[a12k]

Incredibly cool. I am constantly amazed by these efforts and the find my network is a really impressive thing. What’s stopped me from using anything like this ever is the fact that I’m confident that at some point Apple will either embrace this sort of piggybacking on the network and open it up more officially, or it will ban any Apple ID that has ever been associated with such things. Right now they know about this and are not commenting either way.

Hope in the future either Apple supports this more officially, or there is a way to use it with no direct link to my Apple ID or account. Until then, I am a spectator in these things.

[malmeloo]

The process of requesting locations for a certain tag is not tied to any Apple Account. In the instructions in the README, when logging into macless haystack, you can just use a burner account.

[ustad]

Where does it say about burner account?

“You will be asked for your Apple-ID, password and your 2FA”

You mean get another apple device and setup another account?

[malmeloo]

It doesn't mention a burner account anywhere, but as the author of FindMy.py, I happen to know how this stuff works :-). But yes, create a new account (either through an Apple device or the website or w/e), attach it to an Apple device or hackintosh at least once, then log out again.

[tossit444]

Doesn't Apple force SMS 2FA on accounts? I remember trying to use Apple Music some years back and it needed me to give a phone number.

[ValentineC]

Yes, but phone numbers can be used across multiple Apple accounts.

[DanAtC]

What if they shitlist all accounts using the same phone number?

[mmooss]

How is privacy protected? I wouldn't want everyone tracking my airtags.

[dwaite]

It is a cryptography heavy, privacy-oriented protocol somewhat specific to the behavior apple wants, which is tied to social behavior. E.g. it is meant to track lost items, not stolen items and not people.

My understanding of how it is all supposed to work:

You get a key-generating-key at provisioning time. The tag itself has three modes depending on whether it is in contact with one of your devices, and further whether it has been out of contact more than a certain period of time.

When not in contact, it will advertise itself with a rotating public key based partially on a rotating Mac address. An Apple device which sees it will encrypt location data based on that key and send it to apple to store under that public key as a mailbox. A device which continues to see it while moving will start to alert the person holding that device that there may be an AirTag tracking them.

The tag itself has NFC functionality which provides information for helping find the owner, and on Apple's side this is meant to be tied to a real identity to aid LE if there's an abuse scenario.

After a certain amount of time not seeing another device, an AirTag will start to make sounds to alert people where it is when an Apple device comes into range.

When you want to find your item, you anonymously query it under its rotating key information, and use your knowledge of the private key generation to get location information. Since there's nothing Apple uses to correlate these entries, there may be multiple records over time although Apple's UI only shows the newest entry found.

So yes, there's anonymity in being near devices but limited so that someone can know they are being tracked. There's anonymity in querying location. However, there's not meant to be anonymity with physical access.

[jki275]

The data passes through any devices in the vicinity -- but they can't read the data unless they've got the private key to that tag.

[menzoic]

>I wouldn't want everyone tracking my airtags.

That’s kind of how the whole system works.

[mmooss]

I thought it was designed to prevent unwanted people from tracking you. If I bought an airtag, you could track it? Without authentication or authorization?

[malmeloo]

Only if you have the private key belonging to the AirTag at the time of location capture. Anyone can download encrypted location reports for any AirTag found in the wild, but only the owner can decrypt them with the private key.

[hattmall]

So how does one get the private key for an airtag without associating it to their account?

[yardstick]

What about the Apple account of the tag itself?

[malmeloo]

These custom tags are not tied to any account; Apple can't tell whether a tag found in the wild is "legit" or not, so registering it is not necessary. You can use your main account if you want, but if you request too many location reports too often, they will ban your account.

[jcutrell]

I think there is some positive effect potential for Apple to let this slide. The broader this network is, the more adoption it receives. P2P as a super-structure has always been a bigger than vendor problem; adoption by any means is likely an allowable tradeoff, especially since Apple doesn't have to do the work here.

Eventually they will capitalize more on the mesh density, rather than crushing the adoption now.

[malmeloo]

Except that custom tags like these do not require an Apple device in order to use them, so the size of the network is not increased. They only increase the load on the network. FindMy is not a P2P/mesh network; all these tags do is broadcast keys which are picked up by iDevices, which then upload those reports to Apple.

[koolba]

Are the keys not tied to known apple products? Or do you make them up when you first register a device?

Trying to understand why apple doesn’t (or can’t?) already reject broadcast data from keys that are not apple products.

[malmeloo]

Two master secrets are randomly generated when pairing the AirTag for the first time, which are then saved to the iCloud keychain. Those secrets are then used to generate a new keypair every 15 minutes (at most), and the public key is broadcasted by the tag. Not only does Apple not know what the master secrets are in the first place (because they're stored in the keychain), but that's also an insane number of keys to compare against, with no real possibility to precompute them. And that's a big win in terms of privacy.

[prepend]

I would guess because they don’t care. The marginal cost is zero and I think they would only bother if someone ddoses or it becomes an issue.

Until then, more devices are probably positive for reducing potential pitchforking.