Hacker News Reader

Comment by crazygringo | Hacker News Reader

I thought one of the big use cases for this was to track stolen items, like a backpack or maybe even a bicycle.

But the "anti-stalking" feature will notify someone if an AirTag they don't own appears to be traveling with them.

Does this render it useless for anti-theft, then? Since it will just notify a thief that the bike they just stole is being tracked, and they can look for the AirTag and throw it in the nearest trash can?

Not criticizing Apple here -- anti-stalking is super-important -- but just looking for clarification if this will help you find lost items, but not stolen ones.

View on HN

I too, found the anti-stalking features might hinder the use of AirTags for locating intentionally stolen items: (1) it has a removable battery, and also (2) "someone can tap [the tag] with their iPhone or NFC-capable device and instructions will guide them to disable the unknown AirTag".

The anti-stalking feature also seems to contradict its privacy features:

> Bluetooth signal identifiers transmitted by AirTag rotate frequently to prevent unwanted location tracking.

But also, in the next sentence:

> iOS devices can also detect an AirTag that isn’t with its owner, and notify the user if an unknown AirTag is seen to be traveling with them from place to place over time.

If an AirTag is supposed to be "anonymous", then how can a user be informed that this tag has been seen with them over an extended period? This would mean that there is a way to identify a particular AirTag in the first place.

tags rotate identifiers, but only every hour or so.

AirTags are anonymous to other end users.

Obviously Apple is internally maintaining an association between the AirTag's permanent identifier, and its current temporary signal identifier.

This isn't E2EE or anything.

Huh? It certainly is E2EE.

"Whether attached to a handbag, keys, backpack, or other items, AirTag taps into the vast, global Find My network1 and can help locate a lost item, all while keeping location data private and anonymous with end-to-end encryption."

Is the E2EE applying to the Bluetooth ID's?

I think it's referring to other aspects of the system -- this sentence is specifically referring to location data, not Bluetooth ID's.

In any case, my point remains that obviously Apple has to be internally associating the Bluetooth ID's with owner ID's.

They aren't. The tag generates and broadcasts a public key that is rotated every 15 minutes. A nearby "finder" device receives a broadcast, encrypts its location with the received key and sends it with a hash of the public key to Apple's anonymous location directory. The owner (who keeps the same key pair rotation algorithm running from the same seed key) can look up a bunch of key hashes for a range of 15-minute intervals and then fetch and decrypt location payloads. No device or account IDs are transmitted in the process.

Ah ha, got it, thanks -- I was definitely incorrect then. Wish I could edit my original comment to say "never mind" but the edit window passed.

Even with E2EE it makes sense that it is still possible to differentiate "registered, known" tags from "unknown" tags. Unknown tags won't reveal any information about who owns them, but they will still transmit on the same frequencies and with the same protocol as your air tags.

"Your AirTag sends out a secure Bluetooth signal that can be detected by nearby devices in the Find My network. These devices send the location of your AirTag to iCloud — then you can go to the Find My app and see it on a map. The whole process is anonymous and encrypted to protect your privacy. And itʼs efficient, so thereʼs no need to worry about battery life or data usage."

"Only you can see where your AirTag is. Your location data and history are never stored on the AirTag itself. Devices that relay the location of your AirTag also stay anonymous, and that location data is encrypted every step of the way. So not even Apple knows the location of your AirTag or the identity of the device that helps find it."

So no, Apple actively doesn't want to know anything. I'd wager a guess that the airtag query system is using the same kind of method as the COVID tracker API.

This would also reduce the amount of received legal process from LE agencies, since data is not accessible by Apple.

Its private from 3rd parties, but not private from apple and whoever subpoenas them.

Apply this principle to everything apple does and says about privacy and you see it everywhere in their products.

Even more cynically, you can say it's private from their competitors.

They say in the AirTag video that "Everyone can participate without sharing their location with anyone, even Apple"

https://youtu.be/JdBYVNuky1M?t=570

So there's a way to track everyone's expensive kit and it doesn't require revealing one's identity. Ace.

That is not true. All locations are encrypted with a public key before being uploaded to Apple's servers, and only the user's devices (which contain the private key) can decrypt the location.

Yep, Apple hasn't exactly hidden that's how they do privacy. They give you an identifier that makes sense to their systems, but won't make sense to other observers. They still track you, they just don't tie it to PII (I'm assuming there are ways to associate your "anonymous" ID to you though, since it's probably wrapped up with iCloud stuff somewhere - it would just take an arcane query of some sort).

I think it's a pretty reasonable response given malls and other places were scooping up bluetooth and wifi Mac addresses and using them to identify patrons. Sure, only Apple knows so it might possibly have some benefit to Apple and even less possibly a detriment to competitors, but it definitely increases privacy and I find that very compelling. Your iPhone/Android already knows where you are with location services enabled. I'd rather Apple keep everything as private as possible and it's not like their getting a huge data gain.

"AirTag is designed from the ground up to keep location data private and secure. No location data or location history is physically stored inside AirTag. Communication with the Find My network is end-to-end encrypted so that only the owner of a device has access to its location data, and no one, including Apple, knows the identity or location of any device that helped find it."

> Even more cynically, you can say it's private from their competitors.

I've heard this from a few people recently, but I don't understand the implied criticism. What should Apple do here? Keep my data mostly private but also slip a copy of it to Google and Microsoft?

Obviously not. Through the high purchase price of their products, I'm paying (and trusting) Apple to manage my privacy and keep it private from everyone else. The fact that "everyone" necessarily includes all of Apple's competitors isn't just irrelevant, it's a red herring.

The implied criticism is they should also keep it private it from themselves

Wherever possible, they've done exactly that—so how is that a criticism? Case in point is the end-to-end encryption of iMessage. Or the at-rest encryption of iOS devices.

In other instances where Apple does have access to your data, there is a plausible justification for that access and no evidence shown where Apple has ever abused that access for commercial gain.

iCloud backup is on by default, which includes the contents of your iMessage conversations, even if you do turn off this default, your conversations with most other normal people are uploaded in a form where apple has the keys. Apple had plans to make all of iCloud backups E2E encrypted but backed out after pressure from the FBI. https://www.forbes.com/sites/kateoflahertyuk/2020/01/21/appl...

That is one example of many where apple could do it, but doesn't. To do many things on your apple device requires an apple id, which requires a phone number which is linked to identity. Location services uploads your location to apple constantly via close by wifi APs + GPS location, there is no option to do GPS only location w/ no network activity. All of this info is one secret supoena away to be uploaded to violent people with guns. YOU may trust your nice government, but many do not have the luxury of living in such a nice place.

Over and over again, you see the pattern of apple doing of 'private from everyone, except us'. And not mentioning the 'but us' part.

A local device like an iPhone has to know what AirTags are yours, since they have to guide to back to the beacon. If your iPhone notices beacons that appear at multiple locations, that aren't yours, it can detect that.

It isn't yet clear how that detection occurs.

Apple knows who you are. Apple knows which airtag you're near. You don't know which airtag you're near. It seems pretty clear that apple can use this information to tell if an airtag was placed in your car unbeknownst to you. Not sure what the mystery is.

Here’s a detailed protocol reverse engineering paper: https://arxiv.org/pdf/2103.02282.pdf

My guess would be that you, as the tag owner, locally store the master beacon key and can use it to derive key required to decrypt received beacon payloads for your own tags. You can then filter out your own and approximate how many others (which you cannot link over time) you permanently see. If it is more than one most of the time, you’re probably tagged without your consent.

This seems like a problematic situation. In a vacuum I can see how they want to mitigate the stalking risks, but as of right now, unless you have a recently updated Apple device then, then you're completely ignored by the stalking mitigations. There's nothing official from Apple on the Google Play store that would mitigate that situation as well. This just seems like a low barrier to entry stalking tool on the extreme side of use cases for people Apple doesn't have business interests with.

I presume the location info is only collected if its marked as "lost" - at which point if the tag connects to apples network via someones phone, it'll prompt them. If its marked "lost" and sending location with no iphone nearby and is moved it beeps.

The stalking potential is greatly reduced if the victim has an android as the location will only be sent when its detected by an iphone.

The location information is updated whenever it is seen by an iDevice. The iDevice participates in this without its user's explicit permission or knowledge.

If the stalkee has an android they will never know. Their position will be snitched by every iDevice they come near.

From the Heinrich et al.paper:

"Lost devices. Devices that determine to be in a lost state start sending out BLE advertisements with a public key to be discovered by finder devices. Devices are considered to be lost when they lose Internet connectivity.

Third-party accessories [6] are small battery-powered devices that can be attached to a personal item and are set up through an owner device.

Accessories are determined to be lost when they lose their BLE connection to the owner device. Finder devices.

Finder devices form the core of the OF network. As of 2020, only iPhones and iPads with a GPS module are offering finder capabilities. Finder devices can discover lost devices and accessories by scanning for BLE advertisements. Upon receiving an OF advertisement, a finder creates an end-to-end encrypted location report that includes its current location and sends it to Apple’s servers."

Elsewhere, it is clear that this operates even when flight mode is enabled.

If you can't stand criticism of Apple, please fuck off back to reddit and fanboi there.

I thought I read that the tag itself will start beeping if it's not near its owner for too long, and the tag has been moving around? Not sure what "too long" means, but if it's short enough, that should foil stalking attempts if the potential stalkee doesn't have an iDevice.

Edit: looks like it doesn't start beeping for three days (though Apple can change this server-side if they decide three days was a bad choice), which seems like way too long. A stalker could probably make good use of this in just a few hours, let alone three days.

But you don't permanently see them, because the ID rolls over quite often to prevent tracking the beacon.

Conceivably the beacons co-operate in preventing tracking by conversing with iPhones nearby to store a random code supplied by the phone for a period of time, and allowing any iDevice to ask for the list. If your iDevice sees the same random code it transmitted to a stranger beacon appear in multiple time periods it knows it is colocated.

I would guess that the colocation feature would allow you to track devices actively (tailing someone).

Spies will have to be alert the potential for both exposure and tracking. Hopefully Apple commissions Spy Vs Spy ad campaigns!

My guess was simpler. If the phone sees a random tag for 30 minutes, then coincidentally that tag disappears but a new one shows up--for 30 minutes--and this keeps happening, then it's probably the same tag that's following you around. Especially if it's always about X meters away, or whatever.

Random tags passing by wouldn't maintain the same distance or RSSI, and they wouldn't be spaced perfectly apart in time either.

Of course I'm making assumptions here about the key rotation frequency, or even if it's a regular intervals. I guess if you're spending a lot of time in crowds, the rotating beacon that's with you would be hard to pick out of the myriad other beacons coming within range all the time. ("Was that a key rotation, or another person?")

I can see how that might work, but signal reception is always noisy. I doubt RSSI would be a reliable measure. You could partially wrap the AirTag in a scrunch of alfoil and it would mean every movement of the phone would massively change the reception, it would look like a variable distance.

Also, I wonder if it is a fixed time with no overlap? Because you could certainly track someone, eg through a shopping centre, by seeing when a beacon turns off and then listening to new beacons. Correlation would be trivial. And if the e.g. 30m clock is accurate then you could reidentify hours later by just listening to the rollover time, so they would have to vary the rollover at least.

I wonder about false alarms, because you can easily sit on commuter train for an hour and have someone next to you, even more so for long distance travel.

When the ID changes on the tag, a nearby device can link the two id's together since they're in the same 'position' (i.e. id x was at y position and now id z is there, so id x = id y). However, someone who is not there wouldn't be able to link those ID's together. This gets you the privacy feature and the anti-stalking feature. (The anti-stalking feature likely wouldn't need a perfect series of matches; if you have a good chain of them, you'd have good confidence.)

Vanmoof seems to have adopted the Find My spec and integrated it into their bike hardware itself. AirTag is for lost items. Hardware manufacturers can build Find My support into their product to defend against stolen items. I’d guess that’s the strategy.

I still think Tile lost out on a gigantic market by not making it easier for hardware manufacturers to integrate into their ecosystem.

They should have been practically begging oems to embed it.

Yes, and they refuse (apparently) to join Apple's Find My, and instead want users to install their Tile app (and their tags are then only findable by users that have the Tile app installed). They want to own the entire relationship, but I think here they'll lose out.

They might still capture the (worldwide way larger) Android market.

They've had 5(?) years to do that already but they gained initial success and then sat on their laurels while off-brand competitors tried and failed to break into the market.

I tried a couple of cheap Tile competitors but they all wanted you to use their apps and thus weren't very valuable. I almost bought some Tile products around the last Apple event in Fall 2020 but waited because I thought AirTags were going to be released then.

I'm still tracker-less so I'll be picking up a 4 pack of these and I am excited to use them. Here in the US at least, Apple has great marketshare to support a service like this and a proven track record with Find My already. I'm planning a cross country road trip that starts in about 2 months, and I'll feel a lot better about not accidentally leaving my wallet behind at campsite or hotel while I'm in a rush to get back on the road. Then, even if I did, all it takes to hopefully get my stuff back is for someone with an iPhone to walk by it to update it's location.

Unless Apple royally screws up this rollout, I don't see how Tile can continue to dominate marketshare for this sector.

It’s going to be real funny if non Apple users are basically fair game for AirTags tracking and you have to get an iPhone to protect yourself from AirStalking

Apparently they can be disabled with any NFC enabled device: https://apple.com/newsroom/2021/04/apple-introduces-airtag/

>[...] And even if users don’t have an iOS device, an AirTag separated from its owner for an extended period of time will play a sound when moved to draw attention to it. If a user detects an unknown AirTag, they can tap it with their iPhone or NFC-capable device and instructions will guide them to disable the unknown AirTag.

It is better supported on iPhones, but that's acceptable:

>iOS devices can also detect an AirTag that isn’t with its owner, and notify the user if an unknown AirTag is seen to be traveling with them from place to place over time.

I'd like this detection to come in stock Android, similar to how the Contact Tracing thing was shared b/w Apple/Google.

> I'd like this detection to come in stock Android, similar to how the Contact Tracing thing was shared b/w Apple/Google.

This would be an ideal scenario, even if it took longer to roll out for Android phones thanks to the OS fragmentation

Even if that's not happening, I think its not entirely unreasonable for some reliable third party app to pop up an make disabling the AirTags with an Android device almost as easy as an iPhone.

... and if all else fails, you can always whack it with a hammer a few times. Or just take its battery out.

I’m assuming that instructions to disable the AirTag are basically instructions for how to take off the battery.

You can already purchase a huge range of items that do exactly what an airtag does. Everyone is already fair game for this type of stalking, it is silly to try and paint apple in a bad light here.

How many of these third party devices can use every iPhone, iPad and more in the world as a beacon?

Tile uses everyone with the tile app installed. It's not the same by sheer numbers, but it's more than enough that if someone slips a tile tracker on you they will know where you're at. Or, if someone wants to spend a bit more money, not even much more, they can buy a full GPS tracker that doesn't need anything to report on it. Apple isn't coming out with some groundbreaking spy tech here, this is very routine stuff thats been in a small format forever. And guess what, none of the existing ones do anything to alert anyone of stalking, unlike Apple. I don't even like Apple but this is silly.

not to mention tile does it without notifying iphones of airtags or the beep when moved.

    Tile uses everyone with the tile app installed. 
    It's not the same by sheer numbers

It's not Apple's "fault" they're more popular but the end result is that these AirTags are orders of magnitude more potentially dangerous thanks the fact that there are orders of magnitude more iDevice users than Tile app users.

Imagine I'm some kind of creep looking for victims in a club or whatever. I'm planning to accomplish this by dropping Tiles into their bags.

Statistically, how many Tiles would I need to buy and sneak onto persons in order to have a reasonable chance of snaring a victim who just happens to have the Tile app installed? 50? 100? 1000? Not impossible, but not particularly feasible.

How many AirTags would I need to sneak onto victims? Perhaps only one, if they happen to use their phone in public and I see it's from Apple -- that's something I can tell at a glance, unlike wondering if they have the Tile app installed.

They don't need to? GSM radios have gotten tiny. Think literally any innocuous item and it can be fitted with a tracker.

Even a hairbrush: http://www.mccalltech.net/images/0TrackBrush.jpg

The limitation of any tracker is battery lifetime. The AirTag circumvents this by only using low power transmission and the network of all iPhones and iPads in the world, which then relay via their own wifi/4G.

What is certain is that we'll see sophisticated modifications to AirTags that (1) disable the beep, (2) disable anti-stalking.

Theoretically remote attestation and self-disabling anti-tamper could be used, but the potential wins for bypassing the Apple protocol are enormous, the Holy Grail of surveillance espionage.

"Holy Grail of surveillance espionage"... maybe the holy grail alarmist statements.

Why are firmware modifications for this "certain" first off?

And what modifications allow this to work as designed without setting off anti-stalking? If you somehow change the ID it's reporting which afaik is a signed value anyways, how are you going to get access to it's location?

If you don't disable anti-stalking then this is no better than run of the mill GPS trackers which can already run for days to weeks

Nation state attacks are certain because of the massive payoff if they are successful. Were you asleep when the Snowdon NSA leaks happened? [1]

If you can change the ID you can cycle through a list of valid IDs. You can even use it for bit rate comms, ~16 bits an hour or something, which is enough to signal events like "number of iDevices in vicinity", or, if other hardware is used, step count/hour, which works even in GPS denied environments.

The beacon location reported by Find My is generated by the reporting phones' GPS/cellular/wifi location system.

Regular GPS trackers have no means to exfil their data. They don't work in GPS denied environments (poor inside buildings, underground, anywhere a $20 jammer is enabled). OCGs routinely use low power GPS jammers now. Using GPS or 3G requires much more energy, and 3G is easily detected by motivated groups.

So while it might not be great for stalking your partner/ex, it is very tempting for professionals.

[1] https://nsa.gov1.info/dni/nsa-ant-catalog/

"Were you asleep when the Edward Snowden leak happened"

... yeah I'm not going to play this game.

Nation states are certainly doing better than AirTags if that's what you're worried about Secret Agent.

Passive trackers will let you pinpoint someone indefinitely.

And someone motivated is going to catch your spurious 3G emissions but miss an AirTag literally designed to be noticable?

Puhlease. If a nation state is chasing you and this is what turns the tides I strongly suggest turning yourself into their embassy now, save yourself the trouble.

You claimed that no one would go to the effort. It is clear that they will.

Nation states don't have a global network of iPhones.

> Passive trackers will let you pinpoint someone indefinitely.

How?

> Puhlease. If a nation state is chasing you and this is what turns the tides I strongly suggest turning yourself into their embassy now, save yourself the trouble.

"Puhlease" enjoy pretending that nation states are all IDF 8200 elite cyber hackers. The future ubiquity and deniability of these devices will see them feature widely. And some people do need to defend against skilled attackers who can buy custom gear from Shenzhen, and telling them to give up is stupid.

>How?

If an actual nation state is out to get you what's so difficult about tracking you from half a mile away? Surely they're not chasing someone who's actively evading them since you think this person won't find an... AirTag. Something that's actively transmitting at regular intervals and has NFC capabilities.

https://marshallradio.com/ww/product/field-marshall-digital-...

> Adding a Field Marshall UHF to your GPS system allows you to precisely locate the transmitter inside GPS denied environments (inside a building, or locate the signals when GPS satellites are blocked), or when the transmitter is in thick cover.

Or attaching a GPS tracker that logs to it's internal storage that they then recover?

> enjoy pretending that nation states are all IDF 8200 elite cyber hackers

You can't even stay internally consistent to your own fantasy. First you're saying these people will crack Apple's state-of-the-art firmware systems on a brand new platform and signing arrangements to boot, now suddenly they're script kiddies?

And honestly it's disgusting how shameless you are about shoving words in my mouth "telling them to give up" where the fuck did I say that?

Go find something useful to do kid.

I personally don't think anyone is fair game for stalking and this device lowering the barrier to entry should be discussed, and discussing it shouldn't get the kneejerk reaction that they're being painted in a bad light. There are plenty of questions here like:

- How does the anti stalking alert in apartment buildings or people frequently in close proximity for long periods of time?

- Since they considered that this is a risk in the first place then are non Apple users are risk here too? Did they provide appropriate mitigations for them as well?

- What's the future for the Find My network? It would be interesting to standardize and allow for more interoperability in the Find My network.

How is this lowering the barrier? I bought a orbit for my keys that does exactly what this does, for cheaper, like 3 years ago. I would actually say nothing apple does about using this for stalking is useful in the least, because if someone wants to stalk you they can get one of a dozen devices, for cheaper, that would be better because they're not a obvious white and silver apple branded monogrammed thing. Noones at risk, because everyone already was, apple users included. As for the future of it, I think there's already a bike company building the find my system into their bikes, so probably anything high theft could make its way onto a network like this.

Orbit only works with bluetooth on your phone, not the entire Find My network. Additionally, I think it's a fallacy to say that it's fine for Apple to not consider the risks because some other products didn't consider the risks.

It would make sense to do the anti stalking notification after say 4 days. This would make stalking labor intensive since the stalker has to swap tags frequently. So if you leave one in someone's car or drop it in a bag, you'd have to steal it back and replace it. Also if the stalker is unable to track it down, the victim gets notified automatically which makes stalking with these much more dangerous for the stalker.

For a stolen item you'd have that much time to track it down.

They could even track if different non-owned tags track the same person to stop stalkers diligent enough to swap these frequently.

It's an impressively good balancing of usefulness and avoiding bad spillover effects.

    It would make sense to do the anti stalking 
    notification after say 4 days

"Your privacy and safety are important to Apple. We won't let anybody use these devices to stalk you for more than 96 hours."

You haven't thought this through! Seriously, the use cases for 96 hours of tracking are frightening.

1. Meet victim in club/bus/supermarket/wherever

2. Drop AirTag in their bag/pocket/whatever.

3. Now you know where they live and/or work assuming they go to one of those places in the next 96 hours.

Won't be long before magazines start offering tips on how to best avoid getting AirTagged.

Seeing as you can literally give someone a USB cable that tracks them, I don't think AirTags are enabling anything particularly new: https://www.walmart.com/ip/OURLEEME-Car-GPS-Tracker-Vehicle-...

Maybe so, but consider the optics...

That USB cable doesn't work unless it's plugged into something that has power.

Yes? Offer someone a USB cable and you've given them a GPS tracker that will show their home location

But of course as I linked in another comment, trackers have been fit into anything and everything now. Hairbrushes, random trinkets like clocks, even a phone charging brick itself

that sounds like one of those issues everyone worries about but never happens.

Seriously, the use cases for 96 hours of tracking are frightening.

Meet victim in club/bus/supermarket/wherever

I'm not an expert, but I don't think this is how stalking works in practice. People don't stalk random strangers they meet in the supermarket. They stalk former partners, and (more rarely) people they've developed an obsession about. That means the stalker has to worry about being recognized by the victim, and consequently will have fewer opportunities to plant a device and retrieve a device than you imagine.

Furthermore, while being tracked for up to 96 hours indeed is a frightening thought, the typical stalker's goal is to track their victim at all times. Having to plant and retrieve a device at least every four days, without being detected by the victim, makes for a very impractical way to achieve that goal.

    I'm not an expert, but I don't think this is how
    stalking works in practice. People don't stalk random 
    strangers they meet in the supermarket. They stalk
    former partners, and (more rarely) people they've
    developed an obsession about.

Well, yeah -- I agree 100% that this is existing predator behavior, and most crimes will continue to be committed by a person known to the victim.

However, if not properly safeguarded, this sort of tech clearly can enable some new types of bad behavior.

Ultimately I'm a technology optimist and we shouldn't reject new tech simply because it might be misused. However it's also true that even the most cursory glance at history shows us that just about any new technology is also used for nefarious purposes.

This I agree with. My contention was with what you first wrote, which made it seem like the 4 day limit was not meaningful. I think it makes all the difference for the reasons I laid out.

Confirmed by John Gruber

> I talked to folks from Apple today about some of this. The timeout period for when an AirTag will play a sound if separated from its owner is currently three days — but that’s not baked into the AirTags themselves. It’s a server-side setting in the Find My network, so Apple can adjust it if real-world use suggests that three days is too long or too short.

> The “NFC-capable device” thing means Android phones.

https://daringfireball.net/linked/2021/04/20/moren-fine-prin...

I thought it was intended for lost items rather than stolen items. I've had my phone stolen multiple times and thieves know exactly what to do to prevent 'find my' activating. I'm sure it wouldn't take them long to find/disable AirTags either.

>I've had my phone stolen multiple times and thieves know exactly what to do to prevent 'find my' activating. I'm sure it wouldn't take them long to find/disable AirTags either.

...putting it in a faraday bag? Since tags are cheap, they can even smash it.

This isn't really complicated, just remove the battery.

Can't remove batteries from iPhones, or most phones these days.

Yes but you know a phone can be tracked.

If it's someone's backpack or leather jacket, it won't be obvious in any way if there's an AirTag slid deep into some pocket.

Sure a professional thief might check, but plenty of things are stolen casually by people who simply see something lying around.

It’s for both.

On the upside as long as you have Find My iPhone activated when you did have the phone it doesn't have a huge amount of value to the thief, particularly on newer models where individual components can't even be swapped without issues.

This is a good question. I wonder what the period of time is required before it notifies you about potential stalking. If it is more time than would typically take for someone to realize that the item is stolen, then perhaps it’s not such a big deal. But if it’s only 30 minutes or so, a thief could be notified that they’ve stolen a bicycle that’s being tracked before you come out of the grocery store, movie theater, etc.

A related question: can you geofence an airtag so that you are notified if an item leaves an area without you? This could be especially helpful for things like bikes that you would park for long periods of time and would want to know if they’re being moved by someone other than you.

30 minutes seems totally infeasible. People hang out for 30 minutes all the time.

The anti-stalking warning is only triggered if the airtag isn’t near the owner.

I wonder how this works in practice? My main use for an AirTag would be to put on my cat’s collar. But if it starts beeping randomly that’s going to be a problem.

Apple's response would be that AirTag isn't designed for that use case, and that you should purchase a "Find My network enabled" collar for your cat from a third party (it's only a matter of time...)

I actually kinda doubt this situation would happen because it would be a little silly if you could bypass the anti-stalking protection just by buying a 3rd party device.

desolder the speaker or piezo.

Please, if possible, do not put collars on cats :(

If they're outside they can get gravely injured as they pass through the smallest holes and cracks. There are very NSFL images of resulting injuries. The collars often lead to suffocation or very bloody scenes - no matter how well they seem to fit.

https://www.pdsa.org.uk/taking-care-of-your-pet/looking-afte...

Breakaway collars are standard at the pet shops near me. Having a bell on a collar seriously hinders a cat’s ability to hunt birds and other wildlife, which is a huge problem in some places.

And a solution in places like New Zealand, where cats are harming the native bird populations.

please, just keep your cat at home

It would only start beeping if the cat stays away from your iPhone's BLE range for 3 days. I've also thought of doing this, but my cats absolutely hate collars.

So if a friend lends me some keys with one of these attached and I don't have the right kind of phone on me, the keys will start beeping incessantly? That seems pretty darn annoying.

i think only if they are marked lost?

No, it's an anti-stalking feature, so it's triggered when it's been away from the owner for some unspecified period of time, and only when the tag is moved. If someone is using AirTags to stalk someone, they would never mark as lost, which is why beeping isn't tied to this status.

Just tape over the air holes it needs to transmit the sound waves.

So maybe ask your friend to take off the AirTag if you have to borrow their keys for more than a few days?

Apparently any phone with NFC capability can disable any Apple Airtag.

The future is having most items with built in tags. So yeah, your iphone tells you the bike you stole is tracking you but its not realistic to remove the tracker from it so you have to dump the bike.

The future is here [1]:

> Available from today (April 7, 2021), the latest VanMoof S3 & X3 bikes will work with Apple’s Find My app, which means you can track your ride securely using the vast and global Find My network, made up of hundreds of millions of Apple devices. With the new Items tab in the Find My app, you can locate your bike on a map from your iPhone, iPad, or Mac.

1: https://www.vanmoof.com/blog/en/find-my-bike

Sounds like a strong degauss tool would render that useless.

Several factors play into it - how much is it used for 'lost' vs 'stolen(?)' as well as 'if stolen, by someone savvy enough to be checking for tags?' and 'if stolen how long before anti-stalking alerts? Does it alert during daily commutes on the same train? Only after 2+ hours? 3+?'

Does anti-stalking only work for Apple users? I assume it won't notify someone who doesn't have an Apple phone, making it kinda useless for half the population.

The article isn't entirely clear, but suggests that it will use the network of iOS devices around it and that the AirTag will start beeping as well.

Seems like it should be able to detect that it's always traveling together with a single Android phone's WiFi signal, for example.

I wonder how hard would it be to disable beeping. There is probably a speaker that can be drilled through.

That kinda kills the whole purpose of the tag, which is to beep when you lose it. I guess you can still kinda find it with the UWB chip on your iPhone, but that's much harder than by sound.

Not if you want to use the tag to stalk someone.

Then just just a Tile or some other tracker.

The plastik part seems to be the resonator replacing it with a soft material that absorbs sound would be the easiest step.

However it might be better to disconect the speaker which should save lots of energy the peeper would consume otherwise.

I don't think apple checks for the speeker to be connected if the speaker breaks for example it would make the tag unusable resulting in more warrenty complains.

>And even if users don’t have an iOS device, an AirTag separated from its owner for an extended period of time will play a sound when moved to draw attention to it.

So, this prevents some legitimate use cases, for example putting a tag in a suitcase for the flight, because it'll start beeping at some point?

A shame. It would've been cool standing at that conveyor belt at the airport and rather than staring at the luggage as it comes, being able to sense one's own stuff.

Also, seems that it's not suitable for putting on a cat or dog's collar for the same reason.

Presumably "extended period of time" is several days, not several hours.

That would defeat the purpose of this anti-tracking [counter]measure. One would be able to sneak a tag into someone's bag (or clothes, or car) and track their movement for the whole day. Then get back into tag's proximity to reset the timer.

If your threat model is 1 day, it's pretty hard to use that for any sort of "find lost things" product. If I forgot my keychain at work, is it going to beep the entire night? What if I'm out sick the next day? Is it going to annoy all my coworkers for the entire day?

> If I forgot my keychain at work, is it going to beep the entire night?

No, I don't think so.

As I understand it, the idea is that AirTags would only beep if they detect being moved (probably, accelerometer/motion based, as everything else is probably energy cost-prohibitive). So, no, a forgotten keychain left on a table shouldn't beep on its own, unless someone takes it and carries with themselves for some time. It shouldn't even beep if your coworker notices your keys and moves them to another room for safekeeping.

The idea is that it should eventually alert if you put a tag in someone's back pocket and you or they walk away.

Probably needs to be more like minutes.

Think about a stalker dropping a tracker into the pocket/bag/etc of their victim.

They slip a tracker in their co-worker's bag at the end of the day. Coworker goes home. Attacker knows where they live now.

Or, maybe it's a stranger on the bus. Or in a club.

The victim is likely going to be home in less than a few hours. Perhaps less than an hour.

Also rental gear.

I could see businesses being a lot more willing to loan equipment for a trial period if they could put a tag on it.

It doesn't say, but I have to assume that it detects it's moving, but moving together with an unrecognized cell phone or something -- e.g. picking up a single unchanging WiFi signal while most other signals come and go.

Of course, if the person being stalked wasn't carrying a cell phone, then this raises the possibility the anti-stalking wouldn't be activated.

IDK if they've addressed this feature sufficiently well, but I assume phones could ignore airtags when set to airplane mode.

> standing at that conveyor belt at the airport

you're not supposed to put batteries in your luggage

What harm could such a small battery do?

Just desolder the speaker.

What about to cut wire to speaker?

>Does this render it useless for anti-theft, then?

It's hard to make tracking devices hidden. They need to phone home, so that means they emit a signal. Someone can sniff that out using a RF detector. that's why tracking devices tend to be integrated into the product itself (eg. into the ECU for cars, or part of the CPU/motherboard for computers).

It's much easier to have a phone that will easily tell you if there is AirTag around you than having an RF detector.

A RF detector costs $15-$25 shipped from china. If RF anti-theft devices become common (either the GSM or the bluetooth variety), I'm sure it'll be part of a thief's toolkit.

The majority of bike thieves in Portland are not going to buy a $15-$20 RF detector because that would have to come out of their meth budget. They are not a tech-savvy lot.

I suspect some posters are imagining bike thieves as part of some kind of international black market for high end bikes...maybe that exists but 99% of bike thefts are done by the local crackhead who either wants a ride or wants to trade it for $20 for some crack or meth.

A bike thief isn’t going to go rf sniffing

not yet. If a significant portion of otherwise theft-friendly bikes have trackers, I don't see why they wouldn't learn to, someone would probably even commoditize the sniffing tech to sell to other thiefs.

> not yet. If a significant portion of otherwise theft-friendly bikes have trackers, I don't see why they wouldn't learn to, someone would probably even commoditize the sniffing tech to sell to other thiefs.

They wouldn't because we already have TONS of historical data that thieves don't do that.

I am a motorcycle lover and like every owner of a nice bike I know that apart from properly chaining your bike down the single most effective way of retrieving your bike back is by having a tracker on it. In fact some insurance companies give a big discount if you have a professionally mounted tracker on your bike.

History has shown that despite motorcycles being worth 10-20k thieves still don't go through the effort of locating and removing a GPS tracker. What they do is the following... they steal your bike and only move it like 10 streets further away from its original location into some hidden dark dead end alley where no person would normally go and where the owner wouldn't find it by accident. Then they leave it there standing for like 2 weeks and if nobody comes to pick it up within those 2 weeks then they know there is no GPS tracker at which point they can safely take it back to their garage where it gets dismantled into and rebuild. Otherwise they risk of having their garage being exposed.

Now you might ask why only take it 10 streets further away? Because the easiest way is to cut a chain or some poor security and then wheel it down the road for 5 minutes. Only two weeks later they come with a proper vehicle to transport it away.

So if professional thieves can't be bothered (or is just practically too difficult) to locate a tracker then I'm sure normal opportunistic thieves won't be able either.

I guess bicycles thieves are either savvier or have an easier job.

Their modus operandi is to throw a bicycle into a truck or van, move them in lots of fifty across state lines, and tear them down to components.

Any trackers will be quickly rendered useless once they're in the van, and immediately found and discarded.

I'm definitely planning on getting Airtags for my bikes, but mostly for amusement and occasionally forgetting where I parked, I don't have much faith in them as an anti-theft device.

> Any trackers will be quickly rendered useless once they're in the van

You can build a custom LoRa based tracker with 100+km range (line of sight), a van won't disable that. You'll have to use signal triangulation, though, because GPS reception in a van won't be great.

Any recommended further reading on the LoRa solution?

The easiest way to implement that would be using a Crossfire Diversity Nano receiver [1] with a backup battery. It supports GPS out of the box, directly connectable to the receiver.

For a custom solution, ExpressLRS [2] is an open source system that can be flashed to FrSky R9mm receivers that you can hack on to add features you want. Or buy Semtech [3] and ESP32 modules and build your own hardware to maximize transmit power (standard hobby receivers only have 25-40mW telemetry)

PS. TTGO LORA32 modules [4] already have ESP32 and Semtech module assembled, only need flashing (again, lower power than a dedicated 30dbm module)

[1] https://www.team-blacksheep.com/products/prod:xf_nano_div_rx

[2] https://github.com/ExpressLRS/ExpressLRS

[3] https://www.aliexpress.com/item/1005002116232826.html

[4] https://www.aliexpress.com/item/4000010599226.html

Thankyou! I've been having fun with ToWL[1] but this might be the next step.

[1] http://www.phreakmonkey.com/2016/08/towl-telemetry-over-oppo...

You need elevation to get line of sight at 100km+. On flat ground, the curvature of the earth will block your signal.

Hint: tight up under the Brooks saddle with hot glue.

yeah, I'm gonna do that short term, and looking into a 3D-printed mount that clamps onto the rails for the long term

still kind of silly since a saddle is an easily stolen part

Heck, my B17 is worth more than one of my bikes.

>I guess bicycles thieves are either savvier or have an easier job.

They do have an easier job, I think, given that bicycles don't usually weigh between 400lb (sports motorcycles) and 900lb (cruisers).

What they do makes sense from a risk point of view. Trackers are various shapes, sizes and can be mounted different ways, if they miss one they blow their operation. Easier to delay payoff by 2 weeks.

The difference between the GPS and these tags is they actively respond to bluetooth. If you can sniff the bluetooth traffic then you would be able to detect them easily?

In the reverse case, I recall seeing some articles that thieves will use bluetooth sniffers to identify valuables (e.g. cellphones without the BT turned off) in cars, to steal.

Seems feasible that having a sniffer for fancy apple trackers could locate some potentially valuable things to steal.

> Does this render it useless for anti-theft, then?

The other question is: when presented with evidence of stolen property, will the local PD enforce the law and assist with the retrieval of said property?

That's already been answered. Stories abound about "Find My Doohickie said it was at this address. I even knocked on the door, and the person that answered said, 'yup, have your phone, whatta ya gonna do about it?'. Cops said file it with insurance." Cops don't care about a $1000 phone, they're not going to care about your bicycle, either (which has also been proven on multiple occasions).

The do care about stolen vehicles tho. Motorcycle theft is a big problem.

AirTags would probably be the cheapest option for relatively reliable motorcycle tracking. However, there are already devices that can be connected to the bikes battery, hence basically run for ages, that also connect to GPS and GSM.

Tracking with AirTags assumes the thief (or someone closeby) uses an iPhone AND has the 'Fine my' feature activated, which is, given how motorcycle thieves operate in some areas of the world, is relatively unlikely. So you're probably still better off using a GPS+GSM tracker

That depends on the state you are in. That is how it will play out in CA, not at all how it will play out in TX.

States can be pretty large and diverse - the town I live in in California would have a couple of officers at my door in short order if this situation were called in...

Cops cared about my stolen bicycle. They took my report, were very happy I brought a copy of the original invoice and a few weeks later I had mail informing me they had retrieved my bicycle and that I could pick it up. This was in Germany, mind you.

Haha, Europe vs. America changes everything.

I wish it worked like this in the UK. If memory serves in London a motorbike has a 1 in 12 chance of being stolen in any given year, and I suspect it's a lot higher for bicycles.

To be fair when my bicycle was stolen the police did care, but they were quite frank with me about the odds of recovery being virtually zero despite having CCTV of the incident and the getaway vehicle.

Maybe this changes when you turn on stolen mode for the tagged item.

So if you want to stalk someone you put your airtag into stolen mode first? Kinda defeats the purpose of the anti-stalking feature.

I don't think it ever claimed to be anti-theft. It is more focused on "finding something you misplaced" than being a security tracking device.

Not all thieves are smart.

In fact I would hazard to say most are not.

They don't all have to be smart.

A few smart thieves will share the tricks. Probably many smart peoples are even going to try building detector devices.

I could see a smaller version of this, without the speaker, having some real potential for preventing musical instrument theft (especially electric guitars), or at least speeding recovery. The AirTag could conceivably be placed in the electronics control cavity of the guitar.

"Jealous 15 year old uses Apple AirTag to stalk friends"

Vs.

"AirTag notifies bike thief about itself"

For Apple this is a no-brainer.

Seems like the anti-stalking thing could take at least a couple days? In that case, I'd still love to hide one of these things on my bike. If my bike gets stolen, I'll know about it very quickly.

It has to be this way. Imagine if I stick AirTag over someone’s backpack and then track that person all day. You cannot have it both ways.

That's super-important, and also will dramatically raise sales of iPhones among petty thieves.

Might be possible to destroy the beeper.

The anti-stalking feature seems to be... preventing someone from tracking your movements with an AirTag? I don’t get it.

> But the "anti-stalking" feature will notify someone if an AirTag they don't own appears to be traveling with them.

Another case of your device working against your interests.

I don't care if you have something to hide or not. This just sucks at a fundamental level.

If the "interest" that you're worried about AirTags "working against" is being able to stalk people by attaching trackers to them or their belongings -- sincerely, fuck you. It is entirely appropriate for Apple to build functionality into their products to mitigate this sort of abuse.

....It’s alerting thieves that the device they stole is being tracked.

That’s anti-user. The user is the one trying to do the tracking.

And not the user of the phone that is reporting the location of those tags to a stalker? Their interests are important too.

Anyways, I don't think there was ever any intent for AirTags to function as an anti-theft tracking device. Anti-theft is much harder to do well than anti-loss (which is what Apple is targeting), and is very difficult to distinguish from stalkerware for a mass-market product.

> stalkerware for a mass-market product

which is specifically a problem Apple has had with "Find My", so it's nice to see them taking it seriously here.

I'm not sure it's really Apple's fault. You could do the same thing with a Tile or other beacon. That's the entire purpose of the device.

Apple's trying to prevent misuse of their device. They want you to use it to find your keys, not your ex. If you consider that an invalid limitation of your device (by notifying your ex that they seem to be carrying an unknown tracker)... well, let's just say I disagree.

By attempting to prevent misuse they also prevent some legitimate and morally unquestionable uses. Like - the most obvious examples already mentioned in the comments - finding your cat or tracking your checked baggage. There are probably more less obvious use cases where something temporarily leaves owner's proximity, does not remain stationery, but tracking that object's location is perfectly legal and not questionable.

And this can be perceived as - arguably - restrictive and user-hostile by some.

I'll be blunt: Neither of those use cases are very important in comparison, and neither come remotely close to justifying AirTags as unlimited tracking devices with zero restrictions.

Just go buy some other tracker for your cat or whatever.

I don't argue, I'm trying to explain how others may see it.

Everyone has their own needs, requirements and ideas what's essential and what's not. Importance and justifications are subjective matters.

Only thing everyone can certainly agree on that those use cases were not deemed important (or even considered) by Apple, as they would've designed it differently otherwise.

I care a fuck-ton more about finding my dog if lost than my bag. A bag can be replaced with an identical one. A dog cannot.

Current GPS collars are absolutely trash (3 day battery life, bulky, etc), this would be about 10,000 times better if effective. But if it starts beeping randomly unprompted and scares the dog, it's a problem.

A GPS collar and this are two very very different things. An AirTag only works if an iPhone is nearby - if your dog is lost in the woods so to speak, an AirTag will not help you - a GPS collar will.

Sure but this is good enough to be useful in many situations, whereas a GPS collar is impractical enough that it's unlikely to be regularly used. I just wanna throw a chip on the 3 dogs collars and forget about it except to swap batteries once a year. I don't want to be bothered charging active GPS collars every few days and putting a heavy device for the dogs to carry.

I'm sure it's possible to get the best of both worlds, it's just that no one have made it yet. An active GPS tracker does not have to be larger than a keyfob to your car nor does it need to be online all the time. A combination where the GPS is only activated once the tag has not seen a known device for 1 hour. That should give you a battery life measured in years with meter precision when it matters.

Great idea.

I’ll be blunt: a stalker is going to find tools to do stalking without apples help. Far more people just lost out on a super easy pet tracker because of a glorified “think of the children argument”.

All of those usages are permitted and ordinary uses of the device. Nothing prevents you from doing that.

As far as I can tell from reading the article, all it does is say, "Hey, did you know you've been carrying around a tracker that's not yours?" Your cat or your luggage don't care if you attach a tracker to them. Your ex does.

Reply on news.ycombinator.com