Hacker News Reader

The default is to only accept transfers from people that are in your address book.

If I understood their paper[1] correctly you can just use a popular phone number that a person walking by is likely to have in their contacts, like an emergency line number.

My mobile telco's SIM comes with a couple of contacts on it like their customer support line. I don't know anything about AirDrop, but I assume this will work.

[1]: https://www.usenix.org/conference/usenixsecurity21/presentat...

As far as I understand the protocol, you'd need a certificate signed by Apple in order to be able to masquerade as that contact in somebody's contact list, and Apple only signs these after phone number or email confirmation.

> We support contacts-only devices by using extracted AirDrop credentials (keys and certificates) from macOS via our keychain extractor.

This should make it clear that you can’t just claim any phone number or email address.

Reply on news.ycombinator.com