

      • -> View More Comments
  • ad_on_is@lemm.ee ⁨1⁩ ⁨month⁩ ago

    And what exactly does that have to do with GrapheneOS?

    source

    • teohhanhui@lemmy.world ⁨1⁩ ⁨month⁩ ago

      Please, read the links. They are the security and privacy experts when it comes to Android. That’s their explanation of what this Android System SafetyCore actually is.

      source
    • loics2@lemm.ee ⁨1⁩ ⁨month⁩ ago

      Have you even read the article you posted? It mentions these posts by GrapheneOS

      source
• mctoasterson@reddthat.com ⁨1⁩ ⁨month⁩ ago

  People don’t seem to understand the risks presented by normalizing client-side scanning on closed source devices. Think about how image recognition works. It scans image content locally and matches to keywords or tags, describing the person, objects, emotions, and other characteristics. Even the rudimentary open-source model on an immich deployment on a Raspberry Pi can process thousands of images and make all the contents searchable with alarming speed and accuracy.

  So once similar image analysis is done on a phone locally, and pre-encryption, it is trivial for Apple or Google to use that for whatever purposes their use terms allow. Forget the iCloud encryption backdoor. The big tech players can already scan content on your device pre-encryption.

  And just because someone does a traffic analysis of the process itself (safety core or mediaanalysisd or whatever) and shows it doesn’t directly phone home, doesn’t mean it is safe. The entire OS is closed source, and it needs only to backchannel small amounts of data in order to fuck you over.

  Remember the original justification for clientside scanning from Apple was “detecting CSAM”. Well they backed away from that line of thinking but they kept all the client side scanning in iOS and Mac OS. It would be trivial for them to flag many other types of content and furnish that data to governments or third parties.

  source
• shortwavesurfer@lemmy.zip ⁨1⁩ ⁨month⁩ ago

  Not on mine, it doesn’t. I don’t use the Play Store. I don’t have Google Play Services. And I don’t have Google Apps installed. And I’m running Lineage OS. So, fuck you Google.

  source

  • Ilovethebomb@lemm.ee ⁨1⁩ ⁨month⁩ ago

    There’s one in every thread.

    source

    • solsangraal@lemmy.zip ⁨1⁩ ⁨month⁩ ago

      “i just needed to pop in here and mention that the terrible/wrong/evil thing in the post doesn’t affect me at all, like it does for you suckers ROFLMFAO…but also: LOL”

      source

      • -> View More Comments
• Denalduh@lemmy.world ⁨1⁩ ⁨month⁩ ago

  I didn’t have it in my app drawer but once I went to this link, it showed as installed. I un-installed it ASAP.

  play.google.com/store/apps/details?id=com.google.…

  source

  • danciestlobster@lemm.ee ⁨1⁩ ⁨month⁩ ago

    I also reported it as hostile and inappropriate. I am sure Google will do fuck all with that report but I enjoy being petty sometimes

    source
  • woobat@midwest.social ⁨1⁩ ⁨month⁩ ago

    thank you for posting this. it’s not yet installed on my phone for some reason, but i will be checking this page every couple days to make sure it stays that way.

    source
• Ilovethebomb@lemm.ee ⁨1⁩ ⁨month⁩ ago

  I’ve just given it the boot from my phone.

  It doesn’t appear to have been doing anything yet, but whatever.

  source

  • SnotFlickerman@lemmy.blahaj.zone ⁨1⁩ ⁨month⁩ ago

    Yeah no issues here just uninstalling. It hasn’t come back.

    source
• Lanske@lemmy.world ⁨1⁩ ⁨month⁩ ago

  Thnx for this, just uninstalled it, google are arseholes

  source
• AWittyUsername@lemmy.world ⁨1⁩ ⁨month⁩ ago

  Google says that SafetyCore “provides on-device infrastructure for securely and privately performing classification to help users detect unwanted content

  Cheers Google but I’m a capable adult, and able to do this myself.

  source
• variouslegumes@reddthat.com ⁨1⁩ ⁨month⁩ ago

  I switched over to GrapheneOS a couple months ago and couldn’t be happier. If you have a Pixel the switch is really easy. The biggest obstacle was exporting my contacts from my google account.

  source

  • Rekorse@sh.itjust.works ⁨1⁩ ⁨month⁩ ago

    Contacts are overrated.

    source

    • xorollo@leminal.space ⁨1⁩ ⁨month⁩ ago

      New os, who dis?

      source

      • -> View More Comments
  • Atmoro@lemmy.world ⁨1⁩ ⁨month⁩ ago

    LineageOS is amazing as well. Especially since it covers many devices

    source
• Nightsoul@lemmy.world ⁨1⁩ ⁨month⁩ ago

  Thank you was able to find and uninstall the app with no issues

  source
• 0x0@programming.dev ⁨1⁩ ⁨month⁩ ago

  Don’t use Google Play. Prefer Obtanium, F-Droid or Aurora Store.

  source
• sommerset@thelemmy.club ⁨1⁩ ⁨month⁩ ago

  Thanks. Just uninstalled. What a cunts

  source
• zecg@lemmy.world ⁨1⁩ ⁨month⁩ ago

  This is the stupidest shit, moral panic levels of miscomprehension. I mean, I was miffed and promptly removed safetycore because I don’t mind seeing sex organs and don’t want shit using battery for no reason, but wow Forbes.

  source
• digdilem@lemmy.ml ⁨1⁩ ⁨month⁩ ago

  More information: It’s been rolling out to Android 9+ users since November 2024 as a high priority update. Some users are reporting it installs when on battery and off wifi, unlike most apps.

  App description on Play store: SafetyCore is a Google system service for Android 9+ devices. It provides the underlying technology for features like the upcoming Sensitive Content Warnings feature in Google Messages that helps users protect themselves when receiving potentially unwanted content. While SafetyCore started rolling out last year, the Sensitive Content Warnings feature in Google Messages is a separate, optional feature and will begin its gradual rollout in 2025. The processing for the Sensitive Content Warnings feature is done on-device and all of the images or specific results and warnings are private to the user.

  Description by google Sensitive Content Warnings is an optional feature that blurs images that may contain nudity before viewing, and then prompts with a “speed bump” that contains help-finding resources and options, including to view the content. When the feature is enabled, and an image that may contain nudity is about to be sent or forwarded, it also provides a speed bump to remind users of the risks of sending nude imagery and preventing accidental shares. - 9to5google.com/android-safetycore-app-what-is-it/

  So looks like something that sends pictures from your messages (at least initially) to Google for an AI to check whether they’re “sensitive”. The app is 44mb, so too small to contain a useful ai and I don’t think this could happen on-phone, so it must require sending your on-phone data to Google?

  source
• red_bull_of_juarez@lemmy.dbzer0.com ⁨1⁩ ⁨month⁩ ago

  Even with the latest update from Samsung, I am not seeing this app. My OnePlus did get it with the February update and I had to remove it.

  source
• pfr@lemmy.sdf.org ⁨1⁩ ⁨month⁩ ago

  laughs in GrapheneOS

  source
• mrodri89@lemmy.zip ⁨1⁩ ⁨month⁩ ago

  Is there any indication that Apple is truly more secure and privacy conscious over Android? Im kinda tired of Google and their oversteps.

  source
• SplashJackson@lemmy.ca ⁨1⁩ ⁨month⁩ ago

  What a pile of fuck.

  source
• Punchshark@lemmy.ca ⁨1⁩ ⁨month⁩ ago

  Fuck these cunt

  source
• LotrOrc@lemmy.world ⁨1⁩ ⁨month⁩ ago

  I just un-installed it

  Anyone know what Android System Intelligence does? Should that be un-installed as well?

  source
• werefreeatlast@lemmy.world ⁨1⁩ ⁨month⁩ ago

  I’d that what’s killing my fucking battery like crazy lately?

  source
• Sudomeapizza@lemm.ee ⁨1⁩ ⁨month⁩ ago

  For those that have issues on Samsung devices: see here if you’re getting the “App not installed as package conflicts with an existing package” error :

  If you have a Samsung device - uninstall the app also from Knox Secure Folder. Entering to Secure Folder>Settings>Apps

  source
• OfficerBribe@lemm.ee ⁨1⁩ ⁨month⁩ ago

  Kind of weird that they are installing this dependency whether you will enable those planned scanning features or not. Here is an article mentioning that future feature Sensitive Content Warnings. It does sound kind of cool, less chance to accidentally send your dick pic to someone I guess.

  Sensitive Content Warnings is an optional feature that blurs images that may contain nudity before viewing, and then prompts with a “speed bump” that contains help-finding resources and options, including to view the content. When the feature is enabled, and an image that may contain nudity is about to be sent or forwarded, it also provides a speed bump to remind users of the risks of sending nude imagery and preventing accidental shares.

  All of this happens on-device to protect your privacy and keep end-to-end encrypted message content private to only sender and recipient. Sensitive Content Warnings doesn’t allow Google access to the contents of your images, nor does Google know that nudity may have been detected. This feature is opt-in for adults, managed via Android Settings, and is opt-out for users under 18 years of age.

  source
• YarHarSuperstar@lemmy.world ⁨1⁩ ⁨month⁩ ago

  What about the “Android System Intelligence” app that someone else mentioned here? I just realized I have that one. It sounds like it has the capabilities to spy and maybe even more.

  source
• trslim@pawb.social ⁨1⁩ ⁨month⁩ ago

  Dood they scanned all my furry porn

  source
• Bieren@lemmy.world ⁨1⁩ ⁨month⁩ ago

  Google harvesting all your data for profits. I’m shocked. Shocked I say.

  source