34 ms·

AirTags only work with an iCloud account and Apple ID. To get such you need to provide a telephone number, which is linked to your real-world identity, allowing

by sneak 3y ago

AirTags only work with an iCloud account and Apple ID. To get such you need to provide a telephone number, which is linked to your real-world identity, allowing Apple and the US federal police to track your ID-linked tag whereabouts in real-time without a warrant.

datapolitical 3y ago
AirTag data is encrypted with a key that resides only on your devices. It cannot be decrypted by Apple.
- sneak 3y ago
  That's what they say about iMessage, too, but then the devices back up the endpoint keys to Apple in the iCloud Backup (non-e2ee and readable by Apple/FBI). The AirTag keys are supposedly stored in iCloud Keychain (which unlike nudes sent via iMessage, is actually excluded from the non-e2ee iCloud Backup) but it's been a long time since I have read the security architecture document for how the offline Find My system works. The issue with "the data is encrypted" is that a) the receiving device isn't yours (it's some random person's iPhone) and if it's totally opaque to Apple, how do they know to provide that encrypted data provided by some random airport iPhone to your specific account so that you can decrypt it? It seems sort of handwavey to me. I remain unconvinced that Apple is that diligent about maintaining lack of location tracking for iCloud to AirTag mappings given that 99.99%-ish of iCloud users are already providing location to Apple a hundred other times a day (maps, ads, app store, music, books, TV+, etc).
benabbottnz 3y ago
> “you need to provide a telephone number, which is linked to your real-world identity” What country do you live in? I can go to my local supermarket and buy dozens of pre-paid SIM cards with pocket change. If you’re somehow associating your literal identity to a phone number, it sounds like you must be in a pretty heavy surveillance state. Additionally, if you’re worried about being tracked, I hope you don’t carry a phone whatsoever.

by sneak 3y ago

datapolitical 3y ago

AirTag data is encrypted with a key that resides only on your devices. It cannot be decrypted by Apple.

sneak 3y ago
That's what they say about iMessage, too, but then the devices back up the endpoint keys to Apple in the iCloud Backup (non-e2ee and readable by Apple/FBI). The AirTag keys are supposedly stored in iCloud Keychain (which unlike nudes sent via iMessage, is actually excluded from the non-e2ee iCloud Backup) but it's been a long time since I have read the security architecture document for how the offline Find My system works. The issue with "the data is encrypted" is that a) the receiving device isn't yours (it's some random person's iPhone) and if it's totally opaque to Apple, how do they know to provide that encrypted data provided by some random airport iPhone to your specific account so that you can decrypt it? It seems sort of handwavey to me. I remain unconvinced that Apple is that diligent about maintaining lack of location tracking for iCloud to AirTag mappings given that 99.99%-ish of iCloud users are already providing location to Apple a hundred other times a day (maps, ads, app store, music, books, TV+, etc).

benabbottnz 3y ago

> “you need to provide a telephone number, which is linked to your real-world identity” What country do you live in? I can go to my local supermarket and buy dozens of pre-paid SIM cards with pocket change. If you’re somehow associating your literal identity to a phone number, it sounds like you must be in a pretty heavy surveillance state. Additionally, if you’re worried about being tracked, I hope you don’t carry a phone whatsoever.