Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How does Apple privately find offline devices?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

31–40 of 184 posts

Re: How does Apple privately find offline devices?

#31

Post by snazz »

ladberg wrote: post #28
ShakataGaNai wrote: post #6

The problem I see with this is that your phone always has to be broadcasting the BLE beacon, regardless of if it is lost or not. Otherwise it could randomly end up lost in a place with poor/no service... and would never be found For phones, how often is this really an issue? Sure, this is useful for the Tile type "dumb" devices... but if my phone has no cell or data service... it's probably because the battery is dea…

Complete speculation here, but I wouldn't be surprised if devices could keep broadcasting the ping after they're "dead". Tiles last for years without charging, so I bet if Apple can leave on only the bluetooth beacon after the battery drains past where it can power the rest of the phone then this would be doable. Again complete speculation, I have zero clue if the current hardware is even capable of doing this.

The current hardware might not be, but you could run this on a secondary chip similar in specs to the T2 or Secure Enclave. You could theoretically even have a second battery specifically for this purpose, but that would likely be cost-prohibitive.

Re: How does Apple privately find offline devices?

#32

Post by judge2020 »

berbec wrote: post #21
JohnFen wrote: post #18

> The good news is that Apple claims that their system actually does provide strong privacy, and that it accomplishes this using clever cryptography. But that does nothing to protect your privacy against Apple. I already have to make sure that I disable WiFi and Bluetooth when I enter commercial establishments. Now I have to stop using Bluetooth whenever I leave my house?

It gets worse: if you turn off wifi/bluetooth in control center, it only disconnects, keeping the radio active. 1: https://support.apple.com/en-us/HT208086

As it says on the page, this is to make sure a bunch of things still work (eg. you wouldn't really thing you need to keep Bluetooth enabled to use the pencil). Maybe the toast text "disconnecting nearby Wi-Fi until tomorrow" could be a little clearer.

Re: How does Apple privately find offline devices?

#33

Post by gervase »

honopu wrote: post #26
ladberg wrote: post #23

Earlier quoted context omitted.

Why do you do that? All Apple devices generate randomized MAC addresses for networks that they haven't connected to, so they shouldn't be able to track you. In addition, no other actors will be able to gain useful information from the bluetooth pings, they simply forward the encrypted data to Apple. All they can tell is that an Apple device exists nearby, but not who owns it or if they've seen the same device before.…

Did not know this. I figured all those wifi connections I get near stoplights were slurping up mac addresses to track people. I wonder if it generates a mac address every single time or just upon first interaction with a wifi network it doesn't know about?

Apparently the initial implementation (iOS 8) randomized it every time the screen sleeps or wakes. I wasn't able to find any recent documentation detailing the current behavior - probably similar?

Re: How does Apple privately find offline devices?

#34

Post by machinesmachine »

mehrdadn wrote: post #27
RosanaAnaDana wrote: post #16

Total aside, but kinda relevant. I lost my phone like a dufus about a two weeks ago. Battery died and I had no idea where it was. When I pulled the my google location history, it was too coarse to tell me anything other than 'at your house'. However, I was able to pull the raw data from google and post process it by time stamp into a series of rasters that were fine enough for me to see that the phone was definitely…

This is interesting. By the raw data you mean from Google Takeout, or something else? Did you have to filter/smooth the data points?

Also interested. Could you describe the process?

Re: How does Apple privately find offline devices?

#35

Post by jdironman »

mehrdadn wrote: post #27
RosanaAnaDana wrote: post #16

Total aside, but kinda relevant. I lost my phone like a dufus about a two weeks ago. Battery died and I had no idea where it was. When I pulled the my google location history, it was too coarse to tell me anything other than 'at your house'. However, I was able to pull the raw data from google and post process it by time stamp into a series of rasters that were fine enough for me to see that the phone was definitely…

This is interesting. By the raw data you mean from Google Takeout, or something else? Did you have to filter/smooth the data points?

Probably just looked at the last data point depending on the type of data was available. If its longitude / latitude values then its going to be pretty precise, although I would also like to know where to pull more granular data.

Re: How does Apple privately find offline devices?

#36

Post by [deleted] »

ladberg wrote: post #23
JohnFen wrote: post #18

> The good news is that Apple claims that their system actually does provide strong privacy, and that it accomplishes this using clever cryptography. But that does nothing to protect your privacy against Apple. I already have to make sure that I disable WiFi and Bluetooth when I enter commercial establishments. Now I have to stop using Bluetooth whenever I leave my house?

Why do you do that? All Apple devices generate randomized MAC addresses for networks that they haven't connected to, so they shouldn't be able to track you. In addition, no other actors will be able to gain useful information from the bluetooth pings, they simply forward the encrypted data to Apple. All they can tell is that an Apple device exists nearby, but not who owns it or if they've seen the same device before.…

[deleted]

Re: How does Apple privately find offline devices?

#37

Post by judge2020 »

dmitrygr wrote: post #11
RIMR wrote: post #10

Okay, so this would make it insanely easy to stalk any iPhone user. 1. Get BLE tracking tags, and register them with Find My. 2. Covertly attach the BLE tracking tags to things your target owns (backpacks, cars, bikes, etc). 3. You constantly get updates on your tags locations via their iPhone and other iOS devices near the BLE tag(s). This gives you their approximate location and movement history, facilitated primar…

I have no idea how the FindMy BLE system works, but i strongly suspect that the cheaperst compatible "tag" you will find will be an iPhone. Might get a tad expensive to do this...

Assuming the newest ipod touches will work with this, $200 is the cheapest you could do this with in terms of using an iOS device (not that i'm suggesting this is a great option. As pointed out by the other second-level comments, you could just use tile or a real gps tracker without needing iOS).

Re: How does Apple privately find offline devices?

#38

Post by marcinzm »

Fnoord wrote: post #19
Slippery_John wrote: post #15

Earlier quoted context omitted.

I can think of several scenarios: * I lost the phone hiking somewhere with no signal * I lost the phone / it was stolen while in airplane mode * I lost the phone while traveling abroad without any local service This finding service will work for wifi-only ipads, wifi-only apple watches, and macbooks in addition to the likely tracking tokens.

Stolen while in airplane mode, and you're going to rely on BLE? A "good" thief would learn that he'd need to carry around a Faraday cage (read: some tinfoil) to block the signals. The only disadvantage is that the act of putting tinfoil around an iPhone then becomes suspicious.

They'd just have a tinfoil lined bag. No suspicion. I bet you can buy one one Amazon for next to nothing as it is.

Re: How does Apple privately find offline devices?

#39

Post by [deleted] »

berbec wrote: post #21
JohnFen wrote: post #18

> The good news is that Apple claims that their system actually does provide strong privacy, and that it accomplishes this using clever cryptography. But that does nothing to protect your privacy against Apple. I already have to make sure that I disable WiFi and Bluetooth when I enter commercial establishments. Now I have to stop using Bluetooth whenever I leave my house?

It gets worse: if you turn off wifi/bluetooth in control center, it only disconnects, keeping the radio active. 1: https://support.apple.com/en-us/HT208086

[deleted]

Re: How does Apple privately find offline devices?

#40

Post by alexkavon »

Fnoord wrote: post #19
Slippery_John wrote: post #15

Earlier quoted context omitted.

I can think of several scenarios: * I lost the phone hiking somewhere with no signal * I lost the phone / it was stolen while in airplane mode * I lost the phone while traveling abroad without any local service This finding service will work for wifi-only ipads, wifi-only apple watches, and macbooks in addition to the likely tracking tokens.

Stolen while in airplane mode, and you're going to rely on BLE? A "good" thief would learn that he'd need to carry around a Faraday cage (read: some tinfoil) to block the signals. The only disadvantage is that the act of putting tinfoil around an iPhone then becomes suspicious.

Someone could wrap a phone in tinfoil pretty quickly or have one ready-made in the shape of a pouch. Or start carrying a special pouch that stops signals.[0]

Either way once you remove the phone from sight, the suspicion is probably over. The only next step is to kill the signal.

[0] https://www.overyondr.com/howitworks

Post reply on HN