3 ms·

I wish it had a way to integrate with the Find My app instead of having to go through their own (wonky) process to retrieve locations. The chinese clones can do

I wish it had a way to integrate with the Find My app instead of having to go through their own (wonky) process to retrieve locations. The chinese clones can do it (even with their own branding), so it must be possible somehow.

alibarber 2y ago
I think that's the wall in Apple's walled garden here. From reading the official Apple spec. for partners a while back, as part of the pairing process, something is signed by the device with a cert/key that apple issued to that developer (after coming to an agreement i.e - $$) - and, crucially, is different from the keypair that the device will use to actually broadcast. This is then validated by apple and thus allowed to be added to that apple-id's account and hence on to the app. The keys broadcasted by the devices themselves in 'lost' mode (i.e. not in 2 way contact with the owner's device) are arbitrary and completely opaque, Apple doesn't have any way of tying them to an ID or device or developer. This is how the proposed project here works - these keys will always find their way to the apple server. It seems like the knockoff ones have just hijacked a legit key for the pairing process. This means if Apple desires and finds out the key, it can probably remove all devices from all accounts - although the devices themselves will keep on broadcasting and their locations could be accessed in the above janky way. I wonder too if the original key owner might get a large bill for per-device royalties if/when Apple searches it's DB for a count of 'devices-added-to-an-apple-id-signed-by-this-key'...
- nl 2y ago
  This isn't actually the case. Apple supports 3rd party trackers - see https://mfi.apple.com/ https://mfi.apple.com/ and https://developer.apple.com/find-my/ https://developer.apple.com/find-my/
  - alibarber 2y ago
    Yes, this is exactly what I’m saying. Apple officially supports third party trackers, who’s manufactures are issued, by apple as a part of their MFI programs, keys with which these third party devices must use to sign their pairing requests to the users apple account. Perhaps these $5 devices do indeed include legitimate keys from apple to use from this, perhaps they have copied one from another device.
oulipo 2y ago
The Chinese clones use the Apple FindMy program, so they are official tags which can be displayed in the app. The OpenHaystack is a hack which uses different keys, and can't be shown on the app for cryptographic reasons
emsixteen 2y ago
The clones are limited though, are they not? Like, they don't have the directional stuff and all that do they? I may be misremembering what I've read elsewhere.
nguyenkien 2y ago
The "chinese clone" are official supported, here is how: https://developer.apple.com/find-my/ https://developer.apple.com/find-my/

alibarber 2y ago

I think that's the wall in Apple's walled garden here. From reading the official Apple spec. for partners a while back, as part of the pairing process, something is signed by the device with a cert/key that apple issued to that developer (after coming to an agreement i.e - $$) - and, crucially, is different from the keypair that the device will use to actually broadcast. This is then validated by apple and thus allowed to be added to that apple-id's account and hence on to the app. The keys broadcasted by the devices themselves in 'lost' mode (i.e. not in 2 way contact with the owner's device) are arbitrary and completely opaque, Apple doesn't have any way of tying them to an ID or device or developer. This is how the proposed project here works - these keys will always find their way to the apple server. It seems like the knockoff ones have just hijacked a legit key for the pairing process. This means if Apple desires and finds out the key, it can probably remove all devices from all accounts - although the devices themselves will keep on broadcasting and their locations could be accessed in the above janky way. I wonder too if the original key owner might get a large bill for per-device royalties if/when Apple searches it's DB for a count of 'devices-added-to-an-apple-id-signed-by-this-key'...

nl 2y ago
This isn't actually the case. Apple supports 3rd party trackers - see https://mfi.apple.com/ https://mfi.apple.com/ and https://developer.apple.com/find-my/ https://developer.apple.com/find-my/
- alibarber 2y ago
  Yes, this is exactly what I’m saying. Apple officially supports third party trackers, who’s manufactures are issued, by apple as a part of their MFI programs, keys with which these third party devices must use to sign their pairing requests to the users apple account. Perhaps these $5 devices do indeed include legitimate keys from apple to use from this, perhaps they have copied one from another device.

oulipo 2y ago

The Chinese clones use the Apple FindMy program, so they are official tags which can be displayed in the app. The OpenHaystack is a hack which uses different keys, and can't be shown on the app for cryptographic reasons

emsixteen 2y ago

The clones are limited though, are they not? Like, they don't have the directional stuff and all that do they? I may be misremembering what I've read elsewhere.

nguyenkien 2y ago

The "chinese clone" are official supported, here is how: https://developer.apple.com/find-my/ https://developer.apple.com/find-my/