3 ms·
The communication is one-way, and the only thing transmitted from the lost device is the bluetooth public key, so no. The device that detected the AirTag encryp
by etskinner 5y ago
The communication is one-way, and the only thing transmitted from the lost device is the bluetooth public key, so no. The device that detected the AirTag encrypts the location with the public key and transmits it to Apple, not the AirTag itself.
- amelius 5y agoBut what if there is a man in the middle, X: tag sends Bluetooth key to X, then X relays that (e.g. over the internet) to Y which sends it to an IPhone. And since the communication is one way, there is no encryption (I suppose), so replay-attacks should be possible unless it uses a clock. Someone could write an app which reads Bluetooth IDs and then transmits them at random times.
- angry_octet 5y agoI think spoofing will be difficult unless you can dump the key from a specific AirTag (already done, but it's a manual process involving disassembly and advanced skills and equipment). Replay attacks may be possible, but we will have to wait to see if the protocol is entirely passive. The iPhone could broadcast a challenge to the AirTag and transmit the signed response and response delay. The delay should be fairly tightly bounded. The AirTags do have a clock as I understand it, but drift is inevitable, so it wouldn't be a tight bound.