Hacker News Reader

My bluetooth headphones connect to my macbook pro when come home from work and my laptop is sitting on the kitchen table. My headphones tell me "two devices connected" when I walk in the door.

Although it seems like bluetooth _should_ be shut off by devices when not in use, I doubt most devices actually do that.

I'd really like to understand this deeper: are you sure your macbook was hibernating, even if it was closed? Are you sure the proximity advertisement came from the laptop? Usually it is the iPhone doing it.

I've seen that in airports and malls, more than 90% of the advertisements around are iPhones (Android doesn't do BtLe advertisement) and Windows computers (from the shops and stores). A small minority are beacons and wearables (iWatch, Fitbit, etc.) In libraries sometimes I can see Macbooks, but they all are non-hibernating.

My headphones are only paired with my macbook and my android phone. I always am walking with the headphones paired with my phone, so that's one of the two devices. The only other device is my macbook pro, that is often sitting on the kitchen table with it's lid closed, and unused for several days, and yet this happens every day. I obviously don't know what exactly is going on, but if they can "connect" then presumably something about the bluetooth is still functioning.

Interesting. Thanks for the info.

If you left the MacBook connected to the power supply and it is a 2016 model or later then it likely isn't really hibernating, even with the lid closed. By default, most of them remain active when connected to power.

However, you can disable the Bluetooth connection. Go to System Preferences > Bluetooth > Advanced Button and deselect "Allow Bluetooth devices to wake this computer."

I wonder who does the advertisements here. In BtLe the standard is to have the Peripheral (i.e: the headphones) doing proximity advertising and the Central doing the scanning. But, in principle, anything is possible.

"Also, almost all cameras don't advertise Bluetooth"

Many new cameras do. My Nikon surely does, and it keeps it on for quite some time after turning the device "off". Cameras use it to to set up adhoc wifi connections, and sometimes even for data transmission of preview images. I can't say whether laptops keep broadcasting or not (though I'd certainly make no assumptions given that BLE is made to allow virtually limitless use), however laptops are often stowed with a wireless mouse which gives the game up.

"Also, Tile trackers are mostly kept in things that people want to keep with them, one of their functionalities is precisely to warn the user when they're left behind."

The example they gave is a trailhead. There's a lot of shit you don't want to bring on a hike with you that you stow in your car, out of sight and hidden away for exactly the sort of discussion we're having.

Is it just a theory and suspicion? Maybe. But logically it makes a lot of sense, even if just "fear-mongering". It does rationally seem like something to contemplate, which is supposed to be the sort of subject HN was made for.

Out of curiosity I tried out a BLE scanner, finding 14 devices in my immediate proximity. Something I'd never really thought of before.

> Out of curiosity I tried out a BLE scanner, finding 14 devices in my immediate proximity. Something I'd never really thought of before.

I love to play with BLE scanners. It is interesting how the pattern of devices changes on each environment. On malls you'll see a lot of Windows computers and beacons. On school libraries you'll see a lot of Macs. At the gym you'll see iWatches, Fitbits and Garmins.

But the overwhelming majority are iPhones. Android are very quiet.

> Laptops don't propagate Bluetooth advertisements while closed and hibernating.

https://support.apple.com/en-us/HT204032 (Specifically, the Wireless Wake feature works over Bluetooth as well.)

Every Mac has Bluetooth always on unless explicitly turned off. As another commenter mentioned, you can see this by turning on bluetooth headphones near a Mac with the lid closed. The Mac connects basically immediately.

That's a lot of stuff in the security world. Hypotheticals get spun into "hackers are doing this now!" when in the real world that almost never happens. I have to talk my clients off of ledges constantly and build security solutions for threats that aren't in the least bit real because of some nonsense reported in CIO Magazine.

This is a thing.

Maybe this isn’t the real world, but a few months ago in the Apple parking lots in Cupertino targeted breakins were happening on a daily basis.

Once they stepped up security patrols thieves moved on to downtown Palo Alto and Mountain View.

Break-ins yes. But hibernating laptops being discovered via bluetooth? Cameras?

Thieves break into cars when they know there will be valuables inside the car. Now, are they running Bluetooth scanners to determine that, or is the fact that they're parking in an Apple parking lot enough?

From the article:

>San Francisco saw a 24 percent increase in vehicle break-ins between 2016 and 2017

Is that increase due to Bluetooth tracking? Or just all break-ins? This is exactly what I'm talking about... just because break-ins are happening more often and also unrelatedly Bluetooth can be discovered wireless, does not mean the two things are in any way connected.

Possible, yes. Actually happening in the real world? Well, we have an anecdote that the author promises us "isn’t just some crazy theory Joe and I have" and an anecdote from a police representative surrounded by statistics on all break-ins regardless of if Bluetooth was involved.

I mean... the story is about a thief who broke a window and stole a backpack that was in plain sight for anyone passing by the car. Absolutely nothing to do with Bluetooth at all.

It's simultaneously true that people believe or at least repeat any story that triggers their prejudices and that people discount anything that violates them, particularly when they haven't seen it firsthand.

So just because those impulses are opposed, doesn't mean that one is more right than the other in general.

Yes, but when should you decide to take action on that belief? At what point should people go out of their way to prevent an attack that may never happen? It's possible to steal passwords by listening to someone typing on a keyboard and reconstructing the key presses based on the sound. Should everyone stop using keyboard? Stop using passwords and stop using every service that requires a password?

In the security world we develop a risk matrix. This compares the likelihood of a threat compared to the consequences of that in order to determine how concerned you should be. Someone breaking into your car to steal things based on tracking the Bluetooth signal seems a lot less likely than someone breaking into your car because they can see your backpack laying on the back seat, but the consequences are exactly the same. So since thieves seeing your bag and deciding to break into your car is more likely, the natural course of action is to stop leaving your bags in a place that's visible to thieves. If someone then tears open your trunk to steal your bag, then you can worry about Bluetooth.

This article provides absolutely zero proof that Bluetooth was involved in this break-in, so why should anyone rush to the conclusion that Bluetooth was responsible for it? It's not an impulse or a prejudice, one is objectively more right than the other.

Blaming Bluetooth is begging the question when the backpack was visible through the window.

A person could assign enough risk to a proof-of-concept existing that the difference between a true and a false report of it in the wild seems rather small and unimportant.

https://en.wikipedia.org/wiki/Truthiness