4 ms·

The "find my" program is interesting to me because, for the first time (as far as I'm aware) it uses your devices to provide utility to Apple (to resell). They

The "find my" program is interesting to me because, for the first time (as far as I'm aware) it uses your devices to provide utility to Apple (to resell). They remain serious about privacy, but there's still something invasive about it I think they've never done before and always seemed implicitly positioned against.

PurpleFoxy 6y ago
It provides value to Apple by providing value to users. As a user I want to find my lost stuff, Apple now lets me find my stuff without any real cost to me to do some passive scanning.
- solarkraft 6y ago
  And it does so using devices it does not own. In a hypothetical case I might be receiving value that is created using your device. I think that's okay, but fairly new ground for Apple (besides perhaps Wifi mapping?).
yazaddaruvala 6y ago
Does it matter if they now know where my bike is parked, given that they already know where my phone is (i.e. I am) at all times? Meanwhile, I agree with you. It would be nice if Apple (or anyone) didn’t have this type of location information about me. However, it seems that ship has sailed and 5G + mesh networks will make it even more precise.
- nkellenicki 6y ago
  They don't have that information about you. From the bottom of that page: "The Find My network extends these capabilities by locating missing devices even if they can’t or don’t connect to the internet. The Find My network is a crowdsourced network of hundreds of millions of Apple devices that use Bluetooth wireless technology to detect missing devices or items nearby, and report their approximate location back to the owner. The entire process is end-to-end encrypted and anonymous, so no one else, not even Apple or the third-party manufacturer, can view a device’s location or information."
  - sokoloff 6y ago
    Apple controls the app, the network, and the devices that gather the location information. It seems like in order to show me where my missing item is, they have to be able to determine my device’s information. They might claim to choose not to do that correlation until I open the app and go looking, but once I do, it seems obvious that Apple can tell where my device is (in order that they can tell me where it is in their Find My app).
    - PurpleFoxy 6y ago
      This is of course true but at some point you have to pick your battles. There is no FOSS product which does this and there probably never will be. And it’s not in Apple’s business model to try to collect this data.
    - nkellenicki 6y ago
      The "device information" is likely an opaque ID, and the "location" will likely be encrypted using an asymmetric key-pair set up during the pairing process, so the only thing capable of decrypting the location will be your phone. The part you're correct about is that as they control the device, there's nothing saying they can't build a backdoor into it that reports the information (ie. location) back to them once it hits your phone. And we're also taking it on trust that it works the way they say it works, as it's not open-source. But as someone else commented, eventually you have to trust something.
      - peytn 6y ago
        The realistic threat likely isn’t a designed backdoor, but some late-stage bug (especially if server-side) that caused part of the E2E encryption or privacy story to get punted. Who would really block ship on that, esp. with hardware impact?
    - lathiat 6y ago
      The way it works is that the location is encrypted with a key that is only on your device, same as iMessage. So they can't directly decrypt that info. It's possible in theory they could add hooks into the OS to then do that next time you use the key (e.g. effectively a baked in backdoor) or maybe in some cases the key can be extracted from an iCloud backup or similar (I'm not 100% sure how those keys are stored, but it's likely detailed in their security documentation) but in general the service itself cannot see the encrypted device location.
- matthew-wegner 6y ago
  I don’t think that’s what the parent comment is referring to (Apple knowing, and they might not have that capability anyway). Find My-tracked devices emit a Bluetooth chirp. If any Internet-enabled iOS devices hears it, it forwards to iCloud/Apple backend. I can lose a WiFi-only iPad, and it can be fully off any WiFi connection, and still get a ping on its location if its Bluetooth chirps get relayed by a stranger’s iPhone. This exists now, for i.e. the offline iPad example. This larger launch extends the Find My network to a new class of Internet-less, long battery life tag devices.
  - clairity 6y ago
    i’m hopeful that UWB means that this can be shifted off bluetooth/wi-fi/cellular for security and privacy reasons eventually. then you could have those other wireless networking technologies toggleable independent of the find my functionality.
swiley 6y ago
They've been doing this with WiFi since forever (that's how ipod touches had such accurate geolocation despite IP geolocation being accurate to a municipality level at best.)

PurpleFoxy 6y ago

It provides value to Apple by providing value to users. As a user I want to find my lost stuff, Apple now lets me find my stuff without any real cost to me to do some passive scanning.

solarkraft 6y ago
And it does so using devices it does not own. In a hypothetical case I might be receiving value that is created using your device. I think that's okay, but fairly new ground for Apple (besides perhaps Wifi mapping?).

yazaddaruvala 6y ago

Does it matter if they now know where my bike is parked, given that they already know where my phone is (i.e. I am) at all times? Meanwhile, I agree with you. It would be nice if Apple (or anyone) didn’t have this type of location information about me. However, it seems that ship has sailed and 5G + mesh networks will make it even more precise.

nkellenicki 6y ago
They don't have that information about you. From the bottom of that page: "The Find My network extends these capabilities by locating missing devices even if they can’t or don’t connect to the internet. The Find My network is a crowdsourced network of hundreds of millions of Apple devices that use Bluetooth wireless technology to detect missing devices or items nearby, and report their approximate location back to the owner. The entire process is end-to-end encrypted and anonymous, so no one else, not even Apple or the third-party manufacturer, can view a device’s location or information."
- sokoloff 6y ago
  Apple controls the app, the network, and the devices that gather the location information. It seems like in order to show me where my missing item is, they have to be able to determine my device’s information. They might claim to choose not to do that correlation until I open the app and go looking, but once I do, it seems obvious that Apple can tell where my device is (in order that they can tell me where it is in their Find My app).
  - PurpleFoxy 6y ago
    This is of course true but at some point you have to pick your battles. There is no FOSS product which does this and there probably never will be. And it’s not in Apple’s business model to try to collect this data.
  - nkellenicki 6y ago
    The "device information" is likely an opaque ID, and the "location" will likely be encrypted using an asymmetric key-pair set up during the pairing process, so the only thing capable of decrypting the location will be your phone. The part you're correct about is that as they control the device, there's nothing saying they can't build a backdoor into it that reports the information (ie. location) back to them once it hits your phone. And we're also taking it on trust that it works the way they say it works, as it's not open-source. But as someone else commented, eventually you have to trust something.
    - peytn 6y ago
      The realistic threat likely isn’t a designed backdoor, but some late-stage bug (especially if server-side) that caused part of the E2E encryption or privacy story to get punted. Who would really block ship on that, esp. with hardware impact?
  - lathiat 6y ago
    The way it works is that the location is encrypted with a key that is only on your device, same as iMessage. So they can't directly decrypt that info. It's possible in theory they could add hooks into the OS to then do that next time you use the key (e.g. effectively a baked in backdoor) or maybe in some cases the key can be extracted from an iCloud backup or similar (I'm not 100% sure how those keys are stored, but it's likely detailed in their security documentation) but in general the service itself cannot see the encrypted device location.
matthew-wegner 6y ago
I don’t think that’s what the parent comment is referring to (Apple knowing, and they might not have that capability anyway). Find My-tracked devices emit a Bluetooth chirp. If any Internet-enabled iOS devices hears it, it forwards to iCloud/Apple backend. I can lose a WiFi-only iPad, and it can be fully off any WiFi connection, and still get a ping on its location if its Bluetooth chirps get relayed by a stranger’s iPhone. This exists now, for i.e. the offline iPad example. This larger launch extends the Find My network to a new class of Internet-less, long battery life tag devices.
- clairity 6y ago
  i’m hopeful that UWB means that this can be shifted off bluetooth/wi-fi/cellular for security and privacy reasons eventually. then you could have those other wireless networking technologies toggleable independent of the find my functionality.

swiley 6y ago

They've been doing this with WiFi since forever (that's how ipod touches had such accurate geolocation despite IP geolocation being accurate to a municipality level at best.)