[stonegray]

Airtags are associated with your apple ID for safety, but when you make a request for the location from Find My it doesn’t include any information about which airtag you’re asking about; just a CSPRNG-incremented public key that changes every 15 minutes. The location data itself is not available to Apple.

Here is Apple’s docs on how they prevent themselves from inspecting traffic on Fmi: https://support.apple.com/guide/security/find-my-security-se...

[meindnoch]

So how does Find My work on icloud.com then?

[malmeloo]

The short answer is that it doesn't. The iCloud website only shows devices that are actively uploading their location to Apple, such as iPhones and iPads. AirTags are not shown there, as they use the FindMy network instead (the whole other-devices-find-your-airtags mechanism). This library focuses on the latter.

Apple devices can query your AirTag's location because they sync its shared secrets through the iCloud keychain, which is used to generate temporary keys that can be use to download and decrypt the tag's location.

[meindnoch]

>Apple devices can query your AirTag's location because they sync its shared secrets through the iCloud keychain

I see. But can't Apple simply read this data from my iCloud keychain? Or is this kind of data sharing through iCloud keychain e2e encrypted?

[malmeloo]

As far as I understand, the keychain is indeed e2e encrypted and it requires at least one of your other devices to be online in order to sync. However last time I checked Apple still fails the mud puddle test, so there does have to be some kind of master key that decrypts the data in the case of account recovery.

[alphan0n]

It’s explained pretty well in link provided in comment your replying to.

The tl;dr is: The information is publicly available in an encrypted form that is only readable by the party with the key.

Think of it like this, when you mark an item as lost you publish a hashed public identification key, if another device detects that key it creates a location report encrypted with your public key and posts it to a public list of encrypted reports, you decrypt the report with your private key.

[meindnoch]

>you decrypt the report with your private key

Where would this private key be coming from when opening Find My on icloud.com (a website)?

[alphan0n]

From your keychain. Decrypted locally.

If you mean from another device other than one that your keychain is on, ie, a browser on a device you haven’t logged into before, you can’t.

You can get an active location through iCloud if the device is powered on or its last location before power off if the setting is enabled. But you can’t decrypt find my location reports without the private key, which is only available in devices you’ve logged into.

[meindnoch]

Websites can access my keychain? Since when?

[alphan0n]

What’s your actual point here? You seem to be trying to build up to something by asking me questions instead of RTFM.

You aren’t “sending” the key anywhere, you are downloading the report and decrypting it locally.

[wutwutwat]

So Apple has no way to see anything even when developing the platform itself?

They must have a way to decrypt payloads or otherwise get into the system they built and control. The fact that they let law enforcement know when someone is stalking someone with an AirTag shows that the data is available to them. It’s silly to think otherwise, paper or not.

[future10se]

> The fact that they let law enforcement know when someone is stalking someone with an AirTag shows that the data is available to them.

Not technically correct. Apple devices (and Android phones with the appropriate app) detect if an unknown AirTag is moving with them and makes it home, possibly signalling a stalking attempt.

The heuristics for this happen locally; Apple isn't "aware" of this happening. That said, when you first set-up an AirTag, the serial is tied to your account. Therefore, when you physically find an unknown AirTag and report it to law enforcement, they can then subpoena (or get a warrant?) Apple for information on the AirTag owner's identity.

The serial itself, and any personal identifiers, are not used in the locating process, however.

This is well documented in the paper above, in articles, as well as in reverse engineering efforts.

[NavinF]

> they let law enforcement know when someone is stalking someone

Source? That's not a thing

[refulgentis]

+1