4 ms·

It's not the number of keys you check - that can indeed be large. It's the number of responses for different keys you receive with recorded receipt timestamps

It's not the number of keys you check - that can indeed be large. It's the number of responses for different keys you receive with recorded receipt timestamps in the same 15 minute interval. If that is greater than 16 (or perhaps 32 given a normal tag can send two different keys in the same 15 min interval), Apple will know you're either querying more than 16 tags, or have tags using more than one key each.

tialaramex 5y ago
The timestamps are useful to Apple only so that its storage needs don't grow continuously over time, it gets to throw away material it was told about seven days ago. Because AirTag is designed not to chew battery lifetime on the various Apple devices which are effectively drafted to report they saw an AirTag those devices have no limit on how long they can take to get around to telling Apple what they saw. So Apple does have a "timestamp" but that doesn't tell them when the BLE happened, it just helps them purge their database tables. Either the site linked or the paper (I can't remember which) has a chart showing that it can take at least hours for some iDevices to be comfortable that it's time to tell Apple. Maybe they're configured not to spend $$$ on mobile Internet and waited until they saw a friendly WiFi AP, maybe they got low on battery and went dormant until charged that evening. Apple's main "defence" appears to be, as usual, that stuff is designed to be hard to use unless you've given Apple money, thus defending Apple's profitability but not really its customers of course. So a Mac can easily be tricked into doing this stuff (as was done for the article), but you'll need to do a bunch of custom reverse engineering to write a PC app and periodically Apple will casually break it, not because this helps their users but because it protects revenue. I predict some researchers will do that reverse engineering work, Bad Guys will just buy a MacBook.

tialaramex 5y ago

The timestamps are useful to Apple only so that its storage needs don't grow continuously over time, it gets to throw away material it was told about seven days ago. Because AirTag is designed not to chew battery lifetime on the various Apple devices which are effectively drafted to report they saw an AirTag those devices have no limit on how long they can take to get around to telling Apple what they saw. So Apple does have a "timestamp" but that doesn't tell them when the BLE happened, it just helps them purge their database tables. Either the site linked or the paper (I can't remember which) has a chart showing that it can take at least hours for some iDevices to be comfortable that it's time to tell Apple. Maybe they're configured not to spend $$$ on mobile Internet and waited until they saw a friendly WiFi AP, maybe they got low on battery and went dormant until charged that evening. Apple's main "defence" appears to be, as usual, that stuff is designed to be hard to use unless you've given Apple money, thus defending Apple's profitability but not really its customers of course. So a Mac can easily be tricked into doing this stuff (as was done for the article), but you'll need to do a bunch of custom reverse engineering to write a PC app and periodically Apple will casually break it, not because this helps their users but because it protects revenue. I predict some researchers will do that reverse engineering work, Bad Guys will just buy a MacBook.