6 ms·
It feels like that can be exploited in some ways. As a first thought it reduces the privacy of the reporting 3rd party phone. I.e. I can leave a fully charged p
by lixtra 7y ago
It feels like that can be exploited in some ways. As a first thought it reduces the privacy of the reporting 3rd party phone. I.e. I can leave a fully charged phone in my wife’s car and track her for weeks while she will have the burden to recharge her phone for network/gps power.
A regular gps tracker would need much more energy.
Edit: another scenario, leave it in an isolated hut. If I get a signal, someone is close to the hut.
Edit 2: if I piggy back the protocol and can manipulate the key schedule (chose key A or B) then I can leak one bit of information through the third party phone. The third party phone may be allowed to communicate while my sender isn’t.
- rando444 7y agoPlaces like shopping malls use just your devices hardware ids to track your movements. To me just the fact that these things are on when you ask for them to be off is problematic.
- slig 7y agoiOS does shuffle the MAC address in order to prevent this, doesn't it?
- djchen 7y agoYes, except if you connect to their WiFi.
- oflannabhra 7y agoYes, on top of this, applications don’t have access to a devices MAC address through CoreBluetooth, so they can’t fingerprint a device.
- baybal2 7y agoYou can shuffle your mac but not your gsm/3g ids broadcasted in the open as per spec. I first saw this tech, I think, 9 years ago when I first encountered a "bluetooth spam" device
- lixtra 7y agoIf device A and B (both identified by their IP) both see device C (identified by hash of key) I can infer that A and B are close to each other.
- MBCook 7y agoThat only works if the devices report WHO saw the missing device. If they both report up that the device is in the area ask but don’t say who is making the report then you can’t figure that out.
- lixtra 7y agoApple sees the reporting device’s ip-address. Obviously Apple is in an excellent position to spy you anyway, but the claim that even Apple doesn’t know where the turned off device is doesn’t hold for the reporting devices: Apple can infer which reporting devices are in proximity. And they possibly even know who the reporting IP is because of iCloud.
- bonestamp2 7y agoI guess that's true, but mobile device IP addresses cover a pretty wide area so it's not terribly precise.
- lixtra 7y agoBut reporting device A and B were in Bluetooth distance to lost device C. Therefore A and B were close together (like a few meters). It’s a huge improvement over A and B were in the same mobile cell. You can then use the IPs to identify who are A and B.
- amelius 7y ago> I can leave a fully charged phone in my wife’s car and track her for weeks You could do the same thing with a regular phone with an app that uses GPS. Just attach a powerbank if you're concerned about the power.
- m463 7y agoJust the fact that the device is being extra promiscuous on multiple frequencies is annoying enough. I wonder if you can turn off "Find My" just like "find my iphone" and it will prevent these sorts of things.
- antijava 7y agoIf you turn off Find My iPhone it will also disable the new Bluetooth beaconing feature.
- joosters 7y agoAnother scenario, leave it in an isolated hut. If I get a signal, someone is close to the hut. You could do that already with a device, just by making an app that listens for Bluetooth or WiFi traffic. You’d also be able to grab MAC addresses of the nearby phones. Your ‘exploit’ isn’t revealing any more than you can already discover today.
- guiambros 7y agoExcept in the case of Find My you don't need any connectivity in the hut whatsoever. If you build your own BT or WiFi sniffer, you won't be able to piggyback on someone else's internet connectivity.
- BoorishBears 7y agoIf there’s internet connectivity, and you’re sophisticated enough to be planning Find My iPhone based booby traps, firing off a text message from a contained detector shouldn’t be a challenge
- lurking_around 7y agoYou can already do this with a Tile. Leave a Tile in your wife's car and every phone with the Tile app in her vicinity will report her location to you.
- iforgotpassword 7y ago> ... every phone with the Tile app ... So effectively none. I've never even heard of Tile before this. Leveraging the whole Apple ecosystem for this sounds a lot more promising and will probably kill any competitor that depends on installing an app, even if that supports multiple platforms.
- tjoff 7y agoAnd more importantly: opt-in.
- zer0gravity 7y agoHow about the fact that Apple created an unregulated, opaque mesh network from its own devices? No guarantees are provided that this network, under Apples's exclusive control, won't relay other type of information.
- abtinf 7y agoNSA seems to be pretty happy with regulated networks.
- zer0gravity 7y agoIt's probably even happier with unregulated ones...
- baxtr 7y agoAnecdotally: a friend of mine left his iPad in his wife’s car. When looking for through Find My iPhone, he realized that she’s at her ex-boyfriend’s place. He is married happily to another wife now...
- lixtra 7y agoIf you have a subpoena to sniff data to Apple from device X then you can use that to some extent track the location of X by spreading your Tags T_1,...,T_n in interesting places. If X reports T_i you know the location of X, this could be more precise than the usual cell phone tracking because X reports its position with GPS precision.
- Atheros 7y agoTime to make AmIAlone.com
- threeseed 7y agoJust attach a GPS tracker to the battery with a DC converter. Far easier and more reliable than using a phone.
- floe 7y agoThat doesn't have plausible deniability if detected, though.
- tantalor 7y agoSure it does if there's nothing to connect you to it.
- tedunangst 7y agoHow long can one plausibly leave a phone in someone's car, asking for location updates the entire time, while claiming not to remember leaving it there?
- floe 7y ago"I lost it under the seat"? And the point is it's not actively asking for location updates, which would drain battery. You just leave it with cellular off and it sends the standard Find My pulse over Bluetooth.
- Geee 7y agoThis mechanism is very low power, and it allows making tiny devices that can be used for tracking suspects. Maybe this is actually why they made it (someone asked if they could make it). Edit: Maybe Apple will introduce tiny key fobs that can be tracked so you can find your keys or other things.
- servercobra 7y agoThere is already a reference to an Apple Tag in iOS 13. https://www.techradar.com/news/apple-tag-spotted-in-ios-13-and-it-may-be-a-personal-item-tracker-like-tile https://www.techradar.com/news/apple-tag-spotted-in-ios-13-a...
- Geee 7y agoThanks, that's it for sure.
- bonestamp2 7y agoI was wondering why they changed the name, I mean "Find My iPhone" could already find macbooks and ipads but now it sounds like they're going much broader than Apple devices.
- dwaite 7y ago> Edit: Maybe Apple will introduce tiny key fobs that can be tracked so you can find your keys or other things. This is strongly rumored.It may also fall into the bucket of technology they license out, such as Homekit.