4 ms·
The random ID has a fixed suffix in the spec, so you can infer that it’s the same AirTag if you see the same suffix across multiple rotations.
by shuckles 6y ago
The random ID has a fixed suffix in the spec, so you can infer that it’s the same AirTag if you see the same suffix across multiple rotations.
- gruez 6y agohow long is the suffix? I can't see it being effective for both anti-stalking (ie. someone placing a tag on you without your consent) and anti-tracking (ie. shops/malls using your tag to follow you around).
- function_seven 6y agoI don't know the answer to that, but thinking about it generally: If the suffix was just a single hex digit, it would work to detect a persistent tag. After, say 5 key rotations, if the last digit is still "E", then it's highly likely that the tag that's constantly in range is the same physical thing. Meanwhile, if you're trying to use these things to track visitors to your store, you're only getting 16 bins of people. My "E" tag will be the same as 50 other people who've visited last week with the same "E" suffix. I'm having a hard time finding the actual whitepaper on this. Hopefully someone links it in this thread.
- shuckles 6y agoUnfortunately, the spec is currently only available to partners in the MFi program. That is probably where parameters like the one you are asking about are defined: https://developer.apple.com/find-my/ https://developer.apple.com/find-my/. I’m sure there will be a paper published that reverse engineers the spec once these devices are out in the wild. The protocol is in Ivan Kristic’s Black Hat 2019 talk: https://i.blackhat.com/USA-19/Thursday/us-19-Krstic-Behind-The-Scenes-Of-IOS-And-Mas-Security.pdf https://i.blackhat.com/USA-19/Thursday/us-19-Krstic-Behind-T... Finally, the static part of the broadcast doesn’t need to be permanently static. It simply needs to rotate at a period that’s longer than the rest of the public key.