5 ms·

It uses BLE (I believe), and data upload can be combined with other requests on the iPhone's next cellular connection request. CPU use is going to be extremely

It uses BLE (I believe), and data upload can be combined with other requests on the iPhone's next cellular connection request. CPU use is going to be extremely minimal. BLE power usage for a low data rate transmission is very, very low. I don't really see any realistic density of AirTags that would have any measurable impact on energy use of nearby iPhones.

londons_explore 5y ago
The power hungry bit is probably powering in the GPS to attach a location. On Android at least, getting a GPS fix takes many seconds, during which the CPU cannot sleep. For that reason, a default Android phone won't power up the GPS for hours on end sometimes. Yet this find-my feature might require a GPS position every few minutes whenever a new tag is seen. That's a lot of extra power.
- X-Istence 5y ago
  Most users have Find My turned on for their devices so that if they are lost or stolen they can find them. Find My on your phone already has to get an approximate location, and it does so fairly frequently (since you can track somewhat realtime). So having an Air Tag piggy back on the same mechanism won't cost a whole lot in terms of having to power on the geolocation capabilities.
- myself248 5y ago
  If they were to officially support this use-case of arbitrary data transmission, you could also default to non-GPS-located transactions, which would save that power except in cases where the user has specified that they do need locations. Also, coarse location (cellular and wifi) uses basically no power, and might be good enough for an awful lot of applications.
pbhjpbhj 5y ago
This is probably wrong: I guess they can just rate-limit the program that runs in the iPhone, but that still (to me, very naively) would allow a DoS that prevented genuine tags from access. As mentioned in the OP to know if the tag is genuine a device needs to go to the trouble of receiving the traffic in case it's real, then decrypting (search "ECIES encryption" in OP): so you'd be wasting quite a bit of processing before you reject a fake tag. If they rate limit the decryption - which you'd have to - then you can overwhelm a device on the network by sending out fake packets. It strikes me you can generate random BLE data that looks like airtag data cheaper than you can verify packets and so in theory one iPhone could overwhelm a minimum of one other; and presumably could overwhelm all others in range (with lower or equal processing power). They do mention their (the OP's) public keys being rejected. So, if my analysis is right you can either use all processing on all devices in range, or overwhelm all devices in range of they're rate-limited. The second case is preferable. I'm interested in why I'm wrong. Can the imaginary fake tags in my analysis be rejected using less power than it takes to make them?
- floatingatoll 5y ago
  Or, in summary: “Using radio frequencies to intentionally disrupt or damage the functioning of devices you do not own”. Make sure the FCC doesn’t catch you!
  - pbhjpbhj 5y ago
    I'm not in USA, but I've always read FCC as an administrative arm of government, do they do active monitoring and enforcement? Like of you fire up a rogue transmitter the FCC send officers to apprehend you?
    - easton 5y ago
      They have an enforcement division. I’ve always heard if you start a pirate radio station with a bit too much signal, it’s only a matter of time before two agents come tell you to knock it off. https://www.fcc.gov/enforcement https://www.fcc.gov/enforcement
    - floatingatoll 5y ago
      USPS has an enforcement division as well!
- londons_explore 5y ago
  DoS within Wifi transmission range is an unavoidable part of any wireless protocol. The attack you propose is no more powerful, so probably not worth protecting against.

londons_explore 5y ago

The power hungry bit is probably powering in the GPS to attach a location. On Android at least, getting a GPS fix takes many seconds, during which the CPU cannot sleep. For that reason, a default Android phone won't power up the GPS for hours on end sometimes. Yet this find-my feature might require a GPS position every few minutes whenever a new tag is seen. That's a lot of extra power.

X-Istence 5y ago
Most users have Find My turned on for their devices so that if they are lost or stolen they can find them. Find My on your phone already has to get an approximate location, and it does so fairly frequently (since you can track somewhat realtime). So having an Air Tag piggy back on the same mechanism won't cost a whole lot in terms of having to power on the geolocation capabilities.
myself248 5y ago
If they were to officially support this use-case of arbitrary data transmission, you could also default to non-GPS-located transactions, which would save that power except in cases where the user has specified that they do need locations. Also, coarse location (cellular and wifi) uses basically no power, and might be good enough for an awful lot of applications.

pbhjpbhj 5y ago

This is probably wrong: I guess they can just rate-limit the program that runs in the iPhone, but that still (to me, very naively) would allow a DoS that prevented genuine tags from access. As mentioned in the OP to know if the tag is genuine a device needs to go to the trouble of receiving the traffic in case it's real, then decrypting (search "ECIES encryption" in OP): so you'd be wasting quite a bit of processing before you reject a fake tag. If they rate limit the decryption - which you'd have to - then you can overwhelm a device on the network by sending out fake packets. It strikes me you can generate random BLE data that looks like airtag data cheaper than you can verify packets and so in theory one iPhone could overwhelm a minimum of one other; and presumably could overwhelm all others in range (with lower or equal processing power). They do mention their (the OP's) public keys being rejected. So, if my analysis is right you can either use all processing on all devices in range, or overwhelm all devices in range of they're rate-limited. The second case is preferable. I'm interested in why I'm wrong. Can the imaginary fake tags in my analysis be rejected using less power than it takes to make them?

floatingatoll 5y ago
Or, in summary: “Using radio frequencies to intentionally disrupt or damage the functioning of devices you do not own”. Make sure the FCC doesn’t catch you!
- pbhjpbhj 5y ago
  I'm not in USA, but I've always read FCC as an administrative arm of government, do they do active monitoring and enforcement? Like of you fire up a rogue transmitter the FCC send officers to apprehend you?
  - easton 5y ago
    They have an enforcement division. I’ve always heard if you start a pirate radio station with a bit too much signal, it’s only a matter of time before two agents come tell you to knock it off. https://www.fcc.gov/enforcement https://www.fcc.gov/enforcement
  - floatingatoll 5y ago
    USPS has an enforcement division as well!
londons_explore 5y ago
DoS within Wifi transmission range is an unavoidable part of any wireless protocol. The attack you propose is no more powerful, so probably not worth protecting against.