←back to thread

378 points nkko | 2 comments | | HN request time: 0.874s | source
Show context
Havoc ◴[] No.42479967[source]
What are the chance that this keeps working long term?

Sounds awesome & makes airtags more appealing, but if apple is just going to shut it down next week then less so

replies(3): >>42480311 #>>42480903 #>>42482047 #
stonegray ◴[] No.42480311[source]
Changing the underlying find my network to break this would be challenging if not impossible while keeping the privacy protections in place. Apple can’t identify devices sending data to find my, and doesn’t log requests. Short of changes that would break compatibility with older devices it should be relatively stable.

OpenHaystack has been doing this for a few years now and Apple has made no efforts to restrict it.

replies(3): >>42480336 #>>42480693 #>>42482091 #
gjsman-1000 ◴[] No.42480336[source]
> Apple can’t identify devices sending data to find my, and doesn’t log requests.

So what you're saying is that a decent firewall could still inspect the traffic, or the patterns thereof.

Also, this doesn't make any sense, as if Apple doesn't know which AirTag belongs to who, Find My would be very useless; and law enforcement would be furious.

replies(1): >>42480403 #
stonegray ◴[] No.42480403[source]
Airtags are associated with your apple ID for safety, but when you make a request for the location from Find My it doesn’t include any information about which airtag you’re asking about; just a CSPRNG-incremented public key that changes every 15 minutes. The location data itself is not available to Apple.

Here is Apple’s docs on how they prevent themselves from inspecting traffic on Fmi: https://support.apple.com/guide/security/find-my-security-se...

replies(2): >>42480638 #>>42480934 #
meindnoch ◴[] No.42480934[source]
So how does Find My work on icloud.com then?
replies(2): >>42481480 #>>42481808 #
alphan0n ◴[] No.42481480[source]
It’s explained pretty well in link provided in comment your replying to.

The tl;dr is: The information is publicly available in an encrypted form that is only readable by the party with the key.

Think of it like this, when you mark an item as lost you publish a hashed public identification key, if another device detects that key it creates a location report encrypted with your public key and posts it to a public list of encrypted reports, you decrypt the report with your private key.

replies(1): >>42481992 #
1. meindnoch ◴[] No.42481992[source]
>you decrypt the report with your private key

Where would this private key be coming from when opening Find My on icloud.com (a website)?

replies(1): >>42482100 #
2. alphan0n ◴[] No.42482100[source]
From your keychain. Decrypted locally.

If you mean from another device other than one that your keychain is on, ie, a browser on a device you haven’t logged into before, you can’t.

You can get an active location through iCloud if the device is powered on or its last location before power off if the setting is enabled. But you can’t decrypt find my location reports without the private key, which is only available in devices you’ve logged into.