14 ms·

Apple reveals more about AirTag stalking protections

106 points by roguson 5y ago

Invictus0 5y ago
Are these domestic abuse activists aware that GPS tracking devices already exist and have existed for a long time? See here for an example [0]. [0]: https://www.amazon.com/Real-time-Tracker-Worldwide-Coverage-Portable/dp/B07N4DHFZM https://www.amazon.com/Real-time-Tracker-Worldwide-Coverage-...
- jolux 5y ago
  Just because similar devices already exist doesn't mean there isn't also a potential for harm with this device, particularly since these will be sold at every Apple Store and have much more exposure.
- diebeforei485 5y ago
  Sure, but it makes sense to raise concerns about an Apple product because your organization would get more media coverage.
- Fauntleroy 5y ago
  Murderers could also kill someone by strangling them any old time, but guns make it a lot easier. Sometimes simply improving the user experience of a heinous act is enough.
  - Nasrudith 5y ago
    Personally I am old fashioned and blame the murderer. I must not be involved with communists or ambulance chasers enough to have been imbued with values like "The person with money is always the most at fault."
- chc 5y ago
  This is basically "No wireless. Less space than a Nomad. Lame." but make it pro-Apple.
- detaro 5y ago
  Yes, people in that field are painfully aware.
- a4isms 5y ago
  Let’s say I make stoves, and I become aware that somebody could maliciously alter the stove to turn it into an IED. Realizing this, I make some changes to make the stove harder to turn into an IED. Is the argument really, “Are you aware that malicious actors can just go out and buy explosives, so there’s no point in making it difficult to turn a stove into an explosive device?” Or maybe I make a device for the home. I work hard to secure it against malicious actors. Is anybody going to say, “Don’t bother, most people have insecure light bulbs in their home, so there’s no point securing this WiFi speaker you’re selling?” I. Think. Not. It’s always a good idea to reduce the threat area. Security for most people is not a simple binary “secure or not.” --- Also, what’s with the phrase “domestic abuse activists?” Is that supposed to be some kind of slur? I’m baffled, it adds nothing to your argument, and in fact it hints at some kind of cultural bias on your part, which is irrelevant to the soundness of your reasoning. All in all, my advice is to drop language like this unless you are specifically trying to make an argument about social activism. Sprinkling arguments with emotional devices like this subtracts from your message, it doesn’t add to it.
- jonfw 5y ago
  A) Apple doesn't sell those and wouldn't sell those B) The airtags are more capable than those, more affordable, and easier to use C) If you own an airtag, this will be available on a moment's notice. Is your wife going to get lunch with a friend? take it off your keyring and throw it in the glovebox. Boom, now you've got realtime tracking in about 5 seconds. This obviously won't solve the problem of domestic abuse that existed before airtags were introduced, but it will go a long way towards not making it worse.
bombcar 5y ago
If you really want to track someone it's not that hard to just buy an iPhone and turn "find my iPhone" on and slip it somewhere. You could even hardwire it into a car so it remains charged.
- capableweb 5y ago
  Are you really comparing a device that costs hundreds of USD and has a form factor of... A phone, with a device that's supposed to be hooked up to a keychain and that costs 29 USD?
  - crazygringo 5y ago
    To be fair, it's easy to buy an old working iPhone on eBay for $30. And size is entirely irrelevant if you're putting it in someone's car. So I think the parent makes a point worthy of discussion. If Apple is providing this protection for Airtags, why aren't they providing it for all devices?
    - jakeva 5y ago
      Well, "to be fair", a phone's battery would die in a few days. Airtags are supposed to last for a year. Why work so hard to pretend these things are the same and therefore deserve to have the same protections applied when it is obvious with a few moments of thought that they are completely different things?
      - crazygringo 5y ago
        Why are you working so hard to pretend they're completely different when it's obvious from a few moments of thought that tracking is tracking, full stop? If someone wants to stalk you for a couple of days to find out where you live or work or whatever, what does the difference matter of "a few days" vs a "a year"? I don't understand why you think this isn't something worth discussing. It's a safety issue worth asking about, no? I find it truly bizarre that this is being downvoted. Especially on HN which is generally so extremely anti-tracking and pro-privacy.
RcouF1uZ4gsC 5y ago
It seems that people already in that situation are already very vulnerable and AirTags don’t really add that much new vulnerability. If someone has physical access to you and your devices, it will be very hard for you you be sure they are not tracking you. With a lot of Android devices, you can root them and get access to a ton of location data. Many apps also store your location data. You can also side load apps that would do this even more so.
- capableweb 5y ago
  > It seems that people already in that situation are already very vulnerable and AirTags don’t really add that much new vulnerability. It doesn't add more "functionality" in the "tracking" use case, but it does make it more widely available to everyone and possibly easier to use than custom tracking solutions built with ESP32 chips. I'm not saying to block the sale of AirTags, but they should really think through and make it impossible for misuse, otherwise reconsider if the value provided by this product is actually higher than the potential for misuse.
- baq 5y ago
  network effects have nonlinear impact in the size of the network. there are other products which do the same thing. none of them has that scale.
- hundchenkatze 5y ago
  Buying an AirTag is more accessible to vastly more people than rooting phones and side-loading apps.
vaillant 5y ago
This really feels like a losing battle - especially the part where you only get warned about being stalked by the AirTag if you have an iPhone. Having the technology to know where things are is great but we need to figure out how to account for bad actors somehow. I don’t have answers but tech companies can’t create the tools that enable harm and then wash their hands of it. Good for Apple for doing _something_, points for effort.
- jolux 5y ago
  I think the suggestion to cooperate with Google, like they did with COVID-19 tracking, is a great idea. I'm not sure they will go for it, though.
- dangoor 5y ago
  > especially the part where you only get warned about being stalked by the AirTag if you have an iPhone I believe that's not 100% true because of a final failsafe: the AirTag will start making noise if it's separated for too long (the definition of which could be an issue) from the owner's iPhone. That failsafe works if the person doesn't even have a smartphone. I don't know if there _is_ a perfect solution for this, but they are indeed trying.
  - hrktb 5y ago
    As a caveat to that, from the reviews it seems the sound is produced by vibrating the outer shell. I wouldn’t be surprised if removing the outershell or altering it would stop it making much noise. We’re in a situation where there is intention to hide the device, so making some effort to make it silent should be taken into account.
  - jjkaczor 5y ago
    The failsafe (audible alarm) looks like it would take a couple minutes to disable physically: https://www.iphonehacks.com/2021/04/airtag-teardown-reveals-speaker-details-more.html https://www.iphonehacks.com/2021/04/airtag-teardown-reveals-...
BitwiseFool 5y ago
I must have lived a sheltered life because none of these concerns crossed my mind.
- glhaynes 5y ago
  So much of that kind of stuff wouldn't be likely to cross my mind either. (What a nice privilege.) Shows how important it is to have a diverse set of listened-to voices when building tech products.
  - a4isms 5y ago
    We were working on a directory of users and their contact methods for an application, when one of the engineers asked, “Has anybody considered how this might be misused by a vengeful ex-partner should an office romance break up badly?” Nobody had asked themselves this question.
- madeofpalk 5y ago
  That's what we call privilege, and why it's actually great to build diverse teams so they can bring concerns that others wouldn't think of.
  - kepler1 5y ago
    Oh will you gtfo with your stupid agenda? You would've told him to hire people for racial diversity, and what, that would've helped prevent this from being used to stalk people? Or what's the next class of diversity you want? Smell your own bullshit that you're trying to peddle once in a while.
- deleted 5y ago
  [deleted]
w0mbat 5y ago
All these stalking counter-measures make it useless if your device is stolen rather than mislaid. If my bag is stolen I want it to contain a hard to find device, not one that gives away its position (by warning the thief). I also want an easy mechanism to give the police temporary access to track it, til they catch the thief and get my stuff back.
- jolux 5y ago
  >All these stalking counter-measures make it useless if your device is stolen rather than mislaid. I think “useless” is a bit extreme. After three days, the thief may notice it when it starts beeping, but before then it will track just fine. Clearly there’s a trade off here, but I think having anti-stalking protections is pretty important for a product that millions of people are going to bug.
- fossuser 5y ago
  It's a tradeoff of course, but I think they struck a pretty good medium. I like how much they thought about this issue.
  - PurpleFoxy 5y ago
    Agreed. Previously I could not find lost or stolen items. Now I can find lost items. That’s a pure improvement in my eyes.
- nodesocket 5y ago
  > give the police temporary access to track it, til they catch the thief and get my stuff back. I don’t know where you live, but as somebody who previously lived in San Francisco, do you really think the police are going to actively pursue theft claims? It’s why car break-ins and petty theft are out of control in the bay area. The police don’t enforce laws, and certainly don’t actively track down stolen property.
  - djrogers 5y ago
    As somebody who has lived in a lot of places that aren't San Francisco, I can tell you that San Francisco is an outlier WRT how much illegal activity "law enforcement" puts up with.
smiley1437 5y ago
I'm curious - does Tile have similar protections for their devices? Because I found this article that says Tile trackers were used by bad actors https://blog.malwarebytes.com/stalkerware/2019/07/helping-survivors-of-domestic-abuse-what-to-do-when-you-find-stalkerware/ https://blog.malwarebytes.com/stalkerware/2019/07/helping-su... So, if Airtags have stalking protections, why wouldn't I just use a Tile to track someone? They're sortof in the same ballpark of price and size. Is it because Apple's scale is so wide that it makes their Airtags significantly better for stalking?
- djrogers 5y ago
  It's likely because Apple doesn't want to be in the news when something like this happens. If that had been Apple, that would have been a bunch of news articles rather than an obscure blog post.
- judge2020 5y ago
  The only reason a hypothetical stalker would choose Airtags is if they needed the larger network of devices (say, in a rural area where the victim likely has an Apple device but doesn't have a Tile nor neighbors with a Tile) and only needs their location for 3 hours (the time before it alerts the victim with the beeping).
ibudiallo 5y ago
Ok, so I made these things called OttoTags in 2017. Think of them as AirTags with QR code instead (I'm a solo dev) From what I understand, when you find an airtag, you connect it to your device and it gives you the owners contact info. Anyone can get your phone number. When you find an ottotag, you scan it and you contact the owner through ottomon. From here the GPS location is captured and communicated. All interactions are done through the service (ottomon.net). This layer act as a security layer where we filter out spam and possibly stalkers based on past behavior and other heuristics. The two parties can communicate without revealing any information about themselves. So yeah, Apple could have made it much simpler, but they are my competitors now so let's keep this between us. Edit: For more info -> https://www.ottomon.net/blog/privately-communicate-on-ottomon https://www.ottomon.net/blog/privately-communicate-on-ottomo...
- judge2020 5y ago
  > Anyone can get your phone number. If you put it in lost mode. Otherwise, it doesn't reveal the owner's phone number. It's assumed that clicking lost mode and putting a phone number means you expect to be called about that lost item.
  - PurpleFoxy 5y ago
    I have tested them. If you nfc scan one not in lost mode, it opens a page explaining what airtags are and shows you it’s serial number. If you put it in lost mode, scanning shows the same page but with a phone number and a lost message. Being in lost mode will also give the owner a notification when it is found. The airtags are also account locked the whole time and must be manually removed by the owner before someone else can use them.
fasteddie31003 5y ago
I really hope these Airtags can reduce theft. Living in SF I had so many bikes, bags and motorcycles stolen. I'd love to have an Airtag in these things and show the police where my stolen item was. I wonder what law enforcement's response is going to be with the airtags? Will having an Airtag's location be enough for a warrent? Will people become vigilantes and try to get their stuff back without law enforcement?
- Arainach 5y ago
  > I wonder what law enforcement's response is going to be with the airtags? "Sorry, we have too many other cases" > Will having an Airtag's location be enough for a warrent? Probably not (see answer #1) > Will people become vigilantes and try to get their stuff back without law enforcement? Some of them, surely. Most of them, no. We already see this with things like bicycles that people are able to track down on Craigslist.
  - motohagiography 5y ago
    Startup of private airtag "recovery" services could be a thing.
    - PurpleFoxy 5y ago
      Just wait till your bike is on the move, then get a group to recover it.
  - randyrand 5y ago
    if they get 200 reports to the same location they might investigate.
djrogers 5y ago
There are a lot of comments here about how useless these protections are, because A or B already exist, or C works better for stalking. I think most of those comments are missing the real point here. If an Apple product were ever used to stalk - or God forbid, harm - an individual, it would be a big national story. If a Tile or a Samsung tag (or an amazon gps tracker made for stalking) were used in the same way, it would likely only be mentioned in passing if the story were reported at all. That's why it's so important for Apple to do this. Additional benefit - this may push other vendors to do similar things, pushing stalkers back to more tailored devices. That's still helpful, as it's a lot easier to show intent if someone uses a device like that (as opposed to 'whoops, I lost my airtag).
- drdaeman 5y ago
  Would it really help, though? A stalker, not stupid and well-aware about the protection, visits iFixit for a picture of internals, takes a drill, and physically obliterates the buzzer, right through the case. Epoxy or superglue for protection from the elements. So they plant an Airtag, it gets found by accident, shit hits the fan, Apple's name goes in the news, journalists start journalist things, people don't are outraged and demand Apple's repentance, AirTags made of diamond-covered vibranium, including a microphone to control the buzzing and stopping working if buzzer is broken. PR problem not solved, and the core problem of humans not understanding technology is not solved.
  - watwut 5y ago
    The assumption that all stalkers are smart and informed and skilled is not accurate. Plenty of them are in fact stupid, followed some advice from discussion forum without really understanding what they are doing and that is that.
  - Rapzid 5y ago
    A less scrupulous competitor might even create a bunch of these and just plant them on random people. Instant scandal.
  - lstamour 5y ago
nixpulvis 5y ago
Here's a crazy hypothetical for some mulling... Let's say an abuser does use this, and goes on to track someone and then kills them (or commits some other very serious crime). The cops get involved, they start looking into it and discover (through a lapse in other privacy elements of this technology) that a third-party's iPhone was the one that gave away the location. What are the third parties' legal defenses from the law to avoid being labeled an accomplice here?
- Nasrudith 5y ago
  They don't need one. An accomplice is a person who knowingly, voluntarily, or intentionally gives assistance to another in (or in some cases fails to prevent another from) the commission of a crime. The judge is going to be very annoyed at the incompetent prosecutor for wasting his time improperly trying to try anybody and anything connected to the actual actor as an accomplice.
dang 5y ago
Url changed from https://9to5mac.com/2021/04/30/airtag-stalking-protections/ https://9to5mac.com/2021/04/30/airtag-stalking-protections/, which points to this.
gnicholas 5y ago
> If you are an iPhone user, for instance, and someone has placed an AirTag on your person, your phone will eventually alert you that an AirTag that isn’t yours has been found “moving with you.” Apple didn’t clarify how quickly or often this alert will arrive, but it did share that it will occur when you arrive at your home (the address stored in your Apple “Me” card) or at certain other locations that your phone has learned you frequent over time. Apple declined to disclose further specifics, citing the interest of public safety. It’s not great that the alert won’t trigger until you get home. At that point, the stalker now knows where you live.
- takeda 5y ago
  I also find it ironic, that from the quote you posted it also sounds like: "no one can stalk you but us".
  - meatmanek 5y ago
    s/us/your phone, that we control the software for/ I believe this learning is done on-device, not relayed to the cloud. Depending on whether you take Apple's statements at face value about how much they care about your privacy, that's either a big difference or a meaningless difference.
    - takeda 5y ago
      I doubt that figuring the places that you frequent is computed on your phone. Most likely it sends your locations and then Apple runs hadoop jobs (or whatever it is used these days) to get these things.
- uhhhhhhhhhhhhhh 5y ago
  "To find out if you're being stalked, buy an iPhone" wheww!
- randyrand 5y ago
  And you also know where theif theif lives. For a very high value item, or for repeat offenses, it gives you a shot at getting your item back.
linuxftw 5y ago
Getting people to pay for the privilege to wear a tag like a dog. I underestimated Apple's marketing department.
- detaro 5y ago
  they are for stuff, not people.
  - linuxftw 5y ago
    Get real, they're for children.
    - Jcowell 5y ago
      Seems like the Apple Watch SE are for children.
londons_explore 5y ago
How exactly can stalking protection work with apples claim that the system doesn't provide any outsider or apple themselves the ability to track your airtag? Surely stalking protection is doing exactly that? Couldn't I take a modded/hacked iPhone and track somebody elses tag all day long from near the edge of UWB range? Apples original paper [1] said the signals emitted contained no unique/trackable identifier except to the key-holder who could link together all the rolling keys. Yet that can never offer this stalking protection feature. Have Apple dropped the privacy protections they had in mind to enable this anti-stalker feature? [1]: https://www.wired.com/story/apple-find-my-cryptography-bluetooth/ https://www.wired.com/story/apple-find-my-cryptography-bluet...
- gruez 5y ago
  https://news.ycombinator.com/item?id=26878110 https://news.ycombinator.com/item?id=26878110
  - londons_explore 5y ago
    > The random ID has a fixed suffix in the spec, so you can infer that it’s the same AirTag if you see the same suffix across multiple rotations. So if that suffix is 8 or more bits, as soon as you have an airtag on your keys, wallet, and bag, you've become a nice easy to track person. If the suffix is less than 8 bits, then the 200 airtags around me in a classroom setting will always be falsely setting off the alert - at least one of those 256 possible suffixes will remain always in use for hours with every rotation. Privacy 100% broken. Great.
    - gruez 5y ago
      just spitballing here... >So if that suffix is 8 or more bits, as soon as you have an airtag on your keys, wallet, and bag, you've become a nice easy to track person. This can be easily solved by disabling the fixed bits if an "owned" device (eg. your iphone) is present. It prevents the anti-stalking feature from being used, but presumably if you can get a phone to follow the person you can probably get a GPS tracker to follow the person as well so that's not really a security risk. >If the suffix is less than 8 bits, then the 200 airtags around me in a classroom setting will always be falsely setting off the alert - at least one of those 256 possible suffixes will remain always in use for hours with every rotation. The phone can take the number of airtags that it sees into account. If it saw an airtag with the same suffix for the last 3 hours, but during that time it also saw 300 airtags, it's probably a false alarm. But if it only saw 10 airtags then that might warrant warning.
avalys 5y ago
“Instead, an AirTag that has not paired locally with its iPhone in three days will emit a sound.” Ugh, so if I’m gone for longer than a weekend all my stuff at home is going to start beeping? I’m sure my roommate will love that.
- jonny_eh 5y ago
  Turn them off before traveling? Maybe Apple will prompt you?
- SheinhardtWigCo 5y ago
  Is this really how it works? This seems like it would be a huge problem.
  - PurpleFoxy 5y ago
    It isn’t. The tags have to be moving around and away from their owner. And if they really do go off and annoy someone. It’s trivial to twist the backs off and the coin cell battery pops out.
- radicality 5y ago
  I think it has to be three days _and_ the airtag has to be in motion
  - m-p-3 5y ago
    I guess an ill-intentioned stalker could cripple or neuter the speaker to avoid it doing any sounds.
    - PurpleFoxy 5y ago
      People have posted the steps to do it. It’s not very hard. But if you are willing to strip the airtag to bits, it would be easier to plant a cheap android with a sim in someones car. The point is that stalking has always been possible, it’s only important that apple doesn’t make it way too easy. Also when you find an airtag you can bring it to the police and they can get apple to give the owners details. Removing the speaker shows proof of intent.
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
jakear 5y ago
This is such an amazingly terrible invention I have no clue where to begin. How many people will be sexually assaulted by predators planting these devices in the bags of unsuspecting folks at bars and tracking their every location? How many domestic abuse survivors will be terrorized by their abusers planting the tag on some possession then having access to their every location? Hell, how many folks will be burglarized by criminals who plant the tag on their car and can see when someone is away for on a distant vacation. Some technology very much should not exist. “Tags that use an unsuspecting victim’s own phone to report their location back to a would-be criminal without their consent” is definitely on the list. That being said, there are very easy ways to make this unusable for these cases, and I have no clue why they haven’t been implanted. Off the top of my head: a notification any time a tag has been away from it’s owners device for more than X time and has been around your device for at least Y time since, saying “it looks like XXX’s airtag has been lost and is with you, click here to message them”. Yes, this would sacrifice the privacy of the airtag owner, but it’s an opt-in, they only suffer if they buy an airtag. Compared to as-is a completely random unsuspecting person with no involvement in the ecosystem has both their privacy and security compromised.
- ohazi 5y ago
  > and I have no clue why they haven’t been implanted. Off the top of my head: a notification any time a tag has been away from it’s owners device for more than X time and has been around your device for at least Y time since, saying “it looks like XXX’s airtag has been lost and is with you, click here to message them” Did you read past the headline? Apple is doing exactly this.
  - jakear 5y ago
    Did you? Only if they have an iPhone. “Don’t want to be assaulted/stalked/robbed via our $29 device? Buy our $1,000 device!”
- simondotau 5y ago
  > Off the top of my head: a notification any time a tag has been away from it’s owners device for more than X time and has been around your device for at least Y time That's exactly what Apple has done. This isn't even new information. It was part of the AirTags announcement on the 20th of April. "iOS devices can also detect an AirTag that isn’t with its owner, and notify the user if an unknown AirTag is seen to be traveling with them from place to place over time." https://www.apple.com/newsroom/2021/04/apple-introduces-airtag/ https://www.apple.com/newsroom/2021/04/apple-introduces-airt...

106 points by roguson 5y ago

Are these domestic abuse activists aware that GPS tracking devices already exist and have existed for a long time? See here for an example [0]. [0]: https://www.amazon.com/Real-time-Tracker-Worldwide-Coverage-Portable/dp/B07N4DHFZM https://www.amazon.com/Real-time-Tracker-Worldwide-Coverage-...

jolux 5y ago
Just because similar devices already exist doesn't mean there isn't also a potential for harm with this device, particularly since these will be sold at every Apple Store and have much more exposure.
diebeforei485 5y ago
Sure, but it makes sense to raise concerns about an Apple product because your organization would get more media coverage.
Fauntleroy 5y ago
Murderers could also kill someone by strangling them any old time, but guns make it a lot easier. Sometimes simply improving the user experience of a heinous act is enough.
- Nasrudith 5y ago
  Personally I am old fashioned and blame the murderer. I must not be involved with communists or ambulance chasers enough to have been imbued with values like "The person with money is always the most at fault."
chc 5y ago
This is basically "No wireless. Less space than a Nomad. Lame." but make it pro-Apple.
detaro 5y ago
Yes, people in that field are painfully aware.
a4isms 5y ago
Let’s say I make stoves, and I become aware that somebody could maliciously alter the stove to turn it into an IED. Realizing this, I make some changes to make the stove harder to turn into an IED. Is the argument really, “Are you aware that malicious actors can just go out and buy explosives, so there’s no point in making it difficult to turn a stove into an explosive device?” Or maybe I make a device for the home. I work hard to secure it against malicious actors. Is anybody going to say, “Don’t bother, most people have insecure light bulbs in their home, so there’s no point securing this WiFi speaker you’re selling?” I. Think. Not. It’s always a good idea to reduce the threat area. Security for most people is not a simple binary “secure or not.” --- Also, what’s with the phrase “domestic abuse activists?” Is that supposed to be some kind of slur? I’m baffled, it adds nothing to your argument, and in fact it hints at some kind of cultural bias on your part, which is irrelevant to the soundness of your reasoning. All in all, my advice is to drop language like this unless you are specifically trying to make an argument about social activism. Sprinkling arguments with emotional devices like this subtracts from your message, it doesn’t add to it.
jonfw 5y ago
A) Apple doesn't sell those and wouldn't sell those B) The airtags are more capable than those, more affordable, and easier to use C) If you own an airtag, this will be available on a moment's notice. Is your wife going to get lunch with a friend? take it off your keyring and throw it in the glovebox. Boom, now you've got realtime tracking in about 5 seconds. This obviously won't solve the problem of domestic abuse that existed before airtags were introduced, but it will go a long way towards not making it worse.

bombcar 5y ago

If you really want to track someone it's not that hard to just buy an iPhone and turn "find my iPhone" on and slip it somewhere. You could even hardwire it into a car so it remains charged.

capableweb 5y ago
Are you really comparing a device that costs hundreds of USD and has a form factor of... A phone, with a device that's supposed to be hooked up to a keychain and that costs 29 USD?
- crazygringo 5y ago
  To be fair, it's easy to buy an old working iPhone on eBay for $30. And size is entirely irrelevant if you're putting it in someone's car. So I think the parent makes a point worthy of discussion. If Apple is providing this protection for Airtags, why aren't they providing it for all devices?
  - jakeva 5y ago
    Well, "to be fair", a phone's battery would die in a few days. Airtags are supposed to last for a year. Why work so hard to pretend these things are the same and therefore deserve to have the same protections applied when it is obvious with a few moments of thought that they are completely different things?
    - crazygringo 5y ago
      Why are you working so hard to pretend they're completely different when it's obvious from a few moments of thought that tracking is tracking, full stop? If someone wants to stalk you for a couple of days to find out where you live or work or whatever, what does the difference matter of "a few days" vs a "a year"? I don't understand why you think this isn't something worth discussing. It's a safety issue worth asking about, no? I find it truly bizarre that this is being downvoted. Especially on HN which is generally so extremely anti-tracking and pro-privacy.

RcouF1uZ4gsC 5y ago

It seems that people already in that situation are already very vulnerable and AirTags don’t really add that much new vulnerability. If someone has physical access to you and your devices, it will be very hard for you you be sure they are not tracking you. With a lot of Android devices, you can root them and get access to a ton of location data. Many apps also store your location data. You can also side load apps that would do this even more so.

capableweb 5y ago
> It seems that people already in that situation are already very vulnerable and AirTags don’t really add that much new vulnerability. It doesn't add more "functionality" in the "tracking" use case, but it does make it more widely available to everyone and possibly easier to use than custom tracking solutions built with ESP32 chips. I'm not saying to block the sale of AirTags, but they should really think through and make it impossible for misuse, otherwise reconsider if the value provided by this product is actually higher than the potential for misuse.
baq 5y ago
network effects have nonlinear impact in the size of the network. there are other products which do the same thing. none of them has that scale.
hundchenkatze 5y ago
Buying an AirTag is more accessible to vastly more people than rooting phones and side-loading apps.

vaillant 5y ago

This really feels like a losing battle - especially the part where you only get warned about being stalked by the AirTag if you have an iPhone. Having the technology to know where things are is great but we need to figure out how to account for bad actors somehow. I don’t have answers but tech companies can’t create the tools that enable harm and then wash their hands of it. Good for Apple for doing _something_, points for effort.

jolux 5y ago
I think the suggestion to cooperate with Google, like they did with COVID-19 tracking, is a great idea. I'm not sure they will go for it, though.
dangoor 5y ago
> especially the part where you only get warned about being stalked by the AirTag if you have an iPhone I believe that's not 100% true because of a final failsafe: the AirTag will start making noise if it's separated for too long (the definition of which could be an issue) from the owner's iPhone. That failsafe works if the person doesn't even have a smartphone. I don't know if there _is_ a perfect solution for this, but they are indeed trying.
- hrktb 5y ago
  As a caveat to that, from the reviews it seems the sound is produced by vibrating the outer shell. I wouldn’t be surprised if removing the outershell or altering it would stop it making much noise. We’re in a situation where there is intention to hide the device, so making some effort to make it silent should be taken into account.
- jjkaczor 5y ago
  The failsafe (audible alarm) looks like it would take a couple minutes to disable physically: https://www.iphonehacks.com/2021/04/airtag-teardown-reveals-speaker-details-more.html https://www.iphonehacks.com/2021/04/airtag-teardown-reveals-...

BitwiseFool 5y ago

I must have lived a sheltered life because none of these concerns crossed my mind.

glhaynes 5y ago
So much of that kind of stuff wouldn't be likely to cross my mind either. (What a nice privilege.) Shows how important it is to have a diverse set of listened-to voices when building tech products.
- a4isms 5y ago
  We were working on a directory of users and their contact methods for an application, when one of the engineers asked, “Has anybody considered how this might be misused by a vengeful ex-partner should an office romance break up badly?” Nobody had asked themselves this question.
madeofpalk 5y ago
That's what we call privilege, and why it's actually great to build diverse teams so they can bring concerns that others wouldn't think of.
- kepler1 5y ago
  Oh will you gtfo with your stupid agenda? You would've told him to hire people for racial diversity, and what, that would've helped prevent this from being used to stalk people? Or what's the next class of diversity you want? Smell your own bullshit that you're trying to peddle once in a while.
deleted 5y ago
[deleted]

w0mbat 5y ago

All these stalking counter-measures make it useless if your device is stolen rather than mislaid. If my bag is stolen I want it to contain a hard to find device, not one that gives away its position (by warning the thief). I also want an easy mechanism to give the police temporary access to track it, til they catch the thief and get my stuff back.

jolux 5y ago
>All these stalking counter-measures make it useless if your device is stolen rather than mislaid. I think “useless” is a bit extreme. After three days, the thief may notice it when it starts beeping, but before then it will track just fine. Clearly there’s a trade off here, but I think having anti-stalking protections is pretty important for a product that millions of people are going to bug.
fossuser 5y ago
It's a tradeoff of course, but I think they struck a pretty good medium. I like how much they thought about this issue.
- PurpleFoxy 5y ago
  Agreed. Previously I could not find lost or stolen items. Now I can find lost items. That’s a pure improvement in my eyes.
nodesocket 5y ago
> give the police temporary access to track it, til they catch the thief and get my stuff back. I don’t know where you live, but as somebody who previously lived in San Francisco, do you really think the police are going to actively pursue theft claims? It’s why car break-ins and petty theft are out of control in the bay area. The police don’t enforce laws, and certainly don’t actively track down stolen property.
- djrogers 5y ago
  As somebody who has lived in a lot of places that aren't San Francisco, I can tell you that San Francisco is an outlier WRT how much illegal activity "law enforcement" puts up with.

smiley1437 5y ago

I'm curious - does Tile have similar protections for their devices? Because I found this article that says Tile trackers were used by bad actors https://blog.malwarebytes.com/stalkerware/2019/07/helping-survivors-of-domestic-abuse-what-to-do-when-you-find-stalkerware/ https://blog.malwarebytes.com/stalkerware/2019/07/helping-su... So, if Airtags have stalking protections, why wouldn't I just use a Tile to track someone? They're sortof in the same ballpark of price and size. Is it because Apple's scale is so wide that it makes their Airtags significantly better for stalking?

djrogers 5y ago
It's likely because Apple doesn't want to be in the news when something like this happens. If that had been Apple, that would have been a bunch of news articles rather than an obscure blog post.
judge2020 5y ago
The only reason a hypothetical stalker would choose Airtags is if they needed the larger network of devices (say, in a rural area where the victim likely has an Apple device but doesn't have a Tile nor neighbors with a Tile) and only needs their location for 3 hours (the time before it alerts the victim with the beeping).

ibudiallo 5y ago

Ok, so I made these things called OttoTags in 2017. Think of them as AirTags with QR code instead (I'm a solo dev) From what I understand, when you find an airtag, you connect it to your device and it gives you the owners contact info. Anyone can get your phone number. When you find an ottotag, you scan it and you contact the owner through ottomon. From here the GPS location is captured and communicated. All interactions are done through the service (ottomon.net). This layer act as a security layer where we filter out spam and possibly stalkers based on past behavior and other heuristics. The two parties can communicate without revealing any information about themselves. So yeah, Apple could have made it much simpler, but they are my competitors now so let's keep this between us. Edit: For more info -> https://www.ottomon.net/blog/privately-communicate-on-ottomon https://www.ottomon.net/blog/privately-communicate-on-ottomo...

judge2020 5y ago
> Anyone can get your phone number. If you put it in lost mode. Otherwise, it doesn't reveal the owner's phone number. It's assumed that clicking lost mode and putting a phone number means you expect to be called about that lost item.
- PurpleFoxy 5y ago
  I have tested them. If you nfc scan one not in lost mode, it opens a page explaining what airtags are and shows you it’s serial number. If you put it in lost mode, scanning shows the same page but with a phone number and a lost message. Being in lost mode will also give the owner a notification when it is found. The airtags are also account locked the whole time and must be manually removed by the owner before someone else can use them.

fasteddie31003 5y ago

I really hope these Airtags can reduce theft. Living in SF I had so many bikes, bags and motorcycles stolen. I'd love to have an Airtag in these things and show the police where my stolen item was. I wonder what law enforcement's response is going to be with the airtags? Will having an Airtag's location be enough for a warrent? Will people become vigilantes and try to get their stuff back without law enforcement?

Arainach 5y ago
> I wonder what law enforcement's response is going to be with the airtags? "Sorry, we have too many other cases" > Will having an Airtag's location be enough for a warrent? Probably not (see answer #1) > Will people become vigilantes and try to get their stuff back without law enforcement? Some of them, surely. Most of them, no. We already see this with things like bicycles that people are able to track down on Craigslist.
- motohagiography 5y ago
  Startup of private airtag "recovery" services could be a thing.
  - PurpleFoxy 5y ago
    Just wait till your bike is on the move, then get a group to recover it.
- randyrand 5y ago
  if they get 200 reports to the same location they might investigate.

djrogers 5y ago

There are a lot of comments here about how useless these protections are, because A or B already exist, or C works better for stalking. I think most of those comments are missing the real point here. If an Apple product were ever used to stalk - or God forbid, harm - an individual, it would be a big national story. If a Tile or a Samsung tag (or an amazon gps tracker made for stalking) were used in the same way, it would likely only be mentioned in passing if the story were reported at all. That's why it's so important for Apple to do this. Additional benefit - this may push other vendors to do similar things, pushing stalkers back to more tailored devices. That's still helpful, as it's a lot easier to show intent if someone uses a device like that (as opposed to 'whoops, I lost my airtag).

drdaeman 5y ago
Would it really help, though? A stalker, not stupid and well-aware about the protection, visits iFixit for a picture of internals, takes a drill, and physically obliterates the buzzer, right through the case. Epoxy or superglue for protection from the elements. So they plant an Airtag, it gets found by accident, shit hits the fan, Apple's name goes in the news, journalists start journalist things, people don't are outraged and demand Apple's repentance, AirTags made of diamond-covered vibranium, including a microphone to control the buzzing and stopping working if buzzer is broken. PR problem not solved, and the core problem of humans not understanding technology is not solved.
- watwut 5y ago
  The assumption that all stalkers are smart and informed and skilled is not accurate. Plenty of them are in fact stupid, followed some advice from discussion forum without really understanding what they are doing and that is that.
- Rapzid 5y ago
  A less scrupulous competitor might even create a bunch of these and just plant them on random people. Instant scandal.
- lstamour 5y ago

nixpulvis 5y ago

Here's a crazy hypothetical for some mulling... Let's say an abuser does use this, and goes on to track someone and then kills them (or commits some other very serious crime). The cops get involved, they start looking into it and discover (through a lapse in other privacy elements of this technology) that a third-party's iPhone was the one that gave away the location. What are the third parties' legal defenses from the law to avoid being labeled an accomplice here?

Nasrudith 5y ago
They don't need one. An accomplice is a person who knowingly, voluntarily, or intentionally gives assistance to another in (or in some cases fails to prevent another from) the commission of a crime. The judge is going to be very annoyed at the incompetent prosecutor for wasting his time improperly trying to try anybody and anything connected to the actual actor as an accomplice.

dang 5y ago

Url changed from https://9to5mac.com/2021/04/30/airtag-stalking-protections/ https://9to5mac.com/2021/04/30/airtag-stalking-protections/, which points to this.

gnicholas 5y ago

> If you are an iPhone user, for instance, and someone has placed an AirTag on your person, your phone will eventually alert you that an AirTag that isn’t yours has been found “moving with you.” Apple didn’t clarify how quickly or often this alert will arrive, but it did share that it will occur when you arrive at your home (the address stored in your Apple “Me” card) or at certain other locations that your phone has learned you frequent over time. Apple declined to disclose further specifics, citing the interest of public safety. It’s not great that the alert won’t trigger until you get home. At that point, the stalker now knows where you live.

takeda 5y ago
I also find it ironic, that from the quote you posted it also sounds like: "no one can stalk you but us".
- meatmanek 5y ago
  s/us/your phone, that we control the software for/ I believe this learning is done on-device, not relayed to the cloud. Depending on whether you take Apple's statements at face value about how much they care about your privacy, that's either a big difference or a meaningless difference.
  - takeda 5y ago
    I doubt that figuring the places that you frequent is computed on your phone. Most likely it sends your locations and then Apple runs hadoop jobs (or whatever it is used these days) to get these things.
uhhhhhhhhhhhhhh 5y ago
"To find out if you're being stalked, buy an iPhone" wheww!
randyrand 5y ago
And you also know where theif theif lives. For a very high value item, or for repeat offenses, it gives you a shot at getting your item back.

linuxftw 5y ago

Getting people to pay for the privilege to wear a tag like a dog. I underestimated Apple's marketing department.

detaro 5y ago
they are for stuff, not people.
- linuxftw 5y ago
  Get real, they're for children.
  - Jcowell 5y ago
    Seems like the Apple Watch SE are for children.

londons_explore 5y ago

How exactly can stalking protection work with apples claim that the system doesn't provide any outsider or apple themselves the ability to track your airtag? Surely stalking protection is doing exactly that? Couldn't I take a modded/hacked iPhone and track somebody elses tag all day long from near the edge of UWB range? Apples original paper [1] said the signals emitted contained no unique/trackable identifier except to the key-holder who could link together all the rolling keys. Yet that can never offer this stalking protection feature. Have Apple dropped the privacy protections they had in mind to enable this anti-stalker feature? [1]: https://www.wired.com/story/apple-find-my-cryptography-bluetooth/ https://www.wired.com/story/apple-find-my-cryptography-bluet...

gruez 5y ago
https://news.ycombinator.com/item?id=26878110 https://news.ycombinator.com/item?id=26878110
- londons_explore 5y ago
  > The random ID has a fixed suffix in the spec, so you can infer that it’s the same AirTag if you see the same suffix across multiple rotations. So if that suffix is 8 or more bits, as soon as you have an airtag on your keys, wallet, and bag, you've become a nice easy to track person. If the suffix is less than 8 bits, then the 200 airtags around me in a classroom setting will always be falsely setting off the alert - at least one of those 256 possible suffixes will remain always in use for hours with every rotation. Privacy 100% broken. Great.
  - gruez 5y ago
    just spitballing here... >So if that suffix is 8 or more bits, as soon as you have an airtag on your keys, wallet, and bag, you've become a nice easy to track person. This can be easily solved by disabling the fixed bits if an "owned" device (eg. your iphone) is present. It prevents the anti-stalking feature from being used, but presumably if you can get a phone to follow the person you can probably get a GPS tracker to follow the person as well so that's not really a security risk. >If the suffix is less than 8 bits, then the 200 airtags around me in a classroom setting will always be falsely setting off the alert - at least one of those 256 possible suffixes will remain always in use for hours with every rotation. The phone can take the number of airtags that it sees into account. If it saw an airtag with the same suffix for the last 3 hours, but during that time it also saw 300 airtags, it's probably a false alarm. But if it only saw 10 airtags then that might warrant warning.

avalys 5y ago

“Instead, an AirTag that has not paired locally with its iPhone in three days will emit a sound.” Ugh, so if I’m gone for longer than a weekend all my stuff at home is going to start beeping? I’m sure my roommate will love that.

jonny_eh 5y ago
Turn them off before traveling? Maybe Apple will prompt you?
SheinhardtWigCo 5y ago
Is this really how it works? This seems like it would be a huge problem.
- PurpleFoxy 5y ago
  It isn’t. The tags have to be moving around and away from their owner. And if they really do go off and annoy someone. It’s trivial to twist the backs off and the coin cell battery pops out.
radicality 5y ago
I think it has to be three days _and_ the airtag has to be in motion
- m-p-3 5y ago
  I guess an ill-intentioned stalker could cripple or neuter the speaker to avoid it doing any sounds.
  - PurpleFoxy 5y ago
    People have posted the steps to do it. It’s not very hard. But if you are willing to strip the airtag to bits, it would be easier to plant a cheap android with a sim in someones car. The point is that stalking has always been possible, it’s only important that apple doesn’t make it way too easy. Also when you find an airtag you can bring it to the police and they can get apple to give the owners details. Removing the speaker shows proof of intent.

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

jakear 5y ago

This is such an amazingly terrible invention I have no clue where to begin. How many people will be sexually assaulted by predators planting these devices in the bags of unsuspecting folks at bars and tracking their every location? How many domestic abuse survivors will be terrorized by their abusers planting the tag on some possession then having access to their every location? Hell, how many folks will be burglarized by criminals who plant the tag on their car and can see when someone is away for on a distant vacation. Some technology very much should not exist. “Tags that use an unsuspecting victim’s own phone to report their location back to a would-be criminal without their consent” is definitely on the list. That being said, there are very easy ways to make this unusable for these cases, and I have no clue why they haven’t been implanted. Off the top of my head: a notification any time a tag has been away from it’s owners device for more than X time and has been around your device for at least Y time since, saying “it looks like XXX’s airtag has been lost and is with you, click here to message them”. Yes, this would sacrifice the privacy of the airtag owner, but it’s an opt-in, they only suffer if they buy an airtag. Compared to as-is a completely random unsuspecting person with no involvement in the ecosystem has both their privacy and security compromised.

ohazi 5y ago
> and I have no clue why they haven’t been implanted. Off the top of my head: a notification any time a tag has been away from it’s owners device for more than X time and has been around your device for at least Y time since, saying “it looks like XXX’s airtag has been lost and is with you, click here to message them” Did you read past the headline? Apple is doing exactly this.
- jakear 5y ago
  Did you? Only if they have an iPhone. “Don’t want to be assaulted/stalked/robbed via our $29 device? Buy our $1,000 device!”
simondotau 5y ago
> Off the top of my head: a notification any time a tag has been away from it’s owners device for more than X time and has been around your device for at least Y time That's exactly what Apple has done. This isn't even new information. It was part of the AirTags announcement on the 20th of April. "iOS devices can also detect an AirTag that isn’t with its owner, and notify the user if an unknown AirTag is seen to be traveling with them from place to place over time." https://www.apple.com/newsroom/2021/04/apple-introduces-airtag/ https://www.apple.com/newsroom/2021/04/apple-introduces-airt...