Someone attached an AirTag to my car while I was in a bar | Hacker News Reader

Someone attached an AirTag to my car while I was in a bar

twitter.com

335 pointskaycebasques361 comments

This is news just because it's an Apple device being used for something that was already trivially possible.

GPS trackers designed to be magnet-attached to a car which report their location via cell signal cost ~$20 on Amazon. You then tend to need to pay for either a SIM card or a subscription to the device maker's service -- bringing you up to about the cost of an AirTag. These are much harder to detect, as you might imagine.

The Apple device does try to make itself less useful for abusive purposes. Nearby iPhones will notify you if there's an AirTag following you. Apple released an Android app to scan for them (manually -- it'd probably be nice if they released something that did the same passive scanning as iPhones get, but there's battery trade-offs there, and obviously most people won't have that app). AirTags will also beep if they're separated from their owner.

In fact, this is news we're hearing about because of the steps Apple took to make it harder to use these devices for bad purposes. The tweet author got a warning about the device following them.

It's tricky to make something that lets you find where you dropped your keys while walking the dog that can't also be used for nefarious purposes.

While you're correct, I think there is something to be said about the popularization of the technology. Most people aren't aware of GPS trackers other than movies and think they are much harder to come by. AirTags are also less nefarious by nature. If you get caught with a GPS tracker on your person that's pretty suspicious. If you're caught placing an AirTag on someone's car it's easier to pretend you dropped it and are looking for it. I'd also say that the popularization increases the chance of use in the moment. You already have the AirTag and can decide do that tracking. With the GPS you have to do forward planning. I do think there's a difference here that could lead to more people being tracked. Crimes of opportunity are different than planned crimes, and I assume much more common.

It is good that Apple is notifying users when being followed. But it seems that too many false positives are getting people to ignore the messages. Though this is a hard thing to combat.

> If you're caught placing an AirTag on someone's car it's easier to pretend you dropped it and are looking for it.

That doesn't make any sense. If someone catches me placing an AirTag in the undercarriage of a car, it's pretty difficult to pretend that I dropped it there.

Depends how you were caught. On your back reaching up? No. On your knees? Yeah. Consider that this tag was placed in the wheel well, which doesn't require getting on your back and would only take a few seconds. It isn't like someone is there for a significant period of time. Especially since you can then produce said AirTag after inquiry and people will generally believe the claim even if suspicious. All you have to do is create _reasonable_ doubt. That's different than _certain_ doubt. This is because weird stuff like that is much more common than nefarious acts (though we remember nefarious acts more easily). I think you are likely overly estimating yours and the average person's awareness. Scam artists and magicians exploit these kinds of effects frequently and with an extremely high success rate.

Well if you were caught squatting down, with your hand literally in the wheel well of the car, again, that makes it pretty hard to argue you dropped something there. That's what we're talking about here.

Your hand is in the wheel well for a fraction of a second, just enough for a magnet to stick. You can still say "oh I was just picking up my air tag" and it'll be fairly reasonable. I'd buy it if it were done so you didn't look like you were fiddling with the car too long.

Your argument isn't very convincing. AirTags are one of the few location tracker that the public can recognize by sight and identify its use. This makes AirTags much less effective for use by malicious actors than other generic black-plastic case electronics.

My friend just had someone jack up his car and hack off a catalytic converter with a hacksaw in broad daylight, to steal it. How long does it take to place an airtag, 3 seconds? I think the chances of you being caught placing an airtag are slim to none.

It's only less effective if it's somewhere that can be seen. I think most people don't check the insides of their wheel wells more than, well, at all. In which case the device could be neon green and it wouldn't matter for the purposes of visual detection.

You clearly have near 0 relationship with the public. The public can't identify an AirTag; most have hardly heard of the thing. And even if they did, someone's story of dropping a thing would convince 99% of people who want to be doing anything else than running BS detection on some weird person they've happened upon.

> Most people aren't aware of GPS trackers other than movies and think they are much harder to come by. AirTags are also less nefarious by nature. If you get caught with a GPS tracker on your person that's pretty suspicious.

These are used in RC a fair amount, not sure why it'd be anymore suspicious than having an AirTag

Security by obscurity is not security at all. Thinking you were safe because “people didn’t know about it” is not safety at all! Bad people are going to be bad. They don’t need AirTags for that. Knowing it can happen is far better for everyone to know about than living in a false sense of security.

As someone who has been in this field professionally for almost 20 years, my thoughts on this have changed quite a bit. The idea of condemning security through obscurity traces back to cryptography, not security in general. In cryptography, you want the security of your protocol to not depend on the protocol being secret, but the cryptographic keys themselves being secret. There are a lot of good reasons for this, the main one being that the whole point of cryptography is to create protocols that can survive public scrutiny and thus are more easy to implement and more robust.

So for example, without cryptography you'd need to secretly pass a message by courier who might take a secret route, constantly changing his route and delivery time. With cryptography, you can encrypt and sign the message, and then broadcast it over an insecure channel. The second option is much easier than the first. So the whole enterprise of cryptography is based on the principle of abandoning the confidentiality of the protocols themselves.

But there are many situations that require security which are outside of cryptography, because the security of the overall system cannot be reduced to high entropy secrets, and in that case, there is some security benefit that is obtained from obscurity.

For example, we are concerned about username enumeration because we understand users choose weak passwords that might be found in databases, so we do not publish usernames and consider it a vulnerability when usernames are leaked.

As another example, we consider information disclosure consisting of stacktraces leaked to the user to be a vulnerability.

Similarly, there are data centers that cannot just get up and move, and so locations and protocols of these installations are also kept secret.

So while it's true that things which are hard to change should not rely on secrecy in order to maintain their security level, and we should constantly be improving and hardening our protocols so that they can resist public scrutiny, nevertheless it's not the case that all protocols have been or are able to be improved so that their security properties are reducible to high entropy bit strings - in fact most systems don't fall into this category and most will never fall into this category - and for these systems, part of the security will continue to rely on obscurity, even though we are painfully aware of the drawbacks of this approach.

Even in cryptography, there can be value in obscurity.

For instance, suppose you have a system that uses the latest well-known encryption algorithm. You keep the keys secure. Of course.

Now suppose you have an alternative version of the system which super-enciphers all traffic with a fixed and physically protected key. Clearly, if that key is known then the system is no harder to attack than a system without the super-encryption. If the key to the super-encryption is not known, this adds considerable security against, say, successful key interception. Essentially, you are adding diversity of mechanism so that attackers have to multiply and diversify their attacks.

So security-by-obscurity can be a useful adjunct. It just can't be the whole story. Also, it isn't something you should talk about which means that the conversation about such techniques tends to be dominated by people who don't have practical experience with expert and well-financed adversaries.

The intelligence community is very well aware of these factors. That's why they try to protect the integrity of their hardware so much. That also why they don't talk much about the pragmatic aspects of their encryption machines.

Obscurity is not a good primary line of defense. But there's no reason why-- all else being equal-- it can't be part of a more robust setup. The more obstacles the better: like simply not using standard port #s for services so that it takes more than a quick scan of common ports to find something. Simple, and sure easy to defeat, but it takes you off the list for the lowest having fruit of targets.

Security by obscurity is actually pretty good security. Obviously but fool proof, but pretty good. Of course it depends on how good your obscurity is. Plain text passwords are not very obscure. And thus is mainly where the phrase comes from.

Great for business' network effects: you have to have an iPhone 11 or above (U1 chip) to avoid being tracked

Behind its "privacy" PR, Apple is secretly nudging people to buy more iPhones again...

Past tricks to make people upgrade:

1. Slowing down: https://www.bbc.com/news/technology-51413724

2. "Other" storage: https://developer.apple.com/forums/thread/666721

You're surprised a company making a product wants consumers to buy their product?

How does the "slowing down" story keep coming up when it's clear it was the best solution to the problem "what to do when users have the same battery for 3+ years and the device literally cannot sustain itself anymore".

Not surprised, just a hypothesis on hidden tactics behind.

As for your question, do you really trust in Apple's PR? "Privacy, green, ethical labor"

Oh almost forgot, another case:

3. https://www.cbc.ca/news/thenational/complete-control-apple-a...

Well, the way I see it is that in the counterfactual world where they didn't downclock, someone who doesn't "trust in Apple's PR" would conclude that the lack of downclocking is so that phones would turn off randomly, nudging people to buy a new phone.

Or they will just be left with a poor brand experience and switched to Android.

Using this logic, please explain the pattern with #2 and #3.

It’s doesn’t require the U1 chip.

3 days: https://www.youtube.com/watch?v=sPqiQiKN284

I see: https://www.pcmag.com/how-to/apple-airtag-tips

Not so good for Android: https://play.google.com/store/apps/details?id=com.apple.trac...

What’s your point?

AirTags don’t require the U1 chip. It is required for precision finding.

Seems like I’m entertaining a bad faith argument.

My point is that people without iOS 14.5 (older iPhones), iphone 11 or later will either be forced to upgrade or switch from Android (bad app reviews) to avoid being tracked - a dirty trick by Apple to gain customers.

Some people might brush notifications - either be 3 days as the reporter suggested (self tag) or right away as OP (stranger's tag)

Just a hypothesis, but Apple has a history of doing this as seen in 1,2,3 above. Its PR is genius, always spinning the narrative.

#3 update: https://www.youtube.com/watch?v=9l3f1KrMQeo

Trivially possible? I wouldn’t know how to use or where to buy a GPS tracker. I’m sure it’s not super hard. But not as easy as an airtag.

But now anyone with an iPhone can buy a $25 device and track anyone. I would guess that Airtags are also smaller than gps trackers.

> where to buy a GPS tracker.

Have you heard about amazon.com? There are multiple around $20 devices there.

so if you want to track people/pet, are the word that spring to mind "GPS tracker" or "air tag"? What happens when you google "GPS tracker"? NOTHING shows up?

Before AirTag which was only a year ago, did bad actors just sit there thinking to themselves: "man I wish there was a technology to track people, I wish I knew what it's called"?

I thought that too. Google GPS tracker and the first result are trackers for about $30. They come with a SIM Card and and a Online Service for $5 so you can track the tracker. Also comes with an alarm if someone removes the tracker. This is really trivial...

But still not as trivial as an Airtag. You need an iPhone and an Airtag. That’s it. No extra service. No waiting non-Prime or non-Apple shipping for a tracker to arrive.

The first results in Google for me are $50 and are about 10-20x the size as an Airtag. Also multiple parts.

And, the units off Amazon have to be purchased with a credit card + shipped to your house. AirTags can be bought with cash much more anonymously. (Though I’m not sure how/if Apple can identify the associated iPhone if presented with a warrant.)

Walk into a hobby shop, buy a GPS tracker for a RC/drone, pay cash…

I am wondering:

- Would a GPS tracker placed at this position be able to catch the GPS signal? If I understand it correctly, an airtag communicate via bluetooth and would get the location from a phone in range?

- An airtag do not require a SIM card. Are they easily traceable or is it hard to get to the owner?

A GPS tracker in the wheel well would have no problem getting signal, GPS receivers have gotten spookily sensitive in recent years. And that's a genie that won't go back in the bottle.

> An airtag do not require a SIM card. Are they easily traceable or is it hard to get to the owner?

I turned my laptop into a functional airtag one bored day. Not sure how to get the data from apple with a Mac because it requires a bit of hackery due to them not having a public API but it can be done using their email app IIRC.

They store the encrypted location data on their servers so without the private key nobody can read it which also means nobody can determine who owns the tracker — I’d imagine they could use access logs or something to figure out who’s been reading the public key which the tracker broadcasts.

TFA could have not thrown the airtag away, read the serial number off it and used that as a “clue” methinks.

I actually want to get an esp-32 and turn that into a airtag but I’m lazy and would also need to buy a Mac so…though I’m not too lazy to code up a little daemon which will set off the beeper on every airtag in range once I get ahold of one.

I see some parallels here to cases like "Google Glassholes"[1] or the "Sony see through camera" [2]. Both turned to be PR problems, even though technically the companies did not do anything that was not already otherwise possible.

[1] https://nypost.com/2014/07/14/is-google-glass-cool-or-just-p... [2]https://bettermarketing.pub/sonys-see-through-camera-disaste...

In Australia to activate a sim you need a form of ID, if you were to put a sim card in a GPS tracker you could easily be identified. air tags not so much.

Easy, use a foreign SIM and roam. This is pretty common for IoT devices.

Still, even if not linked through purchase, the device will communicate back to a number controlled by you, fairly directly. A lot of obvious and hard-to-mask effort to emulate something that's provided as a COTS package with far harder tracking back to you.

TL;DR: this was possible previously, for fairly determined and advanced users; now it's available to anyone on a whim.

> In fact, this is news we're hearing about because of the steps Apple took to make it harder to use these devices for bad purposes.

I've got Android. Where do i see a warning?

Ps. No, people with Android will not have a Apple app installed. It's the wrong solution for that problem.

How is it the wrong solution? An app is required for any of this to work/be detected. Either everyone jumps on the same bandwagon (Google joins Apple or something), or you install the app for the bandwagon that exists.

? No.

An app must be installed to detect abuse, who would install that preventively?...

For setup, sure that's possible as an app. But my comment was "where do i see a warning", as in : detect abuse.

A protocol should be implemented, so it can be implemented on a more broad os level.

In reality: no one will install an app for a potential abuse and i can't imagine someone would think otherwise. The people that are getting conned are obviously not the users configuring the AirTag.

> An app must be installed to detect abuse, who would install that preventively?...

> A protocol should be implemented, so it can be implemented on a more broad os level.

I don't understand, this is what I'm saying. "Either everyone jumps on the same bandwagon (Google joins Apple or something), or you install the app for the bandwagon that exists."

You need the software installed. Either everyone jumps on the same bandwagon and everyone provides the app/system service with their phone, for the same protocol, or everyone has to install an app/system service that supports whomever's specific protocol. This has been the case long before apple, with Tile, Samsung, etc.

> who would install that preventively?

With the unfortunate consequence of causality and forward direction of time, everyone that has a phone that doesn't already have it as a system service, until everyone jumps on the same bandwagon and agrees to supporting one specific protocol. What's the alternative here? Regulate all tracking devices so they can't be sold until all phones can detect them?

> AirTags will also beep if they're separated from their owner.

Why didn't the AirTag beep in this situation? She said she went around the car trying to find it.

They begin beeping at a random time between 8 and 24 hours after separation, not immediately. Probably it was still too soon?

It's a tricky timing to work out, I guess. You want to warn people about trackers near them, but you don't want someone e.g. leaving their tagged bag in their locker to cause loud beeping after 30 minutes.

I’m sure it’s trivial to physically disable the beep speaker.

Indeed, a Google search is enough to find guides, and I assume most bad actors would be aware of this.

Well, anything that involves precise drilling isn't really what I'd call "trivial". But it's definitely doable.

"GPS trackers designed to be magnet-attached to a car which report their location via cell signal cost ~$20 on Amazon. You then tend to need to pay for either a SIM card or a subscription to the device maker's service -- bringing you up to about the cost of an AirTag. These are much harder to detect, as you might imagine."

Yes ... but Apple has built a mesh network to report the position of people who don't want to be tracked ... and clearly are being tracked. And it's very possible my own iphone is being used in the service of an evil actor. That feels ... different. Ethically -- if not technically.

"It's tricky to make something that lets you find where you dropped your keys while walking the dog that can't also be used for nefarious purposes." This seems awfully blithe. I suspect you aren't a woman. Or that you don't have daughters old enough to live on their own.

> Yes ... but Apple has built a mesh network to report the position of people who don't want to be tracked ... and clearly are being tracked.

Sure, but you could say the same thing about the cell network. Same argument applies to the cell GPS trackers I mentioned.

> And it's very possible my own iphone is being used in the service of an evil actor.

You can turn if off if you want. `Settings > Apple ID > Find My > Find My iPhone` and uncheck `Find My network`. I do appreciate that the power of defaults means that you personally disabling it doesn't really do much to the overall situation, though.

And both should be simple for the police to link to the owner, if they are reported. Maybe a bit less so for a SIM card, but that AirTag is registered with someone’s phone

"So not even Apple knows the location of your AirTag or the identity of the device that helps find it."

Correct. And if you read that carefully, it does not say that Apple doesn't know who the owner is. The owner, in this case, is not whose phone reported the tag.

neither of those statements say anything about identifying who purchased the air tag and what apple account is tied to the air tag.. you do realize that for someone to be able to find the location of the airtag, it has to be tied to their icloud account? the airtags have a serial number. it's trivial for apple to identify what icloud account is associated to the tag by serial number..

> This is news just because it's an Apple device being used for something that was already trivially possible.

> GPS trackers designed to be magnet-attached to a car which report their location via cell signal cost ~$20 on Amazon. You then tend to need to pay for either a SIM card or a subscription to the device maker's service -- bringing you up to about the cost of an AirTag.

So you're saying Apple made it even more trivially possible. Not only does it cost the same, it now requires less effort.

In one way. In another way, the only way the tweet author knew was because Apple alerted them to the fact that they were being tracked.

Other trackers would not do that. It seems Apple actively put effort into thwarting this kind of use.

meta irony! The device that informed you that another device was tracking you is, of course, already tracking your every move.

They did the bare minimum so that once in a while creepy stalkers will get noticed. Should we give them an award?

Nah, just recognize that the tech already was out there, for a lower cost, in a form factor that won't notify you you're being tailed

This isn't a new thing and Apple takes steps that, for example, Tile doesn't to prevent their products from being used for nefarious purposes

I do recongnize that. Does only the first person selling a dangerous product deserve scorn? "X did it first!" is the excuse of a toddler.

They've also made it easier than gps trackers (no sim card needed), probably safer for stalkers (does Apple have a way to report AirTags used for crime and/or find out who owns it?) and it's more effective than Tile.

It also favors their own ecosystem, because only iphone owners get warned. (no I don't consider beeping enough, finding something that beeps intermittently is notoriously difficult).

I'm saying anyone who wanted to do this already could, and Apple's version is worse at being abusive than what they could already do.

Sticking trackers onto the cars of people parked near bars isn't really a thing you do on a whim.

While it’s theoretically possible that this happened, I think this particular story was made up. For a number of reasons: 1) How did the stalker know that that’s her car? She said she was on a night out. Unless she went back to her car all the time, he must have seen her arrive in it. 2) Sticking an AirTag to the inside of the front wheel well isn’t easy. There is dirt and grime there and the surfaces aren’t flat. The stalker would have had to use a very strong adhesive to make the AirTag stick while the car was moving. 3) While it’d be a smart idea to not drive home while a foreign AirTag tracks you, who is alert enough after a night out AND happens to have friends in the vicinity that you can wake up at what must have been a very late hour? 4) Her friend who found and removed the AirTag took no photo. Really?

While it is possible you could use an Apple AirTag in this way, there are a number of facts that don't add up in the story. Supposedly the AirTag in question was "thrown away" so there would be no hints as to how it was attached. Also, if you are being unknowingly tracked by another person's AirTag you can disable the tracking and notification if you are worried about it: https://support.apple.com/en-us/HT212227 and additional steps at https://www.macworld.com/article/345863/how-to-find-block-di...

If you are worried enough to drive to someone else's home, why would you go to sleep with the tracker still on the car without disabling the tracker first?

No doubt that this sort of tracking is possible, but there's much here that needs some questions answered. If it was a ploy to get people to be aware of the possibilities of AirTag tracking, then I suppose that should be disclosed.

Read on the news that this kind of tracking with AirTags is used to steal cars. A car thief attaches it to the target vehicle, and then simply arrives to the place where it is parked overnight. The thief removes AirTag and then waits for an opportunity to steal the car.

How is that better that just stealing a car without the airtag?

You can steal the car in a quiet area at night when the odds of being caught are much lower. It allows the criminal to pick the time and place of the crime, rather than it being dictated by luck and coincidence.

Why not drive through a random suburb at night and randomly pick a car?

It is not attached to average cars, they attach them to cars that are hot in the market

I would also estimate that the nicer the car, the more likely it's inaccessible later in a home garage, limited access parking deck, etc.

Lmao exactly. This argument seems absurd - just steal the car it’s not like she was driving a lambo

We don’t know if the tag was placed there for car theft reasons. The perpetrator could want to know where she lives for something even more nefarious.

Thought the same but didn't want to say so on Twitter.

The AirTag would have been linked to an Apple account.

Friend didn't take any photos, destroyed the only evidence. No police report. Seems legit.

Not to disagree with your overall point, but on #2 magnets work well for this and there are a lot of “hide-a-key” type things on the market that are often used in wheel wells by people who have a history of locking their keys in their car.

Good point, but may I add 5) AirTags are a very expensive way of stalking someone. Surely, there may be some creeps willing to put up this sort of money. But some random guy who sees her on a night out and who happens to have an AirTag with attached magnet with him? And if that was indeed the case, wouldn’t there be some pretext to this, like someone hitting on her that night and she turned him away? She doesn’t mention anything in this regard.

So no, this story doesn’t line up and looks more like cheap attention grabbing at the expensive of a real problem with Apple’s AirTags.

> AirTags are a very expensive way of stalking someone

I don't know your frame of reference in terms of what counts as expensive here, but an AirTag just $29 if bought individually or $25 if bought in a 4-pack. $25 would cover 2 drinks on a night out here (a major west coast US city) at best (and that's without accounting for tax+tip+etc.).

Plenty of stalkers out there are definitely willing to spend way more than just the cost of ~2 drinks, when it comes to stalking someone.

I agree overall that plenty of things in the story don't add up, but the AirTag cost imo isn't one of them.

Back in my cab driving days I would occasionally pick up women from a shelter (for medical appointments and whatnot) and some of the stories they told me about their stalker exes make a $30 investment basically nothing.

The amount of effort they would put into stalking is mind blowing.

Apple knows who owns any given tag, even if they don't know who located the tag, and an iPhone is required to set up the tag. If they hadn't thrown the tag away, looking up the associated ID would have been trivial. I'm not sure if Apple's system will let you pair a tag to a phone that isn't on a cellular network, but if not, that's yet another point of identity for a potential thief or stalker.

So the potential thief/stalker is using a cellular handset that can identify them on an account that can identify them to use a $25 tracker that can identify them. Or, they've stolen someone else's phone, assumed that person won't trigger the lost phone kill-switch in time for them to complete whatever task they've set out for themselves, paired a tag to the stolen phone (which I believe requires the account password and phone passcode to do, but it's been a while since I've done it), and then tracked the victim. It seems like a massive risk compared to buying a plain GPS tracker & pre-paid SIM, but then again, criminals don't tend to be the smartest.

I think the problem with saying something was made up is that it becomes blaming. I would hope people don't vote you down because I think that blame is justified, because I questioned how it was presented, on Twitter. I think if it was something related by a friend or close acquaintance to me, then I'd believe it. That it is being disseminated on Twitter in the way it was, I have a tendency to suspect there is more to the story, given I have no idea if I can trust the individual making the claim.

This seems pretty obvious that this will happen and not necessarily something that is surprising or adds to the story, other than them claiming it happened to them and horrible that is...and maybe an indication everyone should make a big deal out of it.

https://www.youtube.com/watch?v=rE3j_RHkqJc

Saying that somebody made up a story is not blaming. That is an accusation of lying, which implies that wrongdoing didn't even occur.

>I think the problem with saying something was made up is that it becomes blaming.

What's your point? Blame is not a thing to be avoided.

The interesting thing is that I have seen multiple reports of this ( think this is is the third), but in every case, they have destroyed it, lost it, or thrown it away before hand - not given it to the police.

Apple can't tell who the devices is from signals in the wild, but they can figure out who it is if someone gives them the physical device. (Apple tracks the serial number of the device, and from what I understand, can provide purchaser/activator information based on the serial number).

I have a feeling the interaction with the police in a lot of jurisdictions would go something like:

“This person at this address tried to track me without my consent! Here’s the documentation from Apple!”

“Ma’am, has the person at this address murdered you?”

“No.”

“I’m afraid there’s nothing we can do right now. If this person does murder you, please call 911 immediately.”

At the very least, a report should be made. If something does happen, at least there's a paper trail and they would be highest on the list of suspects. Could be used as evidence to get a restraining order as well.

If the person does indeed get near to the victim, then the police can actually do something since they are in violation of a court order.

In this situation you should work with a lawyer to have law enforcement discover the owner of the tracker as part of the process to achieve a civil restraining order. It's probably also doable pro se.

There isn't a clean path to obtaining that information merely by filing a police report or having a conversation with an officer. I would think officers would point you to civil court, but if they don't, it wouldn't take much to discover the process.

That is, if you're lucky and they understand what you're talking about.

You'll probably have to spend some time explaining how it works, why it is a serious issue, and then probably be dismissed.

You'd have to explain to the police why a device that's designed for tracking things being placed on your car is a serious issue?

Personal experience of explaining to a police officer how I was able to track down a friend's stolen smartphone.

Edit: it was in Paris, France.

And to continue on that story, even though I gave them the location: "lack of ressources, we can't dispatch anyone at the moment". They never did anything afterwards.

Essentially. As in "if they would just go away, less paperwork for me."

Maybe that’s because none of these reports were actually true?

Honestly, AirTags invading on people’s privacy are the latest fad. And as with any story about the dangers of “Big Tech”, they make for good headlines. Only that nobody bothers to do some basic due diligence on the truthfulness of these reports in the first place. This one is littered with nonsensical facts that makes me not believe in this story for a second.

Which has nothing to do with the fact that there is indeed abuse potential with Apple’s AirTags.

I will (probably) destroy it too immediately. I have no idea why someone put airtag on my car, maybe they want to know location of my house, or want to know where I live?

Probably because it's a made up story.

The worst part of this is, if you don’t have an iPhone, you’ll never know if you’re being tracked.

Edit: Yes, I know there’s an app. Do you think more than 1% of victims will have it installed?

There is, it's open source and works. I have have this running on my phone in the background and it has alerted me a few times like when my phone was in the locker at the gym and someones airtags was in a locker close to mine.

https://github.com/seemoo-lab/AirGuard

If you already knew that there was an app out there, maybe don't use absolutist sounding phrases like "they'll never know" just to come back and make defensive edits about how nobody out there knows about its existence when you yourself obviously knew about it.

Yes, i, android user, have to install an Apple app to know I'm being tracked by their devices. I, average android user, also do this proactively because I know some creep/car thief/angry customer/... might want to track me or my wife.

Nothing to see here, all totally normal and expected and I should be grateful that there is an app to defend myself proactively against such tracking. I should also do the same for Microsoft, Huawei, Samsung, Sony, ... tracking tags. If that eats my phone battery this is just a small price to pay to assure my daughter won't be kidnapped or my house broken in as the attacker conveniently knew I wasn't home.

May I suggest we also all proactively wear tinfoil helmets to ensure Tesla's 'level 5 self-driving cars' don't kill us? You know, totally not the responsibility of the manufacturer to make sure their products are safe for all.

There is at least one android app to list nearby airtags. The one I found requires you to manually start a scan though so it doesn't alert to issues like this one. OTOH your own phone won't be used to track the air tag. OTOH half the people around you have an iPhone that will do it for them.

Care to link the one you found? Going through the play store these days is a nightmare of privacy problems and adware so if you already found a good one, that would be nice to mention.

https://www.theverge.com/2021/12/13/22832731/apple-android-a...

https://play.google.com/store/apps/details?id=com.apple.trac...

This one is first-party from Apple.

Not true, no app is necessary. The AirTag will start beeping once it's been separated from its owner for longer than 8-24 hours.

That's going to be hard to hear when driving on the highway, also, the seems like a long time if someone is following you home from a bar.

I don't think there's any good way for Apple to fix this. On the other hand, it's been possible to do something similar for a long time, just not this easy, and at this price point. You could suggest that the AirTag disable tracking if it move along with the same phone for more than 15mins, but that's would mean you could steal anything with an AirTag and just keep moving for that period of time.

The Android app also isn't helpful, because many don't know that they need to install it, nor should they have to. Nor does it help say elderly people with no smartphone.

It's a product where Apple really didn't consider the real world implications. It's a neat device, and I'm sure it's well intended, but it's not fit for the world we're currently living in.

The only significant differences between AirTags and other devices are the fact that the victim’s phone might be used to transmit their own location and the widespread availability and marketing of AirPods compared to other devices. Apple can’t really do much about the latter (other than discontinuing them), but it seems like they could partially address the former by having each phone only transmit the location of non-owned AirTags a single time. This might not work if the victim’s car if in heavy traffic where phones in other cars can transmit the location, but it could at least help in cases where a single car is driving home alone.

> It's a product where Apple really didn't consider the real world implications. It's a neat device, and I'm sure it's well intended, but it's not fit for the world we're currently living in.

Exactly; it's unfortunate, but this sort of product should really be made illegal, just due to the many ways it can be misused.

This is incredibly inane. The components that make up a GPS tracker are both extremely cheap to produce, too general-purpose to be made illegal themselves, and can be put together to make a GPS tracker with zero technical skill, just by following any of a thousand YouTube videos. (I have one explaining how to make a GPS tracker out of an Arduino on my YouTube home page right now!)

All that making GPS tracking devices illegal would do is to eliminate all the positive-sum uses of the technology, while creating literally no additional barrier for people already willing to break the law.

It’s the “then only criminals will have guns” thing, but much more clear-cut, because while making your own gun from general-purpose input components requires a machine shop and an unethical person with machining skills to run it (and so making guns illegal really does make guns harder to acquire — though not impossible), making a GPS tracker from general-purpose input components can be done in your own living room without even a soldering iron.

I think there's some merit to the argument that making tracking products widely available has risks and downsides.

For one, there are some important differences between AirTags and a GPS tracker. AirTags don't use GPS (at least, on the tag itself). They're tracked by all the Apple devices around them, and they can use lower power (perhaps even passive) methods. A GPS tracker requires some kind of uplink. A tracker using GPS would need to be larger, and have a shorter battery life for a given size. AirTags are also innocuous to buy and not immediately alarming to see in someone's possession.

The argument that anyone is capable of building a GPS tracker in their living room seems unlikely to me. I think this is far beyond the capabilities of 99.9% of people (although it's a fairly straightforward and very fun project for people interested in Arduino).

All this said, I am mostly in agreement that the arguments against AirTags seem fairly weak. Especially because I assume Apple has a way to easily determine who placed the AirTag, and that they would face serious consequences.

Except they clearly did consider it? And made many countermeasures, from beeping loudly after separation, to releasing an open source first party app on the dominant competing platform to show what is going on.

If anyone provides a device? It’s also traceable to the owner/person watching it.

None of these things are possible/done for the myriad of GPS trackers out there. Apple has made it very risky and frankly dumb to use them for this purpose.

> just not this easy

You're correct, it's been easier.

> at this price point

You're right, it's been cheaper.

> do something similar for a long time,

You're right, it's been similar except that the other methods were far harder for the victim to detect.

Can’t Apple just provide an option that lets you force “stalking” air tags to beep on command? Seems like doing that could essentially solve this whole class of it’s tracking me but I can’t find it stories.

That would render them useless as an anti-theft product.

It used to be after 3 days. It was only changed to hours because of cases like this.

I’m sure it’s easy to open the AirTag and pierce the speaker.

It is not very easy to do so, no. ifixit has a tear down.

https://www.ifixit.com/News/50145/airtag-teardown-part-one-y...

The flip side of this is that if you don’t have an iPhone, you don’t have anything participating in the mesh network that’s required for the AirTag to operate. Of course, someone else’s iPhone could still pick it up and relay the position, but this becomes considerably less likely in a scenario where the adversary is attempting to track a vehicle.

If tracking the vehicle to the destination is the goal it's fairly likely someone with an iPhone will pass by the vehicle at some point. Especially in an apartment complex or public shared parking.

Slip it into a young child’s backpack, they rarely have iPhones. Wait for them to get out of school…

Do you see the danger

I see the creepy potential. I don't see the danger.

The danger is that predators could track a child to a secluded area and abduct them.

Stranger danger is ridiculous and harmful.

Most abuse, abductions, and harm to kids comes from those close to them who already have access to them, not some rando somewhere.

Putting everyone into ‘oh my god, some rando is going to kidnap and kill your kid’ just amps up the already insane anxiety overload everyone is in.

The vast majority of abductions of children are by family. Same with other crimes against children. People they know are far more dangerous than people they don’t.

The predators aren’t hiding in the bushes, they are already in the house.

That's true but I don't see how it negates my point.

This is some kind of bias, the reason this is true is because it’s far easier for those people to abduct a child whose habits they know well. Now that the technology to track anyone is far easier to come by, maybe that will change.

Human trafficking is a huge problem even in America. This includes many children sold for sex. They often find and groom victims online now though, so yes, perhaps they aren't hiding in the bushes.

Or you can just find a random kid in a secluded area and abduct them? Why bother tracking a specific one?

And if someone wants your particular kid for some reason, then they'll probably get them without Apple's assistance.

Couldn't someone just slip a phone in a bag to do the same thing?

Yes, but that’s probably a larger and more expensive device.

That is indeed creepy! But it is unlikely enough that I would not call it dangerous.

You don't see how creepy + children = danger?

I think they do. It's more, which should you fear more: your bath tub or someone rampaging in the street with a knife? The statistics say you should be far more afraid of your bath tub, there is a decent chance it will be your cause of death. The 'stranger' in the street is about as likely as lottery odds.

So when it comes to children, abuse at home is several (if not many) magnitudes more likely than a stranger trying to track and abduct your children.

Depends on the street. If you are in downtown San Francisco for example, all bets are off...

Apple made an Android app for this.

Apple's app requires you to scan manually, it doesn't warn you if you're being stalked. You'll need something like Air Guard to get similar notifications.

That is good that they made it, but the fact that you need to install some app for something that you do not use, seems to me like opt-out tracking?

The app is stop gap at best - it has to be run manually, the screen has to be on, and it chews batteries (due to phone architectural designs)

which currently has a rating of 2/5 because of how terrible it is.

Did you read the reviews ? Maybe because the bad guys do not want you to use it. You need to underestand that there are a lot of people paid to have an opinion on the internet.

Some of the (dumb) reviews don't change the fact that Apple's app requires you to perform manual scans and doesn't alert you if you're being tracked. Only iPhones do that.

If that was the case why don't the non-Apple apps have the same problem then?

how do I see airtags around me with my iphone? on "find my" I just see my own apple stuff.

You can't. You only get an alert after one's been following you around.

iPhone will send an alert to you if unknown AirTag is following you around.

then I don't see how this is a problem having someone else's airtag on the car. the owner of the car is the only person being "followed" by it.

The owner of the tag knows, in real time, where the tag is and only iPhones receive the tracking notifications.

Because the owner of the car would need to have an iPhone?

"Of sexual abuse cases reported to law enforcement, 93% of juvenile victims knew the perpetrator: 59% were acquaintances. 34% were family members. 7% were strangers to the victim.

also https://en.wikipedia.org/wiki/Acquaintance_rape

>this morning while I was asleep I had someone close to me check my car and they found it stuck on the underside of my front passenger wheel well. I wish he took pics before he threw it away

throw away individually identifiable piece of evidence instead of calling the police, ok

Trusted figure eliminating evidence of a plot against you while you sleep (and possibly nudging you to not call the police, who knows!) sounds like a villain right out of a detective story, but it would be a very silly move to not clear in advance how AirTags work and whether the victim uses an iPhone (which can be easy even if they are not that close).

Not impossible (e.g., an impulsive boyfriend or familiar admirer with control issues naively wanting to find out where she goes or purposefully scare her as part of larger big-brain ploy), but depending on her car an AirTag-assisted car theft attempt could be more likely: https://www.yrp.ca/en/Modules/News/index.aspx?newsId=167fa5b...

Victims make poor decisions all the time. It doesn't really imply the story is false - although I happen to find this story unconvincing also.

Throw away individually identifiable piece of evidence instead of calling the police, ok

I wouldn't consider it particularly wise to assume the police will automatically be your friend, in this situation. Ask yourself who may have planted the device, after all.

(I don't think law enforcement would use AirTags, actually. But I'm just saying -- on general principle).

So I and my wife both have AirTags. Every time we take a walk together, we both get notifications that there's an unknown AirTag with us (each others'). You can pause these notifications for just one day, which means we get notified every single day.

Does anyone know how to disable this for specific known AirTags?

Yeah, it feels to me that Apple went too far with their anti-stalker provisions. I believe much of the problem could be eliminated if there was some sort of central filter to the alerts. Phone says to the filter "I see an unknown air tag ID# xxxxx". So long as there is another phone that says "I see a known air tag ID# xxxxx" no alert is triggered. Only when no device claims the tag as known would the phone speak up.

So long as somebody nearby knows the tag it's almost certainly either someone with you or someone simply moving in the same direction and nearby. If it has been planted you'll find out when the planter moves away from you.

Wouldn't this mean that all a stalker would have to do is hide an iPhone in your car along with the airtag?

Although at that point you don't even need the airtag.

I keep getting these notifications for my own AirTags.

I know they’re mine because the notification shows the last four digits of my own phone number.

When an AirTag is assigned to an iCloud account, and a device (say an iPhone) is with you, then you shouldn't get these messages. But if one of you didn't bring their phone but, for example, the keys, you will get these messages, yeah.

Thanks for this. My wife often doesn’t bring her phone on walks, but does bring her keys. That would make sense!

You can track each other with your phone and Google tracking or a bunch of other apps. Maybe that is simpler alternative to tags?

I am given the choice what I want to do, and chose the "always ignore this AirTag" option.

This opens up a new "evil maid" attack: secretly tracking anyone whose phone you have access to.

You are worried about someone who physically has access to your phone and knows your passcode tracking you? That is not the problem being discussed here.

I know it's not being discussed, I am introducing it as an adjucent attack vector that is already an issue with Google Maps' location sharing. Google counters it by sending periodic emails to remind you that you're sharing your location, and with whom.

Being snooped on by someone with physical access to your device, as well as the opportunity to use it while unlocked (passcode or not) happens more times than one might think! It could be anything from a creepy colleague, or an insecure romantic partner.

Are your Apple accounts in a Family Sharing group? I have no idea if that would affect this feature, but my wife and I also have AirTags on our keys and we travel together plenty and have never received this notification.

Thanks for this suggestion. We are not in a Family Sharing group, so I’ll look into whether this helps. I also might just move her AirTag to my account to track her keys, since if she’s misplaced her keys there’s a good chance she’s misplaced her phone as well.

Same. I just wish you could transfer ownership of a tag between family members.

You can. Disconnect it from one person's iCloud, connect it to the other. We did it with our cat's AirTag when I got a newer iPhone, so we could use the more accurate location.

I do wish there was a share feature, though.

The lack of integration with family sharing has made AirTags mostly useless for me.

As someone who has been around message boards and forums since the late 90’s one thing that has really surprised me is the degree to which people have started taking first person online stories seriously.

Reddit of course is full of them, as is Twitter and lots of other places. Meanwhile the incentives to successfully tell a just-so story that goes viral have never been higher. Youtube money, GoFundme, influencer opportunities, etc.

The post we are all responding to is super low effort, not even a photo, and not even a first person account. Her “friend” found an AirTag and threw it away.

Meanwhile there’s a GoFundme link right on the profile.

Just saying.

While the story is of course possible, there are sufficient red flags I'm inclined to think it's not likely.

I stopped when I read that. Terrified woman stays with friend after being alerted to a tracking device on her car. While she sleeps, the friend searches the car and discards a tracking device. Right. And everyone else here treating it like that is fine.

Ok, but it was fully funded months ago.

Apple AirTag Linked to Increasing Number of Car Thefts, Canadian Police Report - https://nypost.com/2021/12/07/carjackers-are-using-this-new-...

Why does the thief bother to track your car back to your house to steal later? Why not just drive around the residential areas where the cars are parked and just choose one at the time you want to do the theft?

So that the thief can learn your schedule and when you're home or using the car and can plan in advance to avoid being caught. Among other things, information about the exact location of an expensive vehicle over multiple days is very valuable information when you're trying to steal said vehicle.

Not a car thief but it's an interesting question. Maybe given the VIN and a few hours/days you can lookup and make a correct key for that type of car. So the tag is placed when the VIN is collected and the theft is smooth with a valid key.

In Amsterdam I once met an Eastern European career criminal who followed people driving home after work hours and waited for them to get into the shower. Then he'd pick their front door lock and take the keys.

Unrelated, he also had a room in his apartment set up to grow weed, with some serious climate control and artificial lighting. He was dealing this pot. He had no papers or permit to stay... what crazy folk.

Pretty bold. I don't know much about Amsterdam, but I've heard burglars in the USA are usually very careful not to break into a house when people are home, as the consequences are much more severe compared to burglarizing an unoccupied house.

That was the article where buried in the text it admits that there were 5 cases that police knew about. Just 5. Looks more like clickbait to me. For the price of an airtag I could just use a GPS tracker with LTE uplink, and not worry about Apple being able to tell the police who the tag was activated for.

Surely Apple can use information from their Find My account to figure out who the AirTag was registered to. Even if the tag has been destroyed. That should be trivially easy, right?

I believe that's where the advice to hand an AirTag to the authorities come from?

From here: https://support.apple.com/en-gb/HT212227

According to the tweet thread:

>this morning while I was asleep I had someone close to me check my car and they found it stuck on the underside of my front passenger wheel well. I wish he took pics before he threw it away

If I found a tracking device on the car of someone close to me, I certainly wouldn't throw it away without showing them and insisting that they go to the police. Why would they just throw it away?

Perhaps they are the ones who put it there in the first place?

Because it never happened.

I'm trying really hard not to come to this conclusion, but the tweet thread doesn't make any sense.

>I didn’t wanna go home, so I spent the night somewhere and just said I’d figure it out in the morning.

So they stayed somewhere and said they would figure it out in the morning. Ok, that's reasonable.

>this morning while I was asleep I had someone close to me check my car

How did they tell someone to search the car while they were asleep? They said they would figure it out "in the morning" when they were awake. Some time between deciding to figure it out in the morning and waking up, they told someone to search their car?

If it didn't happen, being asleep while someone searched your car would be the reason why they threw the device away without your permission. If you were awake when they threw it away, that would be a lot more difficult to believe.

"Of sexual abuse cases reported to law enforcement, 93% of juvenile victims knew the perpetrator: 59% were acquaintances. 34% were family members. 7% were strangers to the victim."

I’m not convinced this is a priority for police. Air tags seem to be a net negative for all.

I would attempt to file a restraining order against the owner of the tag, that would force the police to act.

A ... a net negative? Okay, like maybe I get that some people abuse this thing and maybe that's bad and maybe ten extra people got their car stolen this year or something although even that is questionable given that Tile already existed. But net negative? All the utility from all the people that found all the things they found this year with AirTags is counteracted, is wiped away by... what?

You can always buy more stuff. Lowering the bar for stalking seems like a bad trade off, doesn’t it?

Please don't discourage people from seeking assistance from law enforcement when their personal safety is at risk.

You’re making a big assumption about me. I simply said I’m not convinced this is a priority for police. Prove me wrong!

You may not live in a large American city. It’s a bad place to rely on the cops in my experience.

No, AirTags/the find my network are designed to make it impossible for apple to track anything about a device on the network. If you actually provide the AirTag to police, then they can get the serial number, from which they can get the associated account.

Assuming that whomever put the AirTags their used their own actual account.

AirTags are registered to an Apple account, not a person. It’s not necessarily possible to trace it back.

The AirTag was conveniently discarded by an unnamed third party.

In Canada Airtags are used for car theft

https://toronto.ctvnews.ca/apple-tracking-devices-being-used...

Police are claiming they are, but have provided very limited evidence this is actually happening. https://twitter.com/neilcybart/status/1472634032827645962

What would police investigators possibly have to gain from making this up?

It’s not even an outlandish claim. Knowing the technology and the region this force covers it sounds perfectly reasonable to me that a least some thieves are experimenting with this technique.

Come on. Not everything is a conspiracy.

is this part right?

> If a foreign AirTag is around ANY Apple device that’s connected to a network, a nefarious AirTag owner will know its location!

the airtag is phoning home over all apple hardware, whether or not it belongs to the owner of the tag?

Correct, this is how Apple’s “find my” network works. Devices that don’t have their own GPS can still be on the network because they piggy-back off of nearby Apple devices.

Apple devices do notify users if there’s an unknown AirTag following them around.

It works like Tile and other previous Bluetooth trackers - it relies on a network of devices that can pick up the signal from the tracker and phone it back to the owner/Apple to know the location.

With the major difference that taking part in the Tile network is opt-in (you have to install an app) while taking part in Apple's Find My network is forced on iOS users (there is a way to opt-out, but 99.9% of iOS users are unaware of it).

fun antitrust case when tile decides they want their plugin to ship with the OS too

Sonos and Tile execs warn Congress that Amazon, Google, and Apple are killing competition: https://www.theverge.com/2020/1/21/21070812/sonos-tile-basec...

Basically that is as advertised.

The feature set definition of airtag = "tracking the airtag" and this requires a phone home which is done by using any iPhone (or is is any apple) device.

The find my network is designed to ensure that apple - or any malicious actor will complete access to apple's internal networks - cannot track any device

Can someone just put any random AirTag on someone's car and have it trigger alerts on nearby iphones? Does one have to do something to activate it first?

Curious if all one needs to do is get one and stick it on a randos car to cause psychological distress without even pairing with a phone or otherwise registering/activating the thing.

I'm pretty sure it needs to be activated to an Apple account.

But seriously, people here way overthink things. If a random sicko wants to cause someone psychological distress there are a million ways that they can unfortunately do so that don't involve elaborate technology.

> If a random sicko wants to cause someone psychological distress there are a million ways that they can unfortunately do so that don't involve elaborate technology

This doesn't strike me as elaborate at all.

The fact is the largest generation living today is more engaged with the world via their smartphones than their physical surroundings. AirTags seem uniquely well suited to that reality, with Apple delivering notifications on the attackers' behalf and all.

It strikes me as dependent on the person being griefed being in the Apple ecosystem and the person doing the griefing using a device that is at least potentially tied to their IRL identity. Not saying it's not possible but seems at least an edge case.

And if they want to track, that ability was already available, for the same price as an AirTag, and without the annoying habit beeping loudly or notifying the victim that they are being tracked.

Between reports of AirTags being used to enable auto theft and stalk targets, it is pretty obviously a very handy criminal tool. Apple definitely needs to do something about this for both ethical and reputational reasons.

the beeping if separated from owner after 8-24hrs is a bit helpful, but likely not noticeable if attached to the outside of a car. This is also a pretty big window in which to pull off your crime.

I'd suggest that all tracking come with logging of the original owner's Apple device and it's location. The handy general use case would be to find your phone with an airtag (e.g., on your keys) and another phone (e.g., friend in the group). The obvious deterrent to criminals is that their target and the police will have their device ID and location. They might still get away with it, but would need effectively a burner Apple phone & location history separate from their real device.

Other ideas?

I think this reverse tracking would also raise concerns

- keys with airtag attached are lost, thief (perhaps opportunist) can find the home/car they belong to

- stalker types can steal an airtag from a water bottle, handbag, or whatever, and find the owner's home

Not an iPhone user but AFAIK the lost phone scenario was already covered with even pre-airtag "Find my..." since you could log into iCloud web interface on any other device and use that

Yup, good points.

Perhaps it is just announced that it is logged and subject to police search.

IDK, just trying to think of ideas for a tough situation, but when a primary use case becomes enabling property and violent sex crimes ...

Heck, I was earlier wishing for tags like this that worked better, more trackable and a lot smaller for a variety of uses, including embedding in products. Which would make them all better crime tools. Ugh. Sociopaths really do ruin it for everyone.

Reading that, it sounds like a situation to call/drive to/or otherwise get the attention of the police. Attaching a tracking device to your vehicle is a significant indication of malicious intent. It's a potentially life threatening situation and should be treated as such.

Sounds nice but how it would be possible to prove that owner of the device attached it to vehicle? You would need to have video recording with clearly identifiable person, otherwise owner can simply say that she lost AirTag and someone did a dumb joke and attached it to the car.

Are people against the idea of GPS trackers?

Lightbug uses GPS and has a 6 year battery with a size smaller than a credit card. Ultimately there's no way to put the cat in the bag.

I'd argue it's not possible for a tracker to exist that cannot be used for bad purposes.

Arguably AirTags raised the awareness that you can pretty trivially plant a tracker on someone's bag or car. But given that the technology exists, I'm not sure what everyone outraged expects to happen. Being able to track things and people (with their permission of course) is actually genuinely useful. So it's not reasonable (and of course ultimately unworkable with respect to nefarious purposes) to block this technology.

It’s about the logo on the device. It drives clicks and ad impressions when you write about apple so people are influenced to feel more outrage about them.

Wow! This is a Hollywood-level tracker.

Smaller than a car keyfob Absolutely tiny at just 56 x 37 x 12.9mm, it can fit almost anywhere Plus it weighs almost nothing! (35g) And the battery lasts a month.

https://thelightbug.com/

On the Apple help site, it says you can disable an AirTag that is following you:

> To disable the AirTag and stop sharing your location, tap Instructions to Disable AirTag and follow the onscreen steps.

If I’m understanding this correctly, this means you can defeat this type of stalking easily. On the other hand, this makes AirTags less useful for tracking stolen items, as presumably the thief will disable it.

https://support.apple.com/en-gb/HT212227

Or if the thief has an iPhone they will be notified that the AirTag is tracking them. This is not an anti-theft device and anyone who thinks so will be disappointed. It is a device for finding your own stuff that you have misplaced or forgotten about.

I'd suspect the person who eagerly discarded the evidende

this is hardly a new attack when GPS trackers existed before

The impression most people have is that this is highly available, small, easy to use, cheap, and there is plausible deniability in the intention of purchasing one.

Now, there may be other solutions with some or all of those qualities to varying degrees, but the simple fact that the impression is popular necessarily means that it will see usage in cases where the perpetrator would otherwise not have committed the act.

In other words, "this isn't new technology" is a true but not terribly relevant sentiment.

It is indeed an impression problem. Doing this with LoRa for a lower price has been possible for a very long time and you don't even need a large network for that due to the significant range. Basic triangulation built in to friendly software using existing radios and then simply getting closer with a hand-held transceiver isn't exactly hardcore hacking either. And with the low entry cost and non-detectability by practically any target it's a way worse issue than AirTags or Tiles could ever be.

AirTags are trivial to use and have an extensive tracking network in the form of every iDevice.

Custom or semi-custom battery powered LoRa trackers have lesser batteryluve, are bulkier and much harder to get and deploy.

Basic triangulation is easy-ish, but requires multiple sites or a moving site to work toany degree. And those sites need to hear the tracking beacon.

What I was writing about isn't theory, but is used in the form of pet and wildlife trackers. Networks already exist. Most of the older ones are usable as well using UHF trackers. None of this is new, it's just that 'the bad guys' mostly get caught using bulky SMS-based GPS location transmitters and now AirTags.

Go on Amazon and search for 4g gps tracker. Cheap, small, easy, cellular connected gps units with no way for anyone to detect them, unlike an AirTag.

What is probably true, at least based on the few anecdotal stories that have made the rounds, is that the introduction of AirTags may well have planted the thought in some people that "Oh, it's pretty easy to track someone/something with this cheap device." One can also imagine people making up stories (not saying that's the case here though it's very possible) and people planting a tracker for the lulz to see what would happen.

In the infosec space at least, commoditization of an attack tends to increase its prevalence.

Cost (very low) and ease of use make this different.

How so? You can get GPS trackers for less than an airtag

Most GPS trackers however need a SIM card, which would be traceable.

To what? A point of sale? AirTags can be tracked to where they were sold as well in the same way.

Some countries might have some sort of construction where you need to provide some form of identification but that only applies to the most obvious avenues to buy a SIM-card for the public. It's not like the shady MFA-farms with the 100-modem appliances are fed by a person actually buying 100 SIM-cards without getting caught or something like that... (and then there is false identification which often is a crime by itself but misbehaving persons might not really care about that)

AirTags in this case are just blamed because they are actually detectable by normal users, and that makes it an 'impression' problem, not a new problem.

No - you buy a burner phone at any convenience store, using cash, pop the sim card out of the phone, and put it into the GPS tracker.

And AirTags even alert those (iPhone users) being tracked so they are even less practical

Except for the folks who aren't iPhone users, which is the majority of people.

I've been using AirGuard on my Android. It's FOSS. Available on Play.

https://github.com/seemoo-lab/AirGuard

Apple released an app for Android users to alert them if an AirTag is “following” them: https://www.cnet.com/tech/mobile/android-users-get-this-appl...

There is now an app called „Tracker Detect“ from Apple (for Android) to search for AirTags around you. It hasn’t the ability to use AirTags like on the iPhone but at least you can find one that has been left around you.

Maybe some sort of audible alarm could be in order. Let say every 1-4h hours.

> which is the majority of people.

Depends on where you live. I live in a fairly affluent area, and everyone has iPhones.

Has anyone got the same kind of alerts with AirPods 3/Pro? This is a recurrent issue while hanging out with SO, friends and family and the only devices that we believe carrying are those AirPods.

I think so, it depends on the firmware version and if you activated it as a 'thing' I think. I have one pair that does it and my significant other has one that doesn't but it's not being used as actively and not in Find My either.

This is a GPS tracker that can tap into a world-wide Wi-Fi mesh network supported by the richest company in the world.

I suspect this has a lot to do with apple raising awareness of tracking capabilities. I'd love to know if other forms of this attack increase as a result.

When tweets or news articles like this get popular, I can't help thinking this has a Streisand effect. Crazy stalker people who didn't know they could do this now know they can.

I just installed AirGuard to help prevent this attack... It is available on F-Droid: https://f-droid.org/en/packages/de.seemoo.at_tracking_detect.... Hope it works as advertised... time will tell.

Number of times I've had a true positive alert from Apple's new device tracking notifications: 0 Number of times I've had false positives due to intermittent connectivity issues with my airpods or from my partner using mine: over a dozen. I'm this close to disabling all of these features

AirTags seem to work reliably.

Everything else? I had my iPad in the backpack I was wearing get left behind. Same with my AirPods. I’ve turned those things off and just put an AirTag in my backpack.

That said, I already had two extra air tags since I got a four-pack instead of buying two separately.

This is a general problem with proactive alerts related to rare events. How many "OMG, you're separated from $X" alerts am I willing to put up with for the one legitimate "You just left $X in the restaurant!" alert.

It's always worth mentioning that you can create your own custom tracker device that uses the Find My network.

https://github.com/seemoo-lab/openhaystack/

Help an ignorant person. Wouldn’t this kind of alert let a thief know that whatever they stole has an airtag attached to it? I know it’s probably not marketed as an anti-theft device, but isn’t this anti-stalking measure also a ”pro-theft” measure?

Is it me, or this AirTag did not have its battery connected? We see this thin paper/plastic separator on the photo.

Moreover, don’t these alarms start after some hours after being away from the owner?

The picture is provided as an example, since the removed AirTag was discarded.

The photo is an example.

Just you

Maybe Apple should allow anyone to locate an AirTag by sound, once it's determined that it's following that person.

Edit: it already works like that, seems like Apple thought this through

Air tags can be persuaded to emit a sound, but they can be modified to prevent it.

> persuaded to emit a sound

please explain your choice of word, an AirTag is not a person, you don't persuade it

The correct word is coerce. AirTags can be coerced into chanting an audible sound.

Woman: has something bad happen to her.

Everyone else: gaslight her to infinity or straight up call her a liar.

Not saying it did or didn't happen, but this thread is super toxic.

If it becomes widely known that you won't be believed if you destroy all the evidence of something maybe people will do otherwise in the future.

Looks like the Twitter account is now restricted and the tweets themselves are gone? As the kids say, very "sus".

It was a mistake to throw away the tag. They could've used it (together with police, perhaps) to track down the offender.

This seems plausible:

People at bars are single.

Track their vehicle to their house / apt.

Later, know when vehicle is not at house (hence no one is home - remember - single person).

Rob house.

https://www.macrumors.com/2021/12/03/airtag-linked-to-car-th...

> Rob house

that's not the only possible outcome here

It is a much more likely and sensible (for the bad guy) outcome though. There are so many more people out there that want to rob someone than want to rape someone. Especially when the target is a stranger.

> much more likely and sensible (for the bad guy) outcome though.

I don't know. it could be but bad guys aren't exactly known for being sensible.

"Crime is not actually caused by evil. Crime is caused by systemic disenfranchisement and poverty and lack of access to job opportunities."

Which is to say that most crime is about money.

it's not even the worst one i thought of

Somewhat unrelated… if you drive to the bar then you can’t drink surely?

It's pretty easy to track your drinks and be safely under the limit for driving.

In my country the rule of thumb, for men, is Two standard drinks in the first hour, and then one standard drink for every hour after that.

Well thank goodness blessed Apple are so virtuous and privacy focused, otherwise this would be a real shit-show.

By design AirTags don't provide any information that is useable by apple

it might have been law enforcement. they might be using this to track potential drunk drivers (i am not saying you were drunk driving or anything) but i do know there was a few articles on it this year, here is one i found

https://www.macrumors.com/2021/07/19/police-find-unexpected-...

or it could be worse and you could have a unhinged stalker on your hands. both are intrusive.

but it’s hard to say, is there a way to find out the owner or look at log files to see what op or which provider is accessing the location details of a tag? i know about these tags but i’ve never used one before so understanding is fairly fresh

It's baffling how Apple on the one hand claims that user privacy is the most important thing to them, but on the other hand they built an anonymous tracking network that can be abused for many nefarious purposes, and everyone who has an iPhone was made a part of the network whether they like it or not.

There are so many things that are questionable about Airtags. Another way to abuse it would be for example, you could place an Airtag somewhere on an iPhone users driveway, and use it to determine when they arrive home by checking for pings. The victim won't even see a notification, since the Airtag is stationary.

Preventing attacks like this would require the victim to know where to opt-out of Apple's tracking network, a setting that Apple hid by giving it a confusing name ("Network & Wireless") and shows a warning that your phone won't work properly anymore if you try to turn it off.

(Also, turning that setting off presumably also turns off the Airtag warning? So you are trading one risk against another?)

How is this is any way an anonymous tracker?

The police could get a subpoena for Apple to divulge the iCloud account, credit card, and phone number of the owner of this AirTag. Using air tags to conduct illegal activity is stupid.

Huh, right, with all the talk about the privacy preserving location sharing, I missed that Airtags have a serial number that Apple can look up.

However, my main criticism (that Apple customers were not asked whether they want to participate in a network that may indirectly reveal their location) still stands.

The find my network is designed so that it does not directly or indirectly reveal location of the primary device or any intermediaries to apple

But anytime it sends a ping, it reveals the fact that an iOS device is near. If it's a public place where lots of different people pass by, then that information doesn't identify anyone. But if you place an Airtag at a private location, eg. near someones home, you can use it to detect when the people living there get home.

Now maybe you don't worry about side channels like this, but I really think that it should be up to the individual user to decide whether they want to risk something like this or not.

It's quite telling that Apple does not ask people to opt-in to the Find My network, while every third party app needs explicit user permission for any kind of Bluetooth access.

> Another way to abuse it would be for example, you could place an Airtag somewhere on an iPhone users driveway, and use it to determine when they arrive home by checking for pings. The victim won't even see a notification, since the Airtag is stationary.

You can hide an arbitrary device near a victim's driveway and your choice of surveillance device is an Airtag? Come on.

Reply on news.ycombinator.com