Show HN: Undetectag, track stolen items with AirTag | Hacker News Reader

Show HN: Undetectag, track stolen items with AirTag

undetectag.com

116 pointspompidoo98 comments

I developed a device that turns an Airtag on and off at specific intervals. Current Airtags are detectable right away and cannot be used to track stolen property. That device allows you to hide an Airtag in your car, for example, and someone that steals your car will not be able to use some app to detect it. The Airtag will also not warn the thief of its presence. After some hours, the Airtag turns on again and you can find out its location. It’s not foolproof, as the timing has to be right, but still useful.

What do you think?

Open articleView on HN

After I saw third-party "10 year battery enclosure" offerings for AirTags, was wondering when other workaround customizations like this might appear.

Other impactful variants might be:

* senses whether another 'sibling' AirTag is present, if so, stays off. If not, waits X hours & then turns on.

* has its own motion sensor; only after X minutes of being stationary, it waits Y hours to turn on briefly

* has its own clock & (original-user-known) randomization seed; turns on at pseudorandom intervals the original user can predict

* low-power/low-bandwidth receivers so cheap & tiny now: could wait for national or even global unit-specific 'wake' request - perhaps even with parameters for duration/intervals – before powering-on AirTag portion

A while ago saw someone who was working in the tracking space said the following.

For stolen items you don't want to track them. You want to be able to ask them where they are. The advantage is you can make a locator that doesn't reveal itself by transmitting. And it doesn't waste power receiving gps signals. You could literally have a device that runs for years on a AA battery.

The reason you don't see these on the market is because the people that fund products want to sell location data.

That's how classic Lojack worked. Lojack is a car theft detection device. It's not GPS based. It's hidden somewhere on the vehicle and connected to power. It listens to FM broadcast radio stations until it finds one with the Lojack subcarrier, something Lojack licensed from radio stations in most cities. It decodes the subcarrier, listening for serial numbers of Lojack units that have been stolen. Then it starts transmitting. It doesn't transmit location, just its serial number. Police cars equipped with Lojack receivers get an indication of direction and distance. Lojack had an effort to equip police cars with the equipment. At peak, LoJack had coverage in parts of 29 states.

It was very effective. 98% recovery rate.

> You want to be able to ask them where they are.

Through what presently-existing technology, exactly, is this idea supposed to work over distances greater than at best a couple of miles with say LoRA?

> The reason you don't see these on the market is because the people that fund products want to sell location data.

I'm not equipped to analyse their claims in detail, but Apple claims the design of their find-my network is end-to-end encrypted, and presumably it would be a huge scandal if this turned out to be a massive lie.

It is end-to-end encrypted, yes. The protocol has been widely reverse-engineered and Apple can't actually read your item's location at all. It's pretty clever.

Tile already has this feature. You need to pass verification to use it, but it stays undetectable. However, if you got caught stalking somebody you have to pay $1M fine.

It’s arguably pointless.

> despite the absence of the device on Tile’s app, it can still be tracked and located through other means available on the device.

> Tile Tracker with Anti-Theft mode has a static Mac-Address, which may make it even more trackable

https://techryptic.github.io/2023/03/11/Tile-Anti-Theft-Mode...

Also, tile has a really useless network. I marked mine lost and carried it through a busy city for a month until it got picked up :P

It's probably because the only people using the app are those that bought one and they're not very common here in Europe. With Apple's, Samsung's and Google's network most phones report them. Not just those of the people who own a tag.

Half-related question: the chip on the board looks like an STM32 microcontroller, wouldn't a 6-pin 8-bit PIC10 or similar µC be sufficient and cheaper for the purpose? And possibly use less power, a PIC10F322 in sleep mode with the watchdog timer enabled is around 0.5 µA, while a small STM32 is more in the 100 µA range in the best case.

Probably. Or something like the TPL5110 might actually suffice, purpose-built timer for power gating at 35nA, but only goes up to 2hr at max.

Nice, didn't know this one! This combined with a PIC10 without watchdog timer might also be an interesting combination to do more complex things. Or perhaps simply a TPL5110 with a ultra-low-power flip-flop (does it even exist?) used as a divider to get to 4 hours.

I was wondering why an MCU with so many pins was used. Maybe it was picked for the total package height?

Wouldn't this also greatly reduce the reliability of tracking, especially in rural areas where there might not always be a Find My network device nearby?

In rural areas you're always better off with gps+lte+LoRA tracker anyways.

Yes, unfortunately it would.

I think you should put an accelerometer on it, and only enable the tag a minute or two after it's completely stopped moving. That reduces the likelihood of an "it's following you" notification, as it's not really following you.

Add a normal tag so that the thief can find it.

Problems: if the thief steals your item while the AirTag is on, they can find and disable it.

Have you experimented with a setup (more complicated to package) where you have two AirTags and alternately power one at a time? Could that bypass apples detection whilst also broadcasting location?

Edit: at sufficiently small time durations to run under apples detection radar, but for long enough to be picked up as a location

I don’t know how Apple detects the tracking; this would easily be solved by them.

Yes I think having 2 is a good strategy. I'm also considering offering different timings in the future.

> Events outside our control, such as Apple updating the firmware in the future to prevent the device from working

There are several much cheaper nock offs that inherently will never update the firmware. Why not support those? And just to be sure, offer a package deal, include such tracker.

If its not foolproof, how do you provide any peace of mind that this actually works? Where do you get your 95% number from? If the stolen item isn't able to be found (ie the airtag was removed), do you provide some refund?

AirTags aren’t meant to get stolen items back. That just isn’t the use case. How does this compare to actual GPS trackers like https://monimoto.com/?

That device you link to is more expensive but would never alert the person being stalked, so I suppose that might justify the price.

It's about 10x the size and 4-5x the price.

Probably worth it for a vehicle, but maybe not for a backpack.

Very cool idea, and I love how compact it is!

My only feedback would be re: the site, specifically this part:

“ Airtag is a trademark registered by apple and we have nothing to do with apple.”

Might want to capitalize Apple; just a nitpick.

Good catch! Thank you I will correct it now.

So glad you built this. I thought of this about three weeks ago, and wanted to try the concept out. Now I can just buy it.

A poor workaround to a problem created by unnecessary restrictions. Stalking is already illegal, so why are the tags crippled in the first place? This "feature" severely limits the usefulness of tags for tracking stolen items. Why not just sell some tags that don't alert everyone to their presence? Police and intelligence agencies have those already, so who are we protecting?

> Stalking is already illegal, so why are the tags crippled in the first place?

I assume because it's a network that relies on its reputation among participating nodes to trust it will not be used to track them involuntarily, else they would opt out and collapse the network.

On a related topic, I've opted out of Google's BLE tracking/repeating feature. Apple provides no way to do this. The extra battery drain is significant and measurable, and I did not sign up for this when I purchased my devices.

https://support.google.com/android/thread/284190689/how-to-o...

You can disable it on iPhone by:

Go to: Settings → your name → Find My → Find My iPhone

Toggle “Find My network” → OFF

It should be noted that this will also disable your ability to find your own airtags.

Turning this off doesn't necessarily stop your phone from participating in the "Find My" network, it just prevents your items from being seen. Your phone will continue to relay BLE/UWB traffic for others, and run down your battery more quickly.

Turning off Bluetooth seems to disable the traffic, but then you can no longer access your local Bluetooth devices.

This is wild, but it seems correct, none of the documentation I can find mentions opting out as a sensor that will pass data to Apple. On the other hand, on my Mac no apps are granted access to Location Services, which includes Find My. I don't have an iOS device but it seems like maybe you'd have similarly granular control?

If they are forcing you to transmit data, then it might make even more sense that Apple would steer clear of usage that could create liability for their users.

>Turning this off doesn't necessarily stop your phone from participating in the "Find My" network, it just prevents your items from being seen. Your phone will continue to relay BLE/UWB traffic for others, [...]

Source?

Breaking and entering is already illegal, why do people sell locks?

Locks keep the dyslexic realtor from showing my house to people interested in the neighboring property.

yeah, but they do nothing to stop a locksmith in a fugue state from rekeying all the bolts to match the neighboring property and vice-versa, and then the realtor can walk right in, and you're locked out!

so it's better to just leave the door open.

You’re proving the other persons point - the reason why the a thief doesn’t trivially pick locks isn’t because of the lock, it’s because it’s illegal and there’s a consequence.

Yes it's illegal and there's a consequence but do you care about it after you've been robbed?

You could say the same with a lock. Do you care once it’s broken?

The point of a lock is that it's something to break. That takes skill and visible equipment. The more skill yoo require the more likely the smart guy would do better things to earn money than crime. the more visible equipment the easier it is to track.

consequences for doing something illegal never stopped me from picking a lock, actually. they've only stopped me from stealing

Like tags, locks are also deliberately encumbered so that locksmiths and law enforcement can easily defeat them.

https://www.youtube.com/watch?v=s5jzHw3lXCQ

Are there people out there who sell locks that aren't purposefully bad?

People like Microsoft?

https://www.experts-exchange.com/questions/28691191/Why-did-...

EDIT: Like in the hotels, you got a key for your room, but the hotel management has a "passpartout" key (for back in the day when we had physical keys). The phrase "<thing> must accept interference, but not cause any". So you/we must be able to receive the 'punch' and not resist.

you ask great questions about power! and yes. though you'll generally find the lock isn't the interesting bit, reinforcing the door frame and door and putting pins at the top/bottom and side is how its done.

otherwise 25 dollars at TSC for a fence post driver will make 95% of residential entryways irrelevant.

That video makes no suggestion that the locks have been deliberately sabotaged. The theory in the video is nothing more than that the company is incompetent at making locks.

Can the time interval be changed by the user or is it hardcoded? What are the limits if they can be changed?

hardcoded, but I'm thinking of offering different time intervals in the future

> offering different time intervals

your previous response to the stalking concerns was "it's 4 hours off / 1 hour on, the device is not very suitable for stalking someone"; wouldn't this comment - allowing that to change - then make it even easier for stalkers?

Well it would warn the person that they are being tracked when the airtag turns back on, so I feel like any other tracker would be better suited for stalking people, and most of the time it wouldn't even track.

interesting project

> Events outside our control, such as Apple updating the firmware in the future to prevent the device from working, will not qualify for a refund.

I fully understand why you would want to do this, but as a consumer I would never buy this product with this clause.

I understand your point. In this case the price point makes this a bearable risk, especially to protect much more valuable items. A refund is only useful if only a certain % of people have issue or the company is big. Since this is my only product, an Airtag update that bricks the devices would just bankrupt the company and make me unable to refund most people as my margin is very low anyway.

I was thinking that the price must be high if folks are worried about it not working and getting a refund.

For 10EUR, not only would I not worry about a refund but now I’m buying one or two to use myself on my bicycle and car.

sure but you've acknowledged that your product is something that Apple considers bad and could shut it down. that can usually be overlooked for things like emulation, but you've developed a product that does something Apple specifically added protections against after they learned of its dangerous misuse

> sure but you've acknowledged that your product is something that Apple considers bad

No. Everyone that builds projects inside someone else's ecosystem is subject to this. Even companies that like what your are doing might break it if they aren't specifically testing against your product.

That does not read as "something that Apple considers bad" but rather "something that Apple COULD consider bad"

A reasonable solution would be to get to buy the newer model half-off if this happens. Obviously the maker can’t just have his entire biz nuked with refunds if Apple happens to update firmware.

I think you have your priorities wrong. Why should an unsustainable business be prioritized over consumer benefit?

Nobody has a right to a successful business but when consumers can trust their purchases they are more likely to make additional purchases.

I felt like adding that disclaimer was a nice thing to do, informing the customer and letting them make their own decision. It makes almost no difference to remove that disclaimer (well, it would increase sales). it is not to protect myself. The price is very low and margin is very thin, what happens if Apple bricks the device? There would be very little money left to refund the customers, and most of the refunds would be eaten by transaction fees. Is it worth it for the customers to receive a few cents back? And that's assuming I keep all the money in the company and don't pay myself.

Agree that the transparency is nice but the limitation it mentions disqualifies the product for me.

The lack of trust in the purchase comes from Apple, not from this seller. It's apple that's reaching into your device and force updating the firmware without your consent.

No. The product in this case relies on unintended functionality in a specific firmware version of an Apple device that is specifically designed to not be suitable for this application. In this case it is the add-on device that is not offering refunds if it stops working.

Yes.

> if it stops working.

It doesn't magically stop working though, it would be apple explicitly putting in effort to break this functionality and forcing you to update a device you own, forcing you to use it only how they want you to use it.

https://xkcd.com/1172/

It doesn’t require Apple deliberately breaking this product. They could change the required functionality for an unrelated reason.

Where do you get the idea that Apple specifically designed the AirTag to not be suitable for a third party device to control when it switches on and off? I can understand how they might not approve of this adaptation to their product but I don't see any reason to believe they specifically designed against it.

The AirTag is specifically designed to not be used to track people without their knowledge.

Is that why it released it with built in integration in android so that android users automatically are notified of tags following them?

Or is that why the tag flashes and makes sounds frequently so that people without phones can know they’re being tracked?

You have also developed a device that allows people to use AirTags for stalking.

This. Normal AirTags are just fine for tracking your stuff.

> "(thiefs use apps to locate AirTags around, and AirTags will warn the thief if an unknown AirTag is travelling with them, for example if they steal your car)"

The reason this was introduced is exactly because people used AirTags to stalk others. Advertising that your product turns that off is basically targeting that specific demographic.

That's true. But the advertised use case (tracking stolen items) is perfectly valid.

> The reason this was introduced is exactly because people used AirTags to stalk others.

There were anti-stalking features from the start. It didn’t stop the media hysteria however.

As it's 4 hours off / 1 hour on, the device is not very suitable for stalking someone. Also once the AirTag is back on and the person starts moving, they will be alerted that the AirTag is tracking them.

That’s perfect for finding out where someone lives. Drop it in their bag or jacket at a concert/bar/work/whatever-in-the-evening, and the place they’re likely at in 4 hours is their home.

Not trying to be creepy, I’m just trying to demonstrate how we all need to think like adversaries (eg creeps) when designing products.

You can probably find out where they live from knowing their name. This application is not a high level of stalking.

The concert/bar example allows stalking without knowing someone’s name.

> not a high level of stalking

imo no level of stalking is appropriate. while this device might not do everything a stalker wants it to, it surely makes it easier for them

That's not true in all scenarios.

I once donated an infant car seat to a coworker but forgot I had put an AirTag on it. After she had taken it home, her iPhone told there was an unknown AirTag and she texted me. I apologized profusely and she wasn't bothered by it. Nonetheless had I been nefarious, I would have been able to get her home address.

AirTags are already that. There's videos on YouTube on how to disconnect the speaker that allows AirTags to warn the stalking victim.

Reply on news.ycombinator.com