Lost and Found: Stopping Bluetooth Finders from Leaking Private Information

They can measure temperature, acceleration, and magnetic fields, so you can use them to detect when a door or window opens, whether a machine is vibrating, or even an object's orientation relative to magnetic north. All this can be done for years on a single battery charge and at a cost of pennies per sensor per day. If these devices become 10% smaller each year, it's easy to imagine them eventually becoming something like Smartdust [1].

You could stick one on a treadmill or a weight machine to see how often it is used. Put one on your refrigerator door to find out how often you open the fridge. Put one on your office chair and track how many hours you spend sitting in your seat. Stick one inside a utility panel or a locked door and get an alert whenever it is opened or rattled. The possibilities are endless.

However, there are two truly difficult problems to solve in the design of a bluetooth smart tag: security, and battery life. Sadly, they often conflict.

For example, it turns out that Bluetooth radios consume battery power not just when transmitting, but also while receiving. If you treat the tag as a standard Bluetooth device and allow it to receive and transmit, you're solving the easy security problem.

But if you want to build a really good tracker with maximal battery life, then you have to solve the hard problem: the tracker has to spend most of its time operating as a broadcast-only beacon. That means that every passing receiver can't send challenges or requests: the tracker can only yell its encrypted data out into the void.

The system proposed in this paper is a great improvement on what companies like Tile and Nut are doing. But I predict that Bluetooth smart tags won't really take off until someone solves the "hard" problem.

[1] https://en.wikipedia.org/wiki/Smartdust