How does Apple privately find offline devices? • Hacker News Board

Re: How does Apple privately find offline devices?

#131

Post by Too » Thu, Jun 06, 2019, 7:29 AM UTC

SlowRobotAhead wrote: post #2

>can use a single [private] key regardless of which randomized version of her public key was used to encrypt. I have not seen this before. Trying to wrap my brain around how this works. In terms of ECC I thought public and private were a single pair. Can anyone explain what is going on with public key randomization?

Just speculating but would something like random_key=hash(static_key + datetime) work? static_key is pre-shared between cloud and device and datetime is also known by both device and cloud if rounded down to some accuracy.

Re: How does Apple privately find offline devices?

#132

Post by LordDragonfang » Thu, Jun 06, 2019, 7:49 AM UTC

Phlarp wrote: post #95

HALtheWise wrote: post #89

Earlier quoted context omitted.

Or they have decided that it's too creepy to use at all, so they don't use it for targeted advertising. Seriously, why does everyone assume that companies are evilly cackling in volcano lairs? They know that violating user trust is really expensive and a bad idea. By the way, I'm pretty sure I've seen that Google's advertising targeting is only allowed to use "neighborhood level" location, which is designed to be coa…

Because time and time again it is proven that "these companies" (Facebook and Google) will use any signal they can get their hands on to make money? I'm pretty sure they've both been caught with their hands in the cookie jar doing things they swore they never would.

Genuinely curious, could you provide an example of Google "doing things they swore they never would" with consumer data? Because I know they do plenty of things with data that people think are creepy, but I don't recall ever seeing a story about them doing things they swore they wouldn't (besides the nebulous "don't be evil") or even lying about what they were actually doing with consumer data.

If it's happened time and time again, it should be easy to pull up a source, right?

Re: How does Apple privately find offline devices?

#133

Post by FridgeSeal » Thu, Jun 06, 2019, 7:51 AM UTC

HALtheWise wrote: post #89

Phlarp wrote: post #75

Earlier quoted context omitted.

Or they do and have internally assessed that it would be too creepy to provide to users, but are happily using it to better target advertising.

Or they have decided that it's too creepy to use at all, so they don't use it for targeted advertising. Seriously, why does everyone assume that companies are evilly cackling in volcano lairs? They know that violating user trust is really expensive and a bad idea. By the way, I'm pretty sure I've seen that Google's advertising targeting is only allowed to use "neighborhood level" location, which is designed to be coa…

Because corporations have an underlying profit motive, so if there’s something that they _can_ do to make money, they will almost certainly try?

This isn’t a controversial point, it’s well observed.

Re: How does Apple privately find offline devices?

#134

Post by helloindia » Thu, Jun 06, 2019, 7:56 AM UTC

president wrote: post #92

kccqzy wrote: post #80

Earlier quoted context omitted.

Thieves already know that stolen iPhones are usually not operable. Even with the old Find My iPhone, even after the device has been wiped, only the original owner can activate it again. So these stolen phones are usually broken down, with parts sold separately.

They are getting smarter. A family member had their phone stolen and Find My iPhone reported that the phone was off for months and so she gave up searching. One day, she got a text on her new phone saying "Find my iPhone has found your phone, click here to login to Find my iPhone". It turned out to be a phishing page for her AppleID credentials. She fell for it and I'm assuming the thieves were able to finally get in…

Brian Krebbs covered phishing of users who lost their iPhones, although he doesn't talk about how the "thief" managed to retrieve phone number from the the stolen phone.

https://krebsonsecurity.com/2017/03/if-your-iphone-is-stolen...

Re: How does Apple privately find offline devices?

#135

Post by dewey » Thu, Jun 06, 2019, 8:01 AM UTC

rampant_ai wrote: post #106

president wrote: post #92

Earlier quoted context omitted.

They are getting smarter. A family member had their phone stolen and Find My iPhone reported that the phone was off for months and so she gave up searching. One day, she got a text on her new phone saying "Find my iPhone has found your phone, click here to login to Find my iPhone". It turned out to be a phishing page for her AppleID credentials. She fell for it and I'm assuming the thieves were able to finally get in…

> To this day I have no idea how they were able to get her phone number Guessing here but maybe using "emergency call" and another phone to get the caller ID?

How would that work? I though you can only call emergency numbers from that mode?

Re: How does Apple privately find offline devices?

#136

Post by mjlee » Thu, Jun 06, 2019, 8:07 AM UTC

A potential concern - does this system implement forward secrecy? Is that even possible?

The threat I'm thinking of is some organisation that is able to crack the private key at some point in the future and therefore able to work out where you have been in the past.

Of course, the phone's location in the recent past is exactly what this system is designed to produce. Would it be possible to rekey the connection on a regular/opportunistic basis?

Re: How does Apple privately find offline devices?

#137

Post by Cthulhu_ » Thu, Jun 06, 2019, 8:13 AM UTC

m463 wrote: post #118

dylan604 wrote: post #103

Earlier quoted context omitted.

It's not just NZ. Police in the US are no better. In the Dallas PD, the detective assigned to the case when our house was burgled would not respond to emails sent to him providing evidence. After reaching out through other avenues to reach the detective, he flat out responded with being too busy to read emails. The case went uncleared. However, a few weeks later, there was a random call saying they found an iPad repo…

I've noticed in my lifetime that a number of crimes have become ad-hoc decriminalized. Smaller crimes like bicycle theft or small electronics are basically "who cares" to the police. Many police departments don't even do bicycle registrations anymore. Even car theft has sort of fallen to insurance companies to take care of. A lot of people just want a police report to turn in to insurance so they can get a new car. I…

I'm sure they prefer to focus on bigger cases - why go with a single bike theft if they can investigate an organized bike theft and laundering organization? Why bother with a single phone theft if they find a warehouse full of stolen merchandise?

But yeah, that does mean a lot of petty crime goes unpunished. Stealing a bike here has become normalized - as in, "my bike got stolen, I need to get home so I'll just steal another". Mind you that's only possible with shoddy locks.

Re: How does Apple privately find offline devices?

#138

Post by neuronic » Thu, Jun 06, 2019, 8:17 AM UTC

sapphire_tomb wrote: post #130

erikpukinskis wrote: post #104

Earlier quoted context omitted.

Legally could you go get it, and in the resulting skirmish perhaps attract the attention of the police? Is trespassing to retrieve stolen property still trespassing?

This reminds me of a (probably apocryphal) story a South African friend of mine told me once about the state of policing down there in the late nineties / early noughties. The story goes that a man wakes up in the middle of the night to the sound of burglars looting his garage. Given the occurences of aggravated robberies in SA at the time, often involving guns, he didn't want to confront the miscreants himself, and…

With the gist of the story being that "no units free" actually meaning "no units free to prioritize a burglary", or what?

An active shooting incident would certainly reshuffle the prio list...

Re: How does Apple privately find offline devices?

#139

Post by SmellyGeekBoy » Thu, Jun 06, 2019, 8:28 AM UTC

tinymint wrote: post #77

crazygringo wrote: post #74

Can this be used as essentially 100% effective anti-theft? If an Apple device is constantly emitting a BLE beacon code that can't effectively be changed in any way by a thief... ...then unless a thief keeps the device in their basement and never has anybody visit, your stolen device will almost certainly be detected sooner or later, and then you just call the police? Even if the thief has sold it by that point and di…

Not 100% effective - device could still be stolen and parted out

If only Apple would sell spares through official channels, it would reduce the incentive to steal iPhones even further.

Re: How does Apple privately find offline devices?

#140

Post by shitals » Thu, Jun 06, 2019, 8:36 AM UTC

TLDR; The idea of the new system is to turn Apple’s existing network of iPhones into a massive crowdsourced location tracking system. Every active iPhone will continuously monitor for BLE beacon messages that might be coming from a lost device. When it picks up one of these signals, the participating phone tags the data with its own current GPS location; then it sends the whole package up to Apple’s servers.