Hacker News Reader

Comment by MForster | Hacker News Reader

Can somebody explain how the stalking actually works? As I understand, the wireless technology is short-range? How does the stalker know where the tag is if they're not next to it?

View on HN

You know how in modern iPhones they don't let you disable bluetooth from the pull-down menu anymore? Instead it just says "disconnecting devices until tomorrow". That's because Apple really doesn't want you to ever turn bluetooth off. And that is because all iPhones are part of their location botnet. So if you ever pass by someone else's airtag, your phone will send a message to Apple that it has seen that airtag at your current coordinates.

Also, Apple re-enables Bluetooth on OS updates even if you disable it in Settings, and Apple says this functions as intended. https://lapcatsoftware.com/articles/bluetooth.html

As a user I absolutely prefer a quickly accessible "turn off bluetooth until X" button to a "turn off bluetooth forever" button. Same with the WiFi.

But the current bluetooth and wi-fi buttons don't turn them off at all. They just disconnect your devices while still broadcasting. They're still using power, updating airtag locations, and serving as a beacon that physical retailers use to identify you and track how you move through the store.

As a user I absolutely prefer freaking "turn off" button for both wifi and bluetooth.

iPhones (and by that I mean any iPhone, not just the owners) pick up the signal from the tag and send its location to cloud.

So basically iPhones are now pretty much the biggest surveillance network in the world, constantly reporting on location of tags (and other iPhones) to Apple servers.

Apple’s servers can’t see where the tag is. The location data is encrypted so only the owner of the tag can read it on their phone.

What were they called in deepness in the sky ?

The localizers ?

Yes.

For others' benefit, Vernor Vinge's A Deepness in the Sky depicts a human interstellar civilization thousands of years in the future, in which superluminal travel is impossible (for the humans), so travelers use hibernation to pass the decades while their ships travel between star systems. Merchants often revisit systems after a century or two, so see great changes in each visit.

The merchants repeatedly find that once smart dust (tiny swarms of nanomachines) are developed, governments inevitably use them for ubiquitous surveillance, which inevitably causes societal collapse. <https://blog.regehr.org/archives/255>

They don't need to be next to it, any iPhone nearby the tag will report on it. https://en.wikipedia.org/wiki/AirTag

And the iPhone will share that information globally without asking for permission? I can see how that is a privacy concern.

It's opt in.

So, enough iPhone users opt in to surveillance to make this a globally useful method for stalking? Wow.

Enough users opt in to help other people find their forgotten keys :)

That is an incredibly bad faith interpretation of what’s going on. I don’t have to cite statistics to know that users aren’t “opting in to surveillance” - that’s the clickbait version lacking any nuance. In reality, Apple has built up enough trust and good will with their customers that they not only gladly enable a feature that makes it possible to retrieve lost or stolen items, but they even pay for these aforementioned AirTags.

Whether or not that’s wise is another matter, but come on - don’t blame the victim.

Sorry for coming across as using bad faith. It's just that I didn't understand the overall model. And the article didn't explain it.

Also, I wouldn't blame the victim. I'd rather blame Apple for making their users opt in.

Fair enough! Thanks for clarifying.

As opposed to what? Opt out?

As opposed to not linking "find my phone" to "find AirTags".

They are separate. Under the "Find My iPhone" setting there are separate toggles for "Find My iPhone" and "Find My network".

If you enable "Find My iPhone" but do not enabled "Find My network" you can only find your phone when it is online.

Enabling "Find My network" to make your phone participate in the "Find My" network lets you potentially find your phone when it is not online.

Same with "Find My iPad".

Sorry for getting the terminology wrong. I don't use iPhones.

I meant coupling the "Find My network" feature for iPhones and AirTags.

It's not really coupled. It's more of a quid pro quo relationship.

There are two separate "find lost things" systems.

1. There is a system for finding online things. This is available on devices that have internet connections, and can only be used to find the device when it is online. The device uses its internet connection to report to a central server, which can then tell the owner where to find the device.

2. There is a system for finding things that aren't online. Devices that do not have an internet connection can use this system to let nearby devices know they are there. If those nearby devices have an internet connection, they can relay that sighting along with their location to a central server, which can then tell the owner where to find the missing devices. The relay to the server is protected by some clever public key cryptography so that the server doesn't find out whose device spotted the missing device or where it was.

An iPhone is capable of using both of those systems. There's a toggle for each of them in the settings.

If you want to be able to find your missing iPhone when it is offline you need to use the second system. If you only need to find it when it has an internet connection, you just need to use the first system.

It seems pretty fair. If you want to use other people's phones to find yours when it is offline, you have to let them use your phone to find their offline devices.

The apple user is the enabler not the victim. Without that person this could never happen.

There is no opting out of your own iDevices from reporting others’ trackers, right? I do not want to disable Bluetooth on my iPhone in order to opt out of participating a global panopticon.

You can opt out, but then you do not get to use others' iPhones to find your AirTags. If you want to benefit from the network, you have to contribute, but you don't have to participate at all.

You have some answers but what makes it extremely juicy is that if effectively is the same as a tracker when the person who stalks you knows you have an iphone.

If they throw it under your car for instance, your phone will always show where your driving and you most likely will never hear any chirps coming from it.

Except you will soon get an alert that an unknown AirTag is following you.[0]

Even if you don't have an iPhone, as soon as someone who does have one steps into your car and you drive them somewhere, they will get the alert and you will find out.

[0] - https://media.npr.org/assets/img/2022/02/16/airtag-found-mov...

The AirTags form part of Apple's "Find My" network.

https://en.wikipedia.org/wiki/Find_My

tl;dr Apple devices broadcast IDs and then other Apple devices phone home with those IDs and GPS locations so the owners can find their lost devices even if they don't have internet connectivity.

Does that mean all Apple devices phone home about everything found nearby all the time?

If the user opted in to use the Find-My network, yes.

Most of users want a way to find / lock / remotely wipe their 1000$ phone in case it gets lost or stolen.

Ah, so Apple is linking the feature of finding _my_ phone with reporting on lots of others? That explains why people turn it on, but I find that creepy.

The technology is also built so that the location is encrypted for the device owner - so Apple doesn't have a database of the location of every Apple Find My enabled device in the world, which for me makes it not creepy - my devices can find my devices.

It's really useful for locating lost headphones, laptops, etc. -- whether stolen, left on public transport/taxi, or left at a friend's house.

Edit: link to Apple's description of how Find My works: https://support.apple.com/en-gb/guide/security/sec6cbc80fd0/...

Thanks for pointing out the encryption. That changes things a bit, IMHO.

Would have been nice if the article explained a bit what is actually happening. The wikipedia article doesn't mention it either...

I've edited my comment to add a link to Apple's description of the service's approach: https://support.apple.com/en-gb/guide/security/sec6cbc80fd0/...

So when another phone tells apple the id and location apple doesn't have a list of ids and locations?

>apple doesn't have a list of ids and locations?

That's right - you can read more at [1]

1: https://support.apple.com/en-gb/guide/security/sec6cbc80fd0/...

Is there any independent analysis of this end to end encryption of location data, that confirms that Apple can not really access the location even if they want to?

Reply on news.ycombinator.com