Hacker News new | ask | show | jobs
by paxys 1891 days ago
How many of these third party devices can use every iPhone, iPad and more in the world as a beacon?
2 comments

Tile uses everyone with the tile app installed. It's not the same by sheer numbers, but it's more than enough that if someone slips a tile tracker on you they will know where you're at. Or, if someone wants to spend a bit more money, not even much more, they can buy a full GPS tracker that doesn't need anything to report on it. Apple isn't coming out with some groundbreaking spy tech here, this is very routine stuff thats been in a small format forever. And guess what, none of the existing ones do anything to alert anyone of stalking, unlike Apple. I don't even like Apple but this is silly.

    Tile uses everyone with the tile app installed. 
    It's not the same by sheer numbers
It's not Apple's "fault" they're more popular but the end result is that these AirTags are orders of magnitude more potentially dangerous thanks the fact that there are orders of magnitude more iDevice users than Tile app users.

Imagine I'm some kind of creep looking for victims in a club or whatever. I'm planning to accomplish this by dropping Tiles into their bags.

Statistically, how many Tiles would I need to buy and sneak onto persons in order to have a reasonable chance of snaring a victim who just happens to have the Tile app installed? 50? 100? 1000? Not impossible, but not particularly feasible.

How many AirTags would I need to sneak onto victims? Perhaps only one, if they happen to use their phone in public and I see it's from Apple -- that's something I can tell at a glance, unlike wondering if they have the Tile app installed.

not to mention tile does it without notifying iphones of airtags or the beep when moved.
They don't need to? GSM radios have gotten tiny. Think literally any innocuous item and it can be fitted with a tracker.

Even a hairbrush: http://www.mccalltech.net/images/0TrackBrush.jpg

The limitation of any tracker is battery lifetime. The AirTag circumvents this by only using low power transmission and the network of all iPhones and iPads in the world, which then relay via their own wifi/4G.

What is certain is that we'll see sophisticated modifications to AirTags that (1) disable the beep, (2) disable anti-stalking.

Theoretically remote attestation and self-disabling anti-tamper could be used, but the potential wins for bypassing the Apple protocol are enormous, the Holy Grail of surveillance espionage.

"Holy Grail of surveillance espionage"... maybe the holy grail alarmist statements.

Why are firmware modifications for this "certain" first off?

And what modifications allow this to work as designed without setting off anti-stalking? If you somehow change the ID it's reporting which afaik is a signed value anyways, how are you going to get access to it's location?

If you don't disable anti-stalking then this is no better than run of the mill GPS trackers which can already run for days to weeks

Nation state attacks are certain because of the massive payoff if they are successful. Were you asleep when the Snowdon NSA leaks happened? [1]

If you can change the ID you can cycle through a list of valid IDs. You can even use it for bit rate comms, ~16 bits an hour or something, which is enough to signal events like "number of iDevices in vicinity", or, if other hardware is used, step count/hour, which works even in GPS denied environments.

The beacon location reported by Find My is generated by the reporting phones' GPS/cellular/wifi location system.

Regular GPS trackers have no means to exfil their data. They don't work in GPS denied environments (poor inside buildings, underground, anywhere a $20 jammer is enabled). OCGs routinely use low power GPS jammers now. Using GPS or 3G requires much more energy, and 3G is easily detected by motivated groups.

So while it might not be great for stalking your partner/ex, it is very tempting for professionals.

[1] https://nsa.gov1.info/dni/nsa-ant-catalog/

"Were you asleep when the Edward Snowden leak happened"

... yeah I'm not going to play this game.

Nation states are certainly doing better than AirTags if that's what you're worried about Secret Agent.

Passive trackers will let you pinpoint someone indefinitely.

And someone motivated is going to catch your spurious 3G emissions but miss an AirTag literally designed to be noticable?

Puhlease. If a nation state is chasing you and this is what turns the tides I strongly suggest turning yourself into their embassy now, save yourself the trouble.

You claimed that no one would go to the effort. It is clear that they will.

Nation states don't have a global network of iPhones.

> Passive trackers will let you pinpoint someone indefinitely.

How?

> Puhlease. If a nation state is chasing you and this is what turns the tides I strongly suggest turning yourself into their embassy now, save yourself the trouble.

"Puhlease" enjoy pretending that nation states are all IDF 8200 elite cyber hackers. The future ubiquity and deniability of these devices will see them feature widely. And some people do need to defend against skilled attackers who can buy custom gear from Shenzhen, and telling them to give up is stupid.