3 ms·
Who Can Find My Devices? Apple Crowd-Sourced Location Tracking: Security,Privacy
- FabHK 6y agoNice summary/spec and audit of Apple's Offline Finding design. As far as I understand, seems to validate Apple's design, except for two flaws that seem minor: 1. If you're an app running on a machine, you're not supposed to have access to its location unless explicitly permitted by the user. But an app could access the cached keys of this offline finding feature, and do some shenanigans to "allow any third-party application to bypass Apple’s Core Location API that enforces user consent before an application can access the device’s location", and that malign app could than also "access the location history of the past seven days of all the owner’s devices." This seems to have been fixed as of 10.15.7 (late Catalina). 2. If multiple users have been at the same location at the same time, and they each use "Find My", then Apple could correlate them. This seems fairly remote, but as they point out, this "could be harmful to protesters who put their phones into flight mode to stay anonymous and prevent their devices from showing up during a cell site analysis—which is precisely when the devices would start emitting OF advertisements. Law enforcement agencies could record all the advertised public keys at the demonstration site and ask Apple to provide the Apple IDs of the users that later requested location reports to deanonymize the participants." So, do not use "Find my" within a week of having been at anything of interest to law enforcement if you don't trust Apple.