Hope in the future either Apple supports this more officially, or there is a way to use it with no direct link to my Apple ID or account. Until then, I am a spectator in these things.
Eventually they will capitalize more on the mesh density, rather than crushing the adoption now.
Trying to understand why apple doesn’t (or can’t?) already reject broadcast data from keys that are not apple products.
Until then, more devices are probably positive for reducing potential pitchforking.
That’s kind of how the whole system works.
My understanding of how it is all supposed to work:
You get a key-generating-key at provisioning time. The tag itself has three modes depending on whether it is in contact with one of your devices, and further whether it has been out of contact more than a certain period of time.
When not in contact, it will advertise itself with a rotating public key based partially on a rotating Mac address. An Apple device which sees it will encrypt location data based on that key and send it to apple to store under that public key as a mailbox. A device which continues to see it while moving will start to alert the person holding that device that there may be an AirTag tracking them.
The tag itself has NFC functionality which provides information for helping find the owner, and on Apple's side this is meant to be tied to a real identity to aid LE if there's an abuse scenario.
After a certain amount of time not seeing another device, an AirTag will start to make sounds to alert people where it is when an Apple device comes into range.
When you want to find your item, you anonymously query it under its rotating key information, and use your knowledge of the private key generation to get location information. Since there's nothing Apple uses to correlate these entries, there may be multiple records over time although Apple's UI only shows the newest entry found.
So yes, there's anonymity in being near devices but limited so that someone can know they are being tracked. There's anonymity in querying location. However, there's not meant to be anonymity with physical access.
“You will be asked for your Apple-ID, password and your 2FA”
You mean get another apple device and setup another account?
Apple did fight in court to not have to crack the San Bernardino shooter’s phone, which probably didn’t garner much sympathy with the general public, specifically against government power to compel them to make changes to subvert security.
They also publish a Transparency Report about government requests they’ve received and how many they’ve responded to.
It’s no use. All the opaqueness to Apple relies on
> This private key pair and the secret are never sent to Apple and are synced only among the user’s other devices in an end-to-end encrypted manner using iCloud Keychain.
Which is trivial to compromise from Apple. They do their best to minimize trackability from third parties though.
Explain this? Since both Apple and security researchers have worked on provable trust.
And we don’t even need to go as far as key exchanges, and forget about Find My. Maybe those are better protected and it’s harder for them to pull a sneaky without someone noticing. The location data of your phone isn’t in Secure Enclave and the OS can do whatever the hell it likes with it, good luck verifying a huge closed source OS which phones home all the time isn’t sending your location home. At the end of the day you’re trusting them (or just don’t care because you probably aren’t pissing off TLA, which is certainly true in my case), provable security is extremely limited.
All the big tech companies that have user data publish government data request transparency reports.
The government attempted to force them to write a new operating system for them that would allow them to get the data on the phone. This was never about the San Bernardino phone, everyone knew there was nothing of any use on it and everyone involved was dead. It was about getting precedent on record that they could force a company to backdoor their OS on a court order. They eventually dropped their request when it became obvious Apple wasn't going to roll over for them.
Your post reeks of some personal vendetta against Apple, and has no factual basis.
Which they are absolutely capable of, but refused to that time. People in this thread keep talking about provable trust when the software is fully under Apple’s control, which is just puzzling. It’s still a “trust me bro”. Whether you trust them due to past track record is something else. In fact, that you even need to bring up their refusal as evidence means you don’t believe they’re technically incapable of complying.
Apple have done work, and published tools for researchers, to make it so they can't "modify it in secret". The tools for security research community help verify that and "keep them honest". For instance, this is partly what the prompts about new devices or log in on other devices are about, there's a key exchange happening, and you get told. You can also exchange keys with Messages contacts to verify you're talking to them. You can turn on iCloud Advanced Security and Apple don't get even your backup keys. Also see the new Lockdown Mode.
Granted, Apple can change their minds and become anti-privacy or pro data-brokers and ad-tech, but some of these proofs would break so folks would know.
Anyway, if the government wants to know where you are, they can just ask the Chinese who've been watching Americans' cell phone identifiers move around.
In seriousness, the telcos already sell* this position data to data-brokers and law enforcement have portals to just watch you scurry around, even without a warrant.
* Sometimes telcos share your location data in ways that aren't "selling" so they can say they don't sell it. But the data goes and telcos derive value in exchange.
Your tag doesn't know its position, it simply broadcasts its own, rotating public key. Since the key changes randomly (in a way that you as the legitimate owner can predict), a third party can't easily follow the tag.
Other devices see that key, and share their position, encrypted with your tag's public key.
That makes it relatively hard to get the data, essentially impossible without forcing Apple to re-design the system and push malicious updates, which is generally considered as something that goes beyond what normal subpoenas can do.
Settings → your_name → Find My → device → toggle off
If you don't trust that this will really disable the feature, then you are going to have to think hard about every electronic device you own.
Do you trust the firmware in your Android phone? What about the non-open-source modem chip? What about the SIM card, which runs Java? Are there microphones you haven't noticed built in to your TV remote? (Many have them.) Your toaster likely has a chip in it more powerful than a networked DOS-era computer. (Mine does.) How do you know it's not joining a nearby wifi network and sending out information?
Ever since the China/iCloud thing, I don't fully trust Apple. But among big tech companies, it's certainly the one that I trust the most.
I doubt Samsung and Google have gone to such lengths with their trackers.
It's like, "oh, you want all your photos to be searchable, like 'dogs' or 'Eiffel tower'? Fine, we'll create an on-device embedding of each photo, use homomorphic encryption so you can share it with us and we can match it to its contents without even knowing what they are, then we'll send that back to your device for storage. Oh, and we'll use a relay so we don't even see your IP address while doing this, not that it matters since we can't decrypt the content anyway." It's pretty wild, like they could have easily skipped all this and only a fraction of a fraction of a fraction of users would even know or care.
In fact, I was pretty annoyed that the news story from the above example was "Apple is looking at all your photos and violating your privacy", since they spent so much effort doing it the right way, in a way that respects your privacy, it makes it less likely they will bother going through the effort again
https://www.theregister.com/2025/01/03/apple_enhanced_visual...
Not defending Apple here, but that's silly. User hostility and auto gobbling up data without consent is perfectly normal for most companies out there.
I guess you could make the argument "well what if one day they stop using homomorphic encryption", but that argument doesn't make much sense since 1) why would they and 2) you could already ask the same question today "what if they just started sending info anyway"
You are wrong and it's trivially verifiable. You can watch this years 38c3 video comparing them or read the nicely public specification.
I didn't look at the Google ones because I don't use a Google account. So I couldn't use them anyway.
But good to hear that they did design it well, I'll check that video.
The PMs don't understand that they should be catering to the people purchasing the devices.
I don't trust Samsung and Google as far as I can throw them but apparently in this case they did an ok job. And unfortunately there's no meaningful alternative to the duopoly of iOS and Android. So I was left with two bad choices.
But I don't trust any big tech no. It's just really hard to do without them, sadly.
My wife has ADD and she loses items often. Tiles aren't very loud and are flaky, we don't have an iPhone to use Airtags. I'm too exhausted to try to master the math needed to locate Bluetooth beacons, but I wish I could. I'd love for there to be a "just add 4 small Bluetooth boards" kind of software project, but it doesn't seem to scratch that itch for most open source devs.
I'd think of 2 or 3 AA batteries stuck to a small UWB PCB and stuck with tape of suitable type to the tool.
Are 10$ each doable? I don't see why not, but can't find any board akin to a Bluepill or ESP32-VROOM or PiPico containing the HF part.
The idea would be with base stations that can see each other well enough to synchronize and perform role-reversed pseudoranging to the tracker.
I don't think there will be equivalent alternatives, at least not ones with ultra wideband precision location functionality, availability, acceptable price, and robustness.
On the other hand there does seem to be some UWB support in some Android that might work with Tile's UWB: https://www.zdnet.com/article/how-to-enable-uwb-on-android-a...
Why are you so confidently spreading misinformation? Samsung SmartTag+ exists for years now with this precision and capability for Samsung Android phones.
Where does this wish to spread baseless misinformation come from?
You could have just pointed out the Samsung product.
How come you are so certain what the person was trying to say without asking a clarification question first?
Why are you so angry because I called out misinformation? Is spreading it so normalized to you these days that you get angry if someone highlights it?
I am not angry at all. I was just wondering why you reacted like that. Nevermind
It’s got ultra wide band finding which is nice, but you really need every single android device to have a truly comparable network.
https://www.bluetooth.com/learn-about-bluetooth/feature-enha...
Anyhoo, back in the day I was messing around with beacons and can tell you it's fairly easy to get them working. I wrote a small program to get my laptop to act like a beacon and used some random "bluetooth tracker" on my phone which would give the approximate distance to said beacon. Then it's just a matter of walking around watching the distance measurement.
Rather than using Bluetooth connection strength, it uses Ultra Wideband for precision location. This works on time-flight using the speed of light delay like GPS. When you open the Find My app it very quickly knows the exact distance to the AirTag, and then as you walk around it uses your observed change in position to determine the exact direction the AirTag is from you.
It's really cool tech! You need to use the "Find" feature in the Find My app and not the "Play Sound" feature. And it requires an iPhone 11+ with an H1 Ultra Wideband chip in it. Cost is probably on-par with setting up various bluetooth boards around the house, and way more accurate. Though not as much hackery fun.
https://en.wikipedia.org/wiki/Ultra-wideband#Real-time_locat...
https://github.com/hybridgroup/go-haystack?tab=readme-ov-fil...
I've since added them into all my cars, bags and a few honeypots embedded into high value items that might be stolen.