Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How does Apple privately find offline devices?

blog.cryptographyengineering.com

Post reply on HN
Print view View original

61–70 of 184 posts

Re: How does Apple privately find offline devices?

#61

Post by walterbell »

m463 wrote: post #59
ladberg wrote: post #28

Earlier quoted context omitted.

Complete speculation here, but I wouldn't be surprised if devices could keep broadcasting the ping after they're "dead". Tiles last for years without charging, so I bet if Apple can leave on only the bluetooth beacon after the battery drains past where it can power the rest of the phone then this would be doable. Again complete speculation, I have zero clue if the current hardware is even capable of doing this.

recent apple phones have NFC, which cannot be disabled.

Can NFC be used by iOS applications, e.g. SSH authentication via smartcard, where the private key never leaves the card?

Re: How does Apple privately find offline devices?

#62

Post by nerpderp82 »

RosanaAnaDana wrote: post #54
jdironman wrote: post #35

Earlier quoted context omitted.

Probably just looked at the last data point depending on the type of data was available. If its longitude / latitude values then its going to be pretty precise, although I would also like to know where to pull more granular data.

The GPS receiver isnt' sufficiently accurate for one point to be useful, but in aggregate, it was accurate 'enough'. So although the numerical precision is pretty high, the actual accuracy is pretty low, I think I pulled all the points from 2am-6pm in the final time stamp to figure out where the phone was.

Envious, nay jealous of a room of that size.

Re: How does Apple privately find offline devices?

#63

Post by m463 »

ladberg wrote: post #23
JohnFen wrote: post #18

> The good news is that Apple claims that their system actually does provide strong privacy, and that it accomplishes this using clever cryptography. But that does nothing to protect your privacy against Apple. I already have to make sure that I disable WiFi and Bluetooth when I enter commercial establishments. Now I have to stop using Bluetooth whenever I leave my house?

Why do you do that? All Apple devices generate randomized MAC addresses for networks that they haven't connected to, so they shouldn't be able to track you. In addition, no other actors will be able to gain useful information from the bluetooth pings, they simply forward the encrypted data to Apple. All they can tell is that an Apple device exists nearby, but not who owns it or if they've seen the same device before.…

...Unless you have a private wifi AP you connect to. Then your device is individually identifiable and trackable.

In addition, I believe apps that use ibeacon technology can respond to specific ibeacons. But I think your phone can become a beacon.

I suspect (but am not certain) that if your phone is running app XYZ it can talk to other phones running XYZ through the XYZ registered beacons (if location services are on for app XYZ).

Also, just for an interesting example of where some of this stuff can go... The target app will change the price of an item if it finds you are in a store (search "target app price switch").

Re: How does Apple privately find offline devices?

#64

Post by snazz »

etaoins wrote: post #51
snazz wrote: post #31

Earlier quoted context omitted.

The current hardware might not be, but you could run this on a secondary chip similar in specs to the T2 or Secure Enclave. You could theoretically even have a second battery specifically for this purpose, but that would likely be cost-prohibitive.

The T2 chip is a derivative of the A10. It has similar power requirements to the SOC in modern iPhones. They could probably use a cut down derivative of the W2 chip used in AirPods with the audio codec etc. removed. I’m guessing phone batteries reach a point where they’re still storing energy but can’t provide enough current to safely boot the whole phone. The BLE chip could sip on the remainder of the battery for a…

That sounds reasonable. I had no idea the T2 was that powerful.

Re: How does Apple privately find offline devices?

#65

Post by evan_ »

rootusrootus wrote: post #17
RIMR wrote: post #10

Okay, so this would make it insanely easy to stalk any iPhone user. 1. Get BLE tracking tags, and register them with Find My. 2. Covertly attach the BLE tracking tags to things your target owns (backpacks, cars, bikes, etc). 3. You constantly get updates on your tags locations via their iPhone and other iOS devices near the BLE tag(s). This gives you their approximate location and movement history, facilitated primar…

Wouldn't this be already possible (and a lot cheaper) using something like Tile?

Yes, except you'd need to get your target to install the Tile app and use it frequently enough that it keeps background location privs.

If Apple does come out with a cheap Tile-type device with a then this could be a legit concern. If you hid one in a person's belongings then you'd get hits from their phone- and turning it off wouldn't work, because random passersby would report their location as well.

This could even be better (worse) than spy-gear standalone GPS trackers because the battery would last for a very long time.

Re: How does Apple privately find offline devices?

#66

Post by doctoboggan »

JohnFen wrote: post #18

> The good news is that Apple claims that their system actually does provide strong privacy, and that it accomplishes this using clever cryptography. But that does nothing to protect your privacy against Apple. I already have to make sure that I disable WiFi and Bluetooth when I enter commercial establishments. Now I have to stop using Bluetooth whenever I leave my house?

Did you read the article? The author discussed exactly how they are able to hide sensitive data from Apple.

Re: How does Apple privately find offline devices?

#67

Post by m463 »

Xylakant wrote: post #30
berbec wrote: post #24

Earlier quoted context omitted.

NFC is passive until powered by an external signal. It's very short range, but it does not require internal power. There could be a longer range version at some point.

Yes, but an NFC tag cannot initiate a connection on its own volition. And that’s very much a feature I like in WiFi: I can actively start downloading something. A WiFi card that only responds to an external ping is useless.

I think what berbec is saying is maybe you can locate an NFC device that has a depleted battery.

That said, I don't know if apple NFC works that way. Apple can use NFC to read nearby NFC tags, and possibly become an NFC tag, but I don't know if it can respond in a static way without power.

Re: How does Apple privately find offline devices?

#68

Post by jey »

sixstringtheory wrote: post #43
judge2020 wrote: post #32

Earlier quoted context omitted.

As it says on the page, this is to make sure a bunch of things still work (eg. you wouldn't really thing you need to keep Bluetooth enabled to use the pencil). Maybe the toast text "disconnecting nearby Wi-Fi until tomorrow" could be a little clearer.

From day one I’ve wanted a way to disable the automatic-reenabling feature.

Use airplane mode then enable each one individually?

Re: How does Apple privately find offline devices?

#69

Post by xvector »

JohnFen wrote: post #18

> The good news is that Apple claims that their system actually does provide strong privacy, and that it accomplishes this using clever cryptography. But that does nothing to protect your privacy against Apple. I already have to make sure that I disable WiFi and Bluetooth when I enter commercial establishments. Now I have to stop using Bluetooth whenever I leave my house?

> But that does nothing to protect your privacy against Apple.

Absolutely not true. This is E2EE. This is the whole point of the article.

Re: How does Apple privately find offline devices?

#70

Post by crazygringo »

RosanaAnaDana wrote: post #48
machinesmachine wrote: post #34

Earlier quoted context omitted.

Also interested. Could you describe the process?

Sure. I pulled my data in the standard takeout.google.com/ process. The result is a json (? iirc). I parsed the json into x, y, and rasterized it using gdal. https://imgur.com/a/ZhyTsDV See I wasn't sure if I lost it in the couch in the living room, the office, or the bedroom. This got me within a few feet.

That's amazing, so cool.

Is that something Google's not doing with the data, but could? (E.g. they don't because their maps don't show most houses precisely enough or whatever, so it wouldn't be useful?)

Or is it relying on the fact that you are triangulating or similar from the known exact position of your WiFi routers or similar down to the inch, and Google doesn't have any way of knowing that?

Post reply on HN