3 ms·

> Every AirTag has a unique serial number, and paired AirTags are associated with an Apple ID. Apple can provide the paired account details in response to a sub

> Every AirTag has a unique serial number, and paired AirTags are associated with an Apple ID. Apple can provide the paired account details in response to a subpoena or valid request from law enforcement. We have successfully partnered with them on cases where information we provided has been used to trace an AirTag back to the perpetrator, who was then apprehended and charged. This makes me wonder, could Apple go further? What if Apple put up a web page where anyone could type in the serial number of any AirTag they found, and instantly see the name and phone number of its owner? Apple could even print the website URL on the back of every future AirTag (albeit presumably in tiny print). I bet that would make stalkers think twice! And, I don't think there's any technical reason Apple couldn't do it, right? What I'm not sure about is whether this would be an invasion of the owner's privacy. But, if you're using AirTags to only track your own belongings, when would this ever come up? The owner's privacy seems less important than that of an unwitting victim, since the owner can choose to not buy an AirTag.

foolfoolz 5y ago
this would violate privacy laws like gdpr
- x0x0 5y ago
  Why and how? I'm quite familiar with gdpr, btw -- and I don't see how being able to look up a uuid or some other nonsequential identifier via a site to find the owner obviously violates it. There's a strong legitimate interest case for anyone in possession of a global tracking tag being able to find out the owner, I would think.
  - Terry_Roll 5y ago
    You dont know the circumstances for why an airtag is where it is, what if a parent sewed one into their kids clothes or bag or shoe, but got ripped out or something? Apple should know who possesses the airtags at the very least, and if an airtag is reported lost/stolen, that info could be conveyed back to the person who found it, but nothing more until Apple has then liased with the "owner" to find out what to do next. Obviously this can be automated to some degree.
  - kortilla 5y ago
    I don’t want some asshole who steals my keys to be able to look up my name. How is that a good idea?
  - foolfoolz 5y ago
    the problem is an api that returns someone’s pii without authenticating they are allowed to see it. a uuid on its own is not a problem. but if you can take one and establish a link pii then the uuid becomes a pii risk.
    - x0x0 5y ago
      The far bigger problem is the airtag itself, which spews unpermissioned tracking data without any consent required.
      - theshrike79 5y ago
        There is consent. If you don't want the "spewed tracking data", you can disable the Find My Network completely.
        x0x0 5y ago
        Apple has made no attempt at getting consent from whomever the airtag is on. Maybe if you have an iphone it could alert you.
w-ll 5y ago
> And, I don't think there's any technical reason Apple couldn't do it, right? Technical no; Adding a fraction of a penny to engrave the uuid on the tag is a non-starter.
- zeusk 5y ago
  But they offer free engraving anyway???
- Wowfunhappy 5y ago
  Well, Apple could potentially make users download an app to read the UUID (hopefully not iOS-only), although obviously printing it would be better.
feupan 5y ago
Now if only I had sand paper around. In theory I think you just need to get it closer to an iPhone, no print needed.
eftychis 5y ago
Consider theft. Now the thieves have the victims phone number to attempt to further steal from them. Or if there is an audible sound, they know the police is coming after them and can drop the airtag and avoid apprehension. This is a two edge blade. Personally, if I was going to use an airtag I would use it to protect myself in case of theft. Now, the thieves can locate the airtag due to a notification and move it to an unsuspecting other victim, which will then move on to press charges against me, and I will have to defend myself in court. I don't see the appeal.
- geofft 5y ago
  Right, or even consider the original case where you have an AirTag on your keys for if you lose them - given a name and a phone number, someone who finds your keys can quite possibly figure out where you live and use the keys. Most things you lose are both less dangerous lost and worth less to a criminal (and hence less likely to induce someone to become a criminal) if they can't be tied back to you. Don't put "If found, return to 123 Main Street" on your keys, don't put "Apple Confidential" on your USB keys, don't engrave "Property of North West" on her Switch, etc.
  - Wowfunhappy 5y ago
    Hm, how easy is it to get an address from a cell phone number these days? Maybe Apple could only include the Apple ID? My goal would be to provide enough information so that, if the AirTag's owner is someone the victim knows, they'll be able to determine who it is. Apple needn't provide enough information to identify random strangers, because most stalkers aren't random strangers. (And, the AirTag is appealing due to its ease of use; it would be easier and cheaper to buy a GPS tracker than set up a burner iPhone.) It may not be possible to do this in a completely harmless way to the AirTag owner, but I do think potential victims should get more priority here. Telling everyone to file a police report isn't great IMO, because potential victims may have all sorts of reasons for not wanting the police involved.
- Wowfunhappy 5y ago
  But Apple is already saying you shouldn't use AirTags for cases of theft. The AirTags already attempt to alert people to their presence, including with sound.
quirino 5y ago
I wonder how this would work. Even if you do find the Apple ID the AirTag is associated with, how do you find the person associated with the Apple ID? You can use any name you wish there as far as I know.
- Wowfunhappy 5y ago
  If you have an iPhone, it would be hard to fake your phone number. It could be a burner phone, but if you're going to put in that much effort you might as well get a GPS tracker. And, chances are the stalker is probably someone you know.
up6w6 5y ago
If I understood correctly, this still doesn't protect you against custom Airtags using embedded boards[1]. You could just use any serial number you want and maybe even incriminate other people by using the serial number of their authentic Airtag? [1] https://github.com/seemoo-lab/openhaystack/ https://github.com/seemoo-lab/openhaystack/
- mkj 5y ago
  If they can link serial numbers to appleids it would imply that they could block non-apple devices? Unless the Apple serial numbers are also randomly generated or something? (Might check the apple docs later)
- theshrike79 5y ago
  If your threat model includes someone "just cloning your airtag and planting a clone", I think you've got big issues you need to deal with.
mdoms 5y ago
I honestly can't tell if you're being sarcastic but this is horrifying.
bitcurious 5y ago
Lose a pair of keys? With that system in place anyone who finds them can trivially find out what door they open.

foolfoolz 5y ago

this would violate privacy laws like gdpr

x0x0 5y ago
Why and how? I'm quite familiar with gdpr, btw -- and I don't see how being able to look up a uuid or some other nonsequential identifier via a site to find the owner obviously violates it. There's a strong legitimate interest case for anyone in possession of a global tracking tag being able to find out the owner, I would think.
- Terry_Roll 5y ago
  You dont know the circumstances for why an airtag is where it is, what if a parent sewed one into their kids clothes or bag or shoe, but got ripped out or something? Apple should know who possesses the airtags at the very least, and if an airtag is reported lost/stolen, that info could be conveyed back to the person who found it, but nothing more until Apple has then liased with the "owner" to find out what to do next. Obviously this can be automated to some degree.
- kortilla 5y ago
  I don’t want some asshole who steals my keys to be able to look up my name. How is that a good idea?
- foolfoolz 5y ago
  the problem is an api that returns someone’s pii without authenticating they are allowed to see it. a uuid on its own is not a problem. but if you can take one and establish a link pii then the uuid becomes a pii risk.
  - x0x0 5y ago
    The far bigger problem is the airtag itself, which spews unpermissioned tracking data without any consent required.
    - theshrike79 5y ago
      There is consent. If you don't want the "spewed tracking data", you can disable the Find My Network completely.
      - x0x0 5y ago
        Apple has made no attempt at getting consent from whomever the airtag is on. Maybe if you have an iphone it could alert you.

w-ll 5y ago

> And, I don't think there's any technical reason Apple couldn't do it, right? Technical no; Adding a fraction of a penny to engrave the uuid on the tag is a non-starter.

zeusk 5y ago
But they offer free engraving anyway???
Wowfunhappy 5y ago
Well, Apple could potentially make users download an app to read the UUID (hopefully not iOS-only), although obviously printing it would be better.

feupan 5y ago

Now if only I had sand paper around. In theory I think you just need to get it closer to an iPhone, no print needed.

eftychis 5y ago

Consider theft. Now the thieves have the victims phone number to attempt to further steal from them. Or if there is an audible sound, they know the police is coming after them and can drop the airtag and avoid apprehension. This is a two edge blade. Personally, if I was going to use an airtag I would use it to protect myself in case of theft. Now, the thieves can locate the airtag due to a notification and move it to an unsuspecting other victim, which will then move on to press charges against me, and I will have to defend myself in court. I don't see the appeal.

geofft 5y ago
Right, or even consider the original case where you have an AirTag on your keys for if you lose them - given a name and a phone number, someone who finds your keys can quite possibly figure out where you live and use the keys. Most things you lose are both less dangerous lost and worth less to a criminal (and hence less likely to induce someone to become a criminal) if they can't be tied back to you. Don't put "If found, return to 123 Main Street" on your keys, don't put "Apple Confidential" on your USB keys, don't engrave "Property of North West" on her Switch, etc.
- Wowfunhappy 5y ago
  Hm, how easy is it to get an address from a cell phone number these days? Maybe Apple could only include the Apple ID? My goal would be to provide enough information so that, if the AirTag's owner is someone the victim knows, they'll be able to determine who it is. Apple needn't provide enough information to identify random strangers, because most stalkers aren't random strangers. (And, the AirTag is appealing due to its ease of use; it would be easier and cheaper to buy a GPS tracker than set up a burner iPhone.) It may not be possible to do this in a completely harmless way to the AirTag owner, but I do think potential victims should get more priority here. Telling everyone to file a police report isn't great IMO, because potential victims may have all sorts of reasons for not wanting the police involved.
Wowfunhappy 5y ago
But Apple is already saying you shouldn't use AirTags for cases of theft. The AirTags already attempt to alert people to their presence, including with sound.

quirino 5y ago

I wonder how this would work. Even if you do find the Apple ID the AirTag is associated with, how do you find the person associated with the Apple ID? You can use any name you wish there as far as I know.

Wowfunhappy 5y ago
If you have an iPhone, it would be hard to fake your phone number. It could be a burner phone, but if you're going to put in that much effort you might as well get a GPS tracker. And, chances are the stalker is probably someone you know.

up6w6 5y ago

If I understood correctly, this still doesn't protect you against custom Airtags using embedded boards[1]. You could just use any serial number you want and maybe even incriminate other people by using the serial number of their authentic Airtag? [1] https://github.com/seemoo-lab/openhaystack/ https://github.com/seemoo-lab/openhaystack/

mkj 5y ago
If they can link serial numbers to appleids it would imply that they could block non-apple devices? Unless the Apple serial numbers are also randomly generated or something? (Might check the apple docs later)
theshrike79 5y ago
If your threat model includes someone "just cloning your airtag and planting a clone", I think you've got big issues you need to deal with.

mdoms 5y ago

I honestly can't tell if you're being sarcastic but this is horrifying.

bitcurious 5y ago

Lose a pair of keys? With that system in place anyone who finds them can trivially find out what door they open.