Hacker News Reader

Comment by Despegar | Hacker News Reader

Wired has a good article about how it works

https://www.wired.com/story/apple-find-my-cryptography-bluet...

A rotating scheme that makes it impossible for the wrong actors to track you.

It would be better if I could verify the code running on the device. You have to trust that Apple won’t track you. And hey, I trust Apple more than some unfriendly government, but I still have to trust Apple. If a big profitable unfriendly government asked them to track someone, what would Apple do?

> If a big profitable unfriendly government asked them to track someone, what would Apple do?

Presumably the exact same thing they'd have done if they hadn't rolled out this Find My feature. They designed it so Apple can't tell where your device is, which means if anyone wants to demand this info from Apple, then Apple has to implement that tracking separately, which they could do regardless of the Find My feature's existence.

If Apple had access to the device data themselves, then that's a huge problem because governments can reasonably start issuing warrants for that info. The fact that Apple doesn't have it means nothing has changed on the governmental front.

> The fact that Apple doesn't have it means nothing has changed on the governmental front.

You’re presuming that Apple does not “have” our location data. I am making the claim that Apple could gain our location data if Apple wanted to. I think we are making different arguments. I don’t know if Apple has anyone’s location data. But if Apple decided to selectively enable the collection of some people’s location data, the iPhone 11 would offer them increased precision which other iPhone 11 users would unknowingly assist in collecting.

Why would an actor use Apple as a target vector? It is much easier to get location tracking thru the mobile service providers. They have the location data in real time and can’t deny that. It’s done thousands of times a day all over the world with and without a warrant. No vendor specific phone and no activation of special functions needed.

> Why would an actor use Apple as a target vector?

I can only speculate. But if I wanted someone’s location without making some noise, this increased precision would be nice to have over carrier’s coarse location data. Your GPS position could localize you to a building, but your UWB position could perhaps localize you to a room. And actually if the law enforcement agency had a device capable of detecting yours based on its UWB signal, they could find you very quietly.

Using current generation technologies like OTDOA and similar, cell carriers can already localize you to a room in a building in many cases.

Verizon can do down to around 10 centimeter accuracy with their LTE-M network in the best case (don’t have a link to support that handy, otherwise I’d share).

Or any third parties that you agreed to broadcast location data. We know the geo-location + time dragnet warrants are already used very widely with Google.

I'm not really sure how the U1 data is particularly relevant to governments. They don't generally need to know the precise movements of your phone about a single room. GPS will already locate you to the building and frequently to the room itself.

Most people underestimate the usefulness of location data. Do you can use location data to compute accurate credit scores? (better than what banks achieve). To predict health state?

The article talks how a device owner can opt-in, but there's this:

> A nearby stranger's iPhone, with no interaction from its owner, will pick up the signal, check its own location, and encrypt that location data using the public key it picked up from the [stolen] laptop

Reply on news.ycombinator.com