Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

That is not how AirTags work. They do not reach out to Apple servers at all.

AirTags broadcast an encrypted ID. Phones build lists of ID’s they’ve seen and send the list to Apple.

There is no routing, no ability to send arbitrary data, no active communication of any sort. It’s not a mesh network.

The link you posted makes that pretty clear.

 help



An Apple airtag probably doesn't but it is apparently possible to send some data at a very low rate (the article in [1] says a few bits per hour) over the find my network [2]

[1] https://positive.security/blog/send-my

[2] https://github.com/positive-security/send-my


That's functionally the exact same thing, and if they wanted to send data they could encode it in the "ID".

uh, that is just all the iphones acting as a mesh network for airtag ID’s?

it means you can’t block the tracking by doing anything yourself - you’d also need to block everyone else’s devices too.


Mesh network typically means… a network. Unidirectional, best-effort, randomized IDs are not a network.

And of course you can block the tracking yourself, even though nobody is actually tracking because Apple can’t tell who owns what ID. Just turn off find my on your device.


They definitely meet the definition for a network. there is no requirement for determinism, bi-directional communication, etc. at least in the definitions I see for the word.

and turning it off on your device doesn’t actually block the info being communicated, merely the association where you can see it. and hopefully on their backend, but there is no technical requirement for it.

the whole point is everyone’s iphones forward airtag info for every airtag.


Fair point on the forwarding being non-disable-able. But I don’t see any privacy issue there. The forwarder provides observed obfuscated ID and location, which seems less fraught than even the signal strength metadata returned to cell towers.

I had misinterpreted “you can’t block the tracking” to mean of your own phone, rather than of devices that other people want tracked.


It joins phone location + tagid to provide location info of all tags. the backend then (hopefully) filters out tags people don’t want to track.

‘obfusication’ of IDs isn’t a meaningful thing here, or literally none of it would work.

the whole point of airtags is your phone doesn’t need to be anywhere near the tag to find it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: