←back to thread

378 points nkko | 1 comments | | HN request time: 0.207s | source
Show context
Havoc ◴[] No.42479967[source]
What are the chance that this keeps working long term?

Sounds awesome & makes airtags more appealing, but if apple is just going to shut it down next week then less so

replies(3): >>42480311 #>>42480903 #>>42482047 #
stonegray ◴[] No.42480311[source]
Changing the underlying find my network to break this would be challenging if not impossible while keeping the privacy protections in place. Apple can’t identify devices sending data to find my, and doesn’t log requests. Short of changes that would break compatibility with older devices it should be relatively stable.

OpenHaystack has been doing this for a few years now and Apple has made no efforts to restrict it.

replies(3): >>42480336 #>>42480693 #>>42482091 #
gjsman-1000 ◴[] No.42480336[source]
> Apple can’t identify devices sending data to find my, and doesn’t log requests.

So what you're saying is that a decent firewall could still inspect the traffic, or the patterns thereof.

Also, this doesn't make any sense, as if Apple doesn't know which AirTag belongs to who, Find My would be very useless; and law enforcement would be furious.

replies(1): >>42480403 #
stonegray ◴[] No.42480403[source]
Airtags are associated with your apple ID for safety, but when you make a request for the location from Find My it doesn’t include any information about which airtag you’re asking about; just a CSPRNG-incremented public key that changes every 15 minutes. The location data itself is not available to Apple.

Here is Apple’s docs on how they prevent themselves from inspecting traffic on Fmi: https://support.apple.com/guide/security/find-my-security-se...

replies(2): >>42480638 #>>42480934 #
wutwutwat ◴[] No.42480638[source]
So Apple has no way to see anything even when developing the platform itself?

They must have a way to decrypt payloads or otherwise get into the system they built and control. The fact that they let law enforcement know when someone is stalking someone with an AirTag shows that the data is available to them. It’s silly to think otherwise, paper or not.

replies(2): >>42480822 #>>42483748 #
1. future10se ◴[] No.42480822[source]
> The fact that they let law enforcement know when someone is stalking someone with an AirTag shows that the data is available to them.

Not technically correct. Apple devices (and Android phones with the appropriate app) detect if an unknown AirTag is moving with them and makes it home, possibly signalling a stalking attempt.

The heuristics for this happen locally; Apple isn't "aware" of this happening. That said, when you first set-up an AirTag, the serial is tied to your account. Therefore, when you physically find an unknown AirTag and report it to law enforcement, they can then subpoena (or get a warrant?) Apple for information on the AirTag owner's identity.

The serial itself, and any personal identifiers, are not used in the locating process, however.

This is well documented in the paper above, in articles, as well as in reverse engineering efforts.