5 ms·
Tile's security is so bad it's a feature for stalkers
- dreamcompiler 2mo agoThis explains why I'm seeing commercials for Life360 now for the first time ever: They've developed a new revenue stream by selling everybody's location to advertisers. Now deleted from my family's phones.
- PLenz 2mo agoThat was always the revenue stream, the devices were just a way to get you to give it to them. It's been a minute since I was current on who gets what in the HMD world but I think that data ultimately flows to Placer.ai
- shye 2mo agoNot always. In the beginning it was supposed to be a freemium product, with all the revenue coming from subscriptions.
- alt227 2mo agoWhats the connection between an advertiser knowing your location, and ads from Life360?
- mplewis 2mo agoLife360 increases their marketing budget when they have a profitable way to sell user data so they can get the devices into the hands of more target users.
- zidel 2mo agoPaper: https://arxiv.org/abs/2510.00350 https://arxiv.org/abs/2510.00350
- kefabean 2mo agoDoes anyone know whether https://mygrid.app/ https://mygrid.app/ is trustworthy? Development had been glacial, but looking at their website it seems they finally support degoogled android which is a huge step forwards.
- octoberfranklin 2mo agoBBP;DR (Broken Bot Protection; Didn't Read) Loops forever at blog.adafruit.com Performing security verification This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot.
- stackghost 2mo agoPassing the security verification succeeded for me (firefox on a mac, with ublock origin).
- gruez 2mo agoI never understood this. You can pass turnstile challenges on tor browser in a linux/windows VM, of all things. What unusual browser config are people using to trigger a block?
- Y_Y 2mo agoI use a DPRK VPN
- gruez 2mo agoIs it actually in DPRK, or an unscrupulous operator that hosts the server outside DPRK, but hosts a puts fake information in the whois/geofeed?
- Y_Y 2mo agoIt was a silly joke. I don't know of any provider real or take that offers North Korean IPs, and I suspect that roughly meets demand.
- prosopts 2mo agoI frequently see the problem on Android running Brave with default filters. Unsure on cause - I just give up.
- chrisjj 2mo ago
- kotaKat 2mo ago"But, but, the Tile TOS says they'll fine a stalker a million dollars!" Life360 is such a skeevy bullshit company.
- deleted 2mo ago[deleted]
- alt227 2mo agoI dont get why this is really an issue when there are devices on Temu you can easily buy that are actually designed for stalking. Why would anybody with a genuine nefarious purpose spend their time hacking a tile when they can just buy a generic Chinese gps transponder?
- braiamp 2mo agoBecause it serves a nefarious purpose: to smear the company that makes these devices. I would not be surprised if this is part of some kind of campaign designed to restrict or damage someone.
- EdwardDiego 2mo agoYou went straight to conspiracy?
- braiamp 2mo agoThe title obviously has a slant, because the text of the article doesn't support it. So, yeah, I'm saying the title has a specific goal in mind.
- Dylan16807 2mo agoThe text seems to support it to me, but more importantly "saying the title has a specific goal" isn't answering the question. Yes the title is calling out the company. What takes you from there to some kind of broader campaign.
- malfist 2mo agoI read the article. It absolutely does support the title. Unless you someone consider finger printable devices sending unencrypted location data somehow doesn't enable stalking
- braiamp 2mo ago
- mawadev 2mo agoWhat the hell is Tile?
- alt227 2mo agoThats what google is for.
- psd1 2mo agoIt's a flat plate of material, typically a ceramic square with decorative finish, arranged in regular patterns as a floor or wall surface in rooms expected to be exposed to water, where it is bonded to a substrate with cementitious adhesive.
- evanjrowley 2mo agocross-platform forerunner of the Apple AirTag
- internet2000 2mo agoAirTag alternative
- brookst 2mo agoIf AirTag is a CD, Tile is 8 track.
- kerrieshitz 2mo ago[dead]
- user00005 2mo agoIt isn't that difficult to just not lose things. People love to over complicate their lives with technology, giving up money and privacy in the process.
- rafram 2mo agoThere are plenty of times when you have to trust someone(s) else with your belongings, sometimes for a very long time - say, airline baggage, bus luggage compartment, hotel left luggage, or gym lockers - and it's useful to have a tracker (ideally a more secure one, e.g. AirTag) in case anything goes wrong. And even if you're the type of person who never lets their bags leave their sight, nobody is immune to their keys slipping out of their pocket in a taxi.
- user00005 2mo agoI'm arguing the tradeoff of possible convenience isn't worth it. Tile is owned by Life360. The original article talks about Life360 selling your data to advertisers. Let's look at what the Tile app wants to collect from you: photos and videos, location, app activity, messages, personal info. They say 'no data is shared with third parties'. Does that include the parent company Life360 that does sell data with third parties? https://play.google.com/store/apps/datasafety?id=com.thetileapp.tile&hl=en-US https://play.google.com/store/apps/datasafety?id=com.thetile...
- rafram 2mo agoThen use a better, more private tracker.
- mspecter 2mo agoLast author on the paper here (https://arxiv.org/pdf/2510.00350 https://arxiv.org/pdf/2510.00350). Happy to answer any questions!
- 6stringmerc 2mo agoThanks! Have you considered evaluating the “AppClose” platform in a similar fashion? It is used in family / civil cases to my knowledge. Perhaps another worthwhile avenue of study, perhaps not. Thank you for your time.
- mspecter 2mo agoInteresting! Hadn't heard of it.
- mspecter 2mo agoAlso, I'm just the professor, the grad students on it are the real heroes: Akshaya Kumar [1] and Anna Raymaker [2]. [1] https://akumar805.github.io/ https://akumar805.github.io/ [2] https://annaraymaker.dad/ https://annaraymaker.dad/
- ollien 2mo agoIt's interesting to me that other trackers have end-to-end encryption. I wouldn't have expected it but makes sense for the threat model. > Providerslike Apple and Google achieve location indistinguishability by end-to-end encrypting location information using a public key embedded in BLE advertisements emitted by a tag Though it makes me wonder... What's the private key? If the public key is attached to the tag, how is the device getting it? I'm guessing it gets shared during pairing.
- mspecter 2mo agoIn general, yes! We did some follow on work explaining how all of this works, depending on the provider: https://petsymposium.org/popets/2026/popets-2026-0113.pdf https://petsymposium.org/popets/2026/popets-2026-0113.pdf
- ollien 2mo agoVery cool! I only skimmed Section 4 a bit, but that's really cool! I was going to ask how the web UIs possibly work if the location is indistinguishable, but I went to the Google Find Hub, and it appears you can't view the location for tags unless you enter your phone's pin code / pattern lock. This must either communicate with the phone or the keys are stored on Google's end. EDIT: I turned my phone off, and I can still get the location of my keys... surely this doesn't mean the key is stored on their end? Wouldn't be very good E2EE in that case :)
- izacus 2mo agoThe encryption key is derived from your PIN, it doesn't need to access the phone to do a new derivation.
- miki123211 2mo agoAFAIK, there's a pre-shared key exchanged during pairing, and you then calculate keypairs based on (key, timestamp). Rotating your keypairs in that way prevents attackers from identifying you across time. E.G. if they link a particular keypair to you — let's say at an Airport security gate — that doesn't let them know you've entered a lawyer's office a week later, because that's done under a different, unrelated public key.