Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

How many of these third party devices can use every iPhone, iPad and more in the world as a beacon?


Tile uses everyone with the tile app installed. It's not the same by sheer numbers, but it's more than enough that if someone slips a tile tracker on you they will know where you're at. Or, if someone wants to spend a bit more money, not even much more, they can buy a full GPS tracker that doesn't need anything to report on it. Apple isn't coming out with some groundbreaking spy tech here, this is very routine stuff thats been in a small format forever. And guess what, none of the existing ones do anything to alert anyone of stalking, unlike Apple. I don't even like Apple but this is silly.


    Tile uses everyone with the tile app installed. 
    It's not the same by sheer numbers
It's not Apple's "fault" they're more popular but the end result is that these AirTags are orders of magnitude more potentially dangerous thanks the fact that there are orders of magnitude more iDevice users than Tile app users.

Imagine I'm some kind of creep looking for victims in a club or whatever. I'm planning to accomplish this by dropping Tiles into their bags.

Statistically, how many Tiles would I need to buy and sneak onto persons in order to have a reasonable chance of snaring a victim who just happens to have the Tile app installed? 50? 100? 1000? Not impossible, but not particularly feasible.

How many AirTags would I need to sneak onto victims? Perhaps only one, if they happen to use their phone in public and I see it's from Apple -- that's something I can tell at a glance, unlike wondering if they have the Tile app installed.


not to mention tile does it without notifying iphones of airtags or the beep when moved.


They don't need to? GSM radios have gotten tiny. Think literally any innocuous item and it can be fitted with a tracker.

Even a hairbrush: http://www.mccalltech.net/images/0TrackBrush.jpg


The limitation of any tracker is battery lifetime. The AirTag circumvents this by only using low power transmission and the network of all iPhones and iPads in the world, which then relay via their own wifi/4G.

What is certain is that we'll see sophisticated modifications to AirTags that (1) disable the beep, (2) disable anti-stalking.

Theoretically remote attestation and self-disabling anti-tamper could be used, but the potential wins for bypassing the Apple protocol are enormous, the Holy Grail of surveillance espionage.


"Holy Grail of surveillance espionage"... maybe the holy grail alarmist statements.

Why are firmware modifications for this "certain" first off?

And what modifications allow this to work as designed without setting off anti-stalking? If you somehow change the ID it's reporting which afaik is a signed value anyways, how are you going to get access to it's location?

If you don't disable anti-stalking then this is no better than run of the mill GPS trackers which can already run for days to weeks


Nation state attacks are certain because of the massive payoff if they are successful. Were you asleep when the Snowdon NSA leaks happened? [1]

If you can change the ID you can cycle through a list of valid IDs. You can even use it for bit rate comms, ~16 bits an hour or something, which is enough to signal events like "number of iDevices in vicinity", or, if other hardware is used, step count/hour, which works even in GPS denied environments.

The beacon location reported by Find My is generated by the reporting phones' GPS/cellular/wifi location system.

Regular GPS trackers have no means to exfil their data. They don't work in GPS denied environments (poor inside buildings, underground, anywhere a $20 jammer is enabled). OCGs routinely use low power GPS jammers now. Using GPS or 3G requires much more energy, and 3G is easily detected by motivated groups.

So while it might not be great for stalking your partner/ex, it is very tempting for professionals.

[1] https://nsa.gov1.info/dni/nsa-ant-catalog/


"Were you asleep when the Edward Snowden leak happened"

... yeah I'm not going to play this game.

Nation states are certainly doing better than AirTags if that's what you're worried about Secret Agent.

Passive trackers will let you pinpoint someone indefinitely.

And someone motivated is going to catch your spurious 3G emissions but miss an AirTag literally designed to be noticable?

Puhlease. If a nation state is chasing you and this is what turns the tides I strongly suggest turning yourself into their embassy now, save yourself the trouble.


You claimed that no one would go to the effort. It is clear that they will.

Nation states don't have a global network of iPhones.

> Passive trackers will let you pinpoint someone indefinitely.

How?

> Puhlease. If a nation state is chasing you and this is what turns the tides I strongly suggest turning yourself into their embassy now, save yourself the trouble.

"Puhlease" enjoy pretending that nation states are all IDF 8200 elite cyber hackers. The future ubiquity and deniability of these devices will see them feature widely. And some people do need to defend against skilled attackers who can buy custom gear from Shenzhen, and telling them to give up is stupid.


>How?

If an actual nation state is out to get you what's so difficult about tracking you from half a mile away? Surely they're not chasing someone who's actively evading them since you think this person won't find an... AirTag. Something that's actively transmitting at regular intervals and has NFC capabilities.

https://marshallradio.com/ww/product/field-marshall-digital-...

> Adding a Field Marshall UHF to your GPS system allows you to precisely locate the transmitter inside GPS denied environments (inside a building, or locate the signals when GPS satellites are blocked), or when the transmitter is in thick cover.

Or attaching a GPS tracker that logs to it's internal storage that they then recover?

> enjoy pretending that nation states are all IDF 8200 elite cyber hackers

You can't even stay internally consistent to your own fantasy. First you're saying these people will crack Apple's state-of-the-art firmware systems on a brand new platform and signing arrangements to boot, now suddenly they're script kiddies?

And honestly it's disgusting how shameless you are about shoving words in my mouth "telling them to give up" where the fuck did I say that?

Go find something useful to do kid.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: