Hacker News Reader

Comment by verdverm | Hacker News Reader

Are they less prone to stalking? All I see is generic corpo "industry security" verbiage

It looks like the anti-stalking mechanism remains the same: if your iPhone detects that a non-paired AirTag is traveling with you you'll get a persistent notification about it.

I've seen these myself for my partner's AirTag when I was carrying her stuff.

Apparently Android 6+ can warn you about AirTags in the same way, since May 2024: https://www.apple.com/newsroom/2024/05/apple-and-google-deli...

The way Find My has been built, it doesn't really matter what they do with the tags, it's fairly straightforward to build your own tags, or modify tags, that bypass any stalking detection.

A phone's stalking detection just looks for a tag that's not yours that has been around you for a while.

But you can modify a tag such that it selectively powers up, or build a tag that changes identifiers, such that the stalking detection tools don't pick it up.

I've written a bit about this here: https://www.hotelexistence.ca/further-thoughts-on-stealth-ai... https://www.hotelexistence.ca/exploring-bluetooth-trackers-a...

There were rumors that this version makes the speaker harder to remove (I remove the speaker from the previous version when I put them in my own cars & motorcycles to make them harder to find). Looking forward to a teardown...

The most stalkable users are android users, but even that it's going away with newer androids. And it already beeps when you move it if it's been away from the owner for too long.

I know because I have an android phone and a not-so-used ipad and mine beep all the time.

What stalking scenario are you worried with?

Have you not seen the stories? Put one of these on the underside of an ex's car

How does that avoid the Android/iPhone unknown AirTag warning features?

And it would notify your ex that you did so, no?

Apple has already done more than enough to discourage stalking. We shouldn’t nerf all our technology to the ground because assholes exist.

It's too late when they are notified. The last known address is where the victim is at.

The perpetrator has to already find the victim, and physically be there, to put the tag on the car

Meeting could happen in public, it doesn't mean they know their private address.

For example, meet someone at a convention/fair/job, gift/sell them something which has a hidden tag, and then wait for them to drive to their hotel, or home. Gotcha. With influencer and celebs, you can also send something to their agency, and hope they are re-routed to their home. S** like that happened quite often until people learned to be more careful. Probably still sometimes happens even now.

I'm sure idiots do this but it's a pretty high risk way to try to track someone. IME the tracking notifications are timely enough that you're going to have a good idea where they came from. Actual GPS trackers are cheap on Amazon, have better accuracy, and don't notify people they exist -- they just don't have the public's mindshare nearly as much.

On the car, not on the car at the victim's house.

Or the much more, frankly common, scenario is: a $15 plushie bought through Amazon wishlist, sold by PerpOwned LLC for $500, and delivered through Amazon warehouse. That's actually happening.

I don't know why anyone with a budget would choose to use an Airtag that notifies nearby iPhones and makes noise when you move it around. If Amazon lets you ship arbitrary items to people's private address, that sounds like a vulnerability with Amazon that is far more severe than simply shipping Airtags.

Isn't it easy to disable the speaker?

“Easy” in relative terms for people who hack on electronics. Even if you remove the speaker, modern phones will tell the victim that someone else’s AirTag is moving along with them, unless the owner of the AirTag is also present.

Not sure about that. My Android warns me about my wife's airtags so often, that if I would actually be tracked by a malicious airtag, I would just assume it's one of my wife's tags. This could be prevented if I could mark a tag to be trusted on my Android phone, but no such feature exists.

Reply on news.ycombinator.com