Detecting Unwanted Location Trackers | Hacker News Reader

Detecting Unwanted Location Trackers

datatracker.ietf.org

69 pointsdevadvance15 comments

As this is an IETF doc, it's available in multiple formats. For those reading on a phone, the 'htmlized' format is probably easiest:

https://datatracker.ietf.org/doc/html/draft-detecting-unwant... (This is NOT a suggestion to replace the story link, as from there you can get to the docs GitHub, mailing list etc)

Others can be selected at the top of the main link. This seems to be the second rev of a draft.

(Having now read it)

One interesting point is that non owners get to disable locators if they are moving with them. Which makes sense to allow people to disable hostile trackers, but it also means a thief can disable it. May be the right call, but it does mean a ready market for noncompliant devices will exist unless this is put into law

This seems dead on arrival to me. The feature provides no benefit to end users, but severely reduces the legitimate functionality of the product. (For instance, this makes the products useless for preventing luggage theft.)

At the same time, even if 99.9% of trackers have this built in, it still won’t prevent malicious use cases.

Anyway, I’m hoping it will be dead on arrival, but I fear that corrupt law enforcement organizations will try to get this mandated, since it will let them continue to steal luggage, and avoid dealing with people that would like their stolen items to be recovered.

Depends who you call an end user. These devices can't do anything on their own, they piggyback on the network of nearby phone users. If one is tracking you, it's likely using your phone, even if the actual owner is a stalker who's trying to figure out when you are in a secluded spot. Arguably, phone owners should get some kind of say in how this works.

>Arguably, phone owners should get some kind of say in how this works.

You as the phone owner can refuse to relay the tracker, but you shouldn't be able to disable it

If one is tracking me, you’re right, but the probability of that is low.

If one I own is tracking someone else, either they know it, and are OK with it, or they stole my stuff. The probability of this is at least 100x higher.

The vast majority of the market are people like me, and (unless they outlaw fleet management equipment and stolen property trackers) the criminals can and will be able to buy things that are better for stalking.

Edit: By better for stalking, I mean these trackers probably have battery lives measured in months, not years, and probably aren’t rated for being magnetically attached to a wheel well or vehicle undercarriage. I doubt they even have an option for wiring into automotive 12V. On top of that, they’re not going to provide the stalker with high time resolution traces of where they’ve been for the last year.

This is the official joint proposal from Apple and Google. The problem is there is an irreconcilable conflict of interest between the needs of people who use trackers like AirTags for anti-theft purposes, and thus need them not to be detectable or possibly disabled by thieves, and the needs of people who are stalked to identify and disable trackers they don’t control. I don’t see how the conflict can be resolved, other than allowing only police to do that, but it would be very cumbersome for victims of stalking.

Also, since Apple’s Find My network is open to third-party manufacturers, unless they have some authentication mechanism, there is nothing preventing a manufacturer from defecting and implementing a tracker that uses the network, is not detectable by not having a beeper, but still implements the rest of the protocol to be locatable.

This is a perfect example of the road to hell being paved with good intentions. Cheap, fit for purpose tracking equipment has been available since the 90s and only become more capable.

These consumer grade air tag and tile devices are a practical way to track all your things, but allowing people to disable them or even alerting to their presence kind of defeats the purpose.

How would it work if my tracker is with me on a train with 20 other people in close proximity for let’s say 5 hour trip? Would they all get warnings about my tracker that I am using for my own keys and also get to disable it?

In this RFC's terminology, in that case your tracker would be in near-owner mode, and not trigger those alerts. If your phone was turned off or out of battery, then yes then the other travelers would get warned about your tracker.

https://datatracker.ietf.org/doc/html/draft-detecting-unwant...

Alternatively, there's a ready market for bags that are also Faraday cages.

That doesn’t help if you don’t know you have a location tracking device on you or in your car. This specification is about detecting unknown trackers.

I’ve only read parts of it, but it seems like it’s trying to formalize the behavior that AirTags and iPhones already follow so that all phones (Android) can alert you proactively when an unwanted tracker is traveling with you.

Couldnt a moving faraday cage act as a tracking beacon?

Subject of interest to specifically pop up on cams.

I was thinking the faraday bag could show up as a black negative spot on the back of an otherwise moving human assuming one were using the WiFi signal vision trick.

https://www.youtube.com/watch?v=qkHdF8tuKeU

How would you detect and track somebody with a faraday bag?

I think they’re assuming always-on fully body scanners like the TSA uses. Real time nude video feeds of the whole planet are the only thing protecting us from terrorism and stuff.

Before they implement it, they’ll probably need an excuse other than “Think of the children” though.

https://www.youtube.com/watch?v=qkHdF8tuKeU

Have you seen Aza Raskin talking about it?

Reply on news.ycombinator.com