4 ms·

As there's a limit of 16 AirTags per Apple ID, and each AirTag's keys rotate every 15 minutes, presumably Apple can detect if anyone is abusing the system by se

As there's a limit of 16 AirTags per Apple ID, and each AirTag's keys rotate every 15 minutes, presumably Apple can detect if anyone is abusing the system by sending more than 16 different "messages" per 15 minutes. They can't detect this when the fake airtags are sending, but can detect it from stored message timestamps when you query. If they start to see this being abused a lot, they can then block Apple IDs. To avoid Apple being able to see this, you probably need to either use multiple Apple IDs, or send less than 16 bits per 15 minutes.

blantonl 5y ago
for nation states and interested parties, these seem like trivial restrictions considering the value of now having a deployed mobile mesh network of 1 billion + devices available for free.
tialaramex 5y ago
Suppose a real AirTag owner is wondering where their lost tag is. Although it would be ideal to learn where it is right now they'd be somewhat happy to know where an iPhone "saw" it two hours ago, or indeed a week ago... and Apple's system deliberately stores up to a week of data. A week is about 700 keys to check. For one "lost" device, but as you note Apple are happy for you to buy more than a dozen, and of course you wouldn't be happy if Apple tells you that you must only track one of those. Apple has no way to know if your check for 7000 keys is, in fact, ten devices for a week, or 7000 unrelated queries, it deliberately doesn't know how to relate the keys to one or more tags. So while yes, that would mean if you have a long term sensor network Apple could block you using it to move more than a few bytes per hour per Apple ID (Apple IDs are free) if you have a more nefarious motive to move say a kilobyte in an hour or two, once every few weeks, that should work fine.
- mhandley 5y ago
  It's not the number of keys you check - that can indeed be large. It's the number of responses for different keys you receive with recorded receipt timestamps in the same 15 minute interval. If that is greater than 16 (or perhaps 32 given a normal tag can send two different keys in the same 15 min interval), Apple will know you're either querying more than 16 tags, or have tags using more than one key each.
  - tialaramex 5y ago
    The timestamps are useful to Apple only so that its storage needs don't grow continuously over time, it gets to throw away material it was told about seven days ago. Because AirTag is designed not to chew battery lifetime on the various Apple devices which are effectively drafted to report they saw an AirTag those devices have no limit on how long they can take to get around to telling Apple what they saw. So Apple does have a "timestamp" but that doesn't tell them when the BLE happened, it just helps them purge their database tables. Either the site linked or the paper (I can't remember which) has a chart showing that it can take at least hours for some iDevices to be comfortable that it's time to tell Apple. Maybe they're configured not to spend $$$ on mobile Internet and waited until they saw a friendly WiFi AP, maybe they got low on battery and went dormant until charged that evening. Apple's main "defence" appears to be, as usual, that stuff is designed to be hard to use unless you've given Apple money, thus defending Apple's profitability but not really its customers of course. So a Mac can easily be tricked into doing this stuff (as was done for the article), but you'll need to do a bunch of custom reverse engineering to write a PC app and periodically Apple will casually break it, not because this helps their users but because it protects revenue. I predict some researchers will do that reverse engineering work, Bad Guys will just buy a MacBook.
barbegal 5y ago
This is covered in the blog post. There doesn't currently appear to be any rate limiting. And the rate limit would be tricky to implement because there are times when you need to catch up on the location of a device over a longer period of time. But yes Apple could limit to say 16 * 4 * 24 * 7 = 10752 requests per week.
- mhandley 5y ago
  No, the comment in the blog post is not what I'm suggesting. All Apple needs is to do is record the timestamps that iPhones received the AirTag beacon. When an Apple ID queries for keys, if Apple finds more matching key reports received in any 15 minute period than is plausible, then either the Apple ID is associated with more than the 16 permitted AirTags, or some of them are using more than one key per 15 minutes. So Apple can definitely detect this unless you either use multiple Apple IDs, or you limit to around 16 bits per 15 minutes.

blantonl 5y ago

for nation states and interested parties, these seem like trivial restrictions considering the value of now having a deployed mobile mesh network of 1 billion + devices available for free.

tialaramex 5y ago

Suppose a real AirTag owner is wondering where their lost tag is. Although it would be ideal to learn where it is right now they'd be somewhat happy to know where an iPhone "saw" it two hours ago, or indeed a week ago... and Apple's system deliberately stores up to a week of data. A week is about 700 keys to check. For one "lost" device, but as you note Apple are happy for you to buy more than a dozen, and of course you wouldn't be happy if Apple tells you that you must only track one of those. Apple has no way to know if your check for 7000 keys is, in fact, ten devices for a week, or 7000 unrelated queries, it deliberately doesn't know how to relate the keys to one or more tags. So while yes, that would mean if you have a long term sensor network Apple could block you using it to move more than a few bytes per hour per Apple ID (Apple IDs are free) if you have a more nefarious motive to move say a kilobyte in an hour or two, once every few weeks, that should work fine.

mhandley 5y ago
It's not the number of keys you check - that can indeed be large. It's the number of responses for different keys you receive with recorded receipt timestamps in the same 15 minute interval. If that is greater than 16 (or perhaps 32 given a normal tag can send two different keys in the same 15 min interval), Apple will know you're either querying more than 16 tags, or have tags using more than one key each.
- tialaramex 5y ago
  The timestamps are useful to Apple only so that its storage needs don't grow continuously over time, it gets to throw away material it was told about seven days ago. Because AirTag is designed not to chew battery lifetime on the various Apple devices which are effectively drafted to report they saw an AirTag those devices have no limit on how long they can take to get around to telling Apple what they saw. So Apple does have a "timestamp" but that doesn't tell them when the BLE happened, it just helps them purge their database tables. Either the site linked or the paper (I can't remember which) has a chart showing that it can take at least hours for some iDevices to be comfortable that it's time to tell Apple. Maybe they're configured not to spend $$$ on mobile Internet and waited until they saw a friendly WiFi AP, maybe they got low on battery and went dormant until charged that evening. Apple's main "defence" appears to be, as usual, that stuff is designed to be hard to use unless you've given Apple money, thus defending Apple's profitability but not really its customers of course. So a Mac can easily be tricked into doing this stuff (as was done for the article), but you'll need to do a bunch of custom reverse engineering to write a PC app and periodically Apple will casually break it, not because this helps their users but because it protects revenue. I predict some researchers will do that reverse engineering work, Bad Guys will just buy a MacBook.

barbegal 5y ago

This is covered in the blog post. There doesn't currently appear to be any rate limiting. And the rate limit would be tricky to implement because there are times when you need to catch up on the location of a device over a longer period of time. But yes Apple could limit to say 16 * 4 * 24 * 7 = 10752 requests per week.

mhandley 5y ago
No, the comment in the blog post is not what I'm suggesting. All Apple needs is to do is record the timestamps that iPhones received the AirTag beacon. When an Apple ID queries for keys, if Apple finds more matching key reports received in any 15 minute period than is plausible, then either the Apple ID is associated with more than the 16 permitted AirTags, or some of them are using more than one key per 15 minutes. So Apple can definitely detect this unless you either use multiple Apple IDs, or you limit to around 16 bits per 15 minutes.