Live data from Hacker News

Apple: Android is a tracking device [pdf]

justice.gov

11–20 of 87 posts

Re: Apple: Android is a tracking device [pdf]

#11
post #2

All smartphones are. There's only so much you can do to cover your track. There's most likely always someone knowing where you are if your phone is powered on (or even powered off with Apple Find My network). https://9to5mac.com/2021/06/07/ios-15-find-my-network-can-fi...

Find My does not leak user or device location to Apple or other users. The greatest info leak is “there is a find my device near me”.

Re: Apple: Android is a tracking device [pdf]

#12

This is so crazy to see. Usually when Apple faces the public, everything is super curated to sound pro-consumer, even if its anti-consumer. Sure this PDF doesnt venture far from it, they still paint Apple in the prettiest picture, but the terminology shows that Apple is basically doing the same thing as google but with slightly different methods to blur it. Heck, we don't actually know what is going on inside an iPho…

I always felt Apple pivoted to 'privacy' when they saw they had missed the race to harvest and monetise personal information.

Re: Apple: Android is a tracking device [pdf]

#13
post #11
post #2

All smartphones are. There's only so much you can do to cover your track. There's most likely always someone knowing where you are if your phone is powered on (or even powered off with Apple Find My network). https://9to5mac.com/2021/06/07/ios-15-find-my-network-can-fi...

Find My does not leak user or device location to Apple or other users. The greatest info leak is “there is a find my device near me”.

> The greatest info leak is “there is a find my device near me”.

Which is anonymous and the identity changes every 30 minutes or an hour, I forget which.

Re: Apple: Android is a tracking device [pdf]

#14

This is so crazy to see. Usually when Apple faces the public, everything is super curated to sound pro-consumer, even if its anti-consumer. Sure this PDF doesnt venture far from it, they still paint Apple in the prettiest picture, but the terminology shows that Apple is basically doing the same thing as google but with slightly different methods to blur it. Heck, we don't actually know what is going on inside an iPho…

> Heck, we don't actually know what is going on inside an iPhone, they could be combining accounts and sending data to Cambridge Analytica for all we know. You have a point. Apple depends so much on security by obscurity.

That’s true of everything you haven’t compiled yourself, using a compiler you wrote and bootstrapped yourself.

There is no technical proof that any of the software or hardware we use every day is trustworthy. There is, however, incentive alignment that makes it unlikely that companies do wild and crazy things.

Re: Apple: Android is a tracking device [pdf]

#15
post #3
post #2

All smartphones are. There's only so much you can do to cover your track. There's most likely always someone knowing where you are if your phone is powered on (or even powered off with Apple Find My network). https://9to5mac.com/2021/06/07/ios-15-find-my-network-can-fi...

Find My doesn’t actually map the device to an individual. Someone might know where the device which is currently broadcasting an ID is, but that ID rotates frequently, and can only be resolved to you using keys held against your Apple ID. The entire thing is specifically designed such that objects being tracked by Find My can’t be resolved to individuals, because the network depends upon publicly broadcasting those o…

Can ID be mapped to IMEI and by extension SIM or mobile number? If yes, then it can be resolved to individuals.

Re: Apple: Android is a tracking device [pdf]

#16

Title could probably use a “2013”

It hasn’t changed though, has it?

It really has, Android actually has privacy controls now which they definitely didn't in 2013. Developers can't request your location 24/7 without you even being aware of it like they could 10 years ago.

Re: Apple: Android is a tracking device [pdf]

#17

This is so crazy to see. Usually when Apple faces the public, everything is super curated to sound pro-consumer, even if its anti-consumer. Sure this PDF doesnt venture far from it, they still paint Apple in the prettiest picture, but the terminology shows that Apple is basically doing the same thing as google but with slightly different methods to blur it. Heck, we don't actually know what is going on inside an iPho…

In the Apple world, they basically carefully redefined privacy as "anyones else besides us getting access". They put themselves as a fully trusted party for everything.

How do you square that claim with E2EE and the way Find My works?

Re: Apple: Android is a tracking device [pdf]

#18
post #3
post #2

All smartphones are. There's only so much you can do to cover your track. There's most likely always someone knowing where you are if your phone is powered on (or even powered off with Apple Find My network). https://9to5mac.com/2021/06/07/ios-15-find-my-network-can-fi...

Find My doesn’t actually map the device to an individual. Someone might know where the device which is currently broadcasting an ID is, but that ID rotates frequently, and can only be resolved to you using keys held against your Apple ID. The entire thing is specifically designed such that objects being tracked by Find My can’t be resolved to individuals, because the network depends upon publicly broadcasting those o…

Yeah, the GPS location (of the finder device) is encrypted using the ID as encryption key before uploading to Apples servers, so unless the owner of the device actually looks for it, Apple doesn't even know who the encrypted blob they can't read belongs to.

Re: Apple: Android is a tracking device [pdf]

#19
post #15
post #3

Earlier quoted context omitted.

Find My doesn’t actually map the device to an individual. Someone might know where the device which is currently broadcasting an ID is, but that ID rotates frequently, and can only be resolved to you using keys held against your Apple ID. The entire thing is specifically designed such that objects being tracked by Find My can’t be resolved to individuals, because the network depends upon publicly broadcasting those o…

Can ID be mapped to IMEI and by extension SIM or mobile number? If yes, then it can be resolved to individuals.

No, the "Find My" identifiers cannot be mapped to an IMEI except by the user to whose account the device is registered.

Re: Apple: Android is a tracking device [pdf]

#20
post #15
post #3

Earlier quoted context omitted.

Find My doesn’t actually map the device to an individual. Someone might know where the device which is currently broadcasting an ID is, but that ID rotates frequently, and can only be resolved to you using keys held against your Apple ID. The entire thing is specifically designed such that objects being tracked by Find My can’t be resolved to individuals, because the network depends upon publicly broadcasting those o…

Can ID be mapped to IMEI and by extension SIM or mobile number? If yes, then it can be resolved to individuals.

It can not.

The master private key used by the system is generated locally and never leaves your Apple devices in a state that anyone except your devices can read it.

The master key is used to derive an AirTag specific private key which is provisioned to the AirTag and is in turn combined with an increasing counter which generates a third private key that's never stored anywhere. The ID broadcast is the public key of this third key. It changes every 30 minutes or 1 hour, I forget which.

Other devices see this key, use it to encrypt their own location, and upload that encrypted blob along with the public key to Find My, and in order for Apple to even know which account the encrypted blob they can't decrypt belongs to I have to actually request the location of my AirTag by locally deriving the keypair it used for a certain point in time.

Post reply on HN