An update on AirTag and unwanted tracking
apple.com
apple.com
1) know AirTags exist (many obviously don't)
2) go out of their way to install Apple's Android AirTag scanner app (only 100k-500k worldwide have done so according to Google Play stats)
3) manually open the scanner app and scan, since it doesn't scan passively in the background; and even then, it won't help you find the speaker-less AirTag, since it doesn't tell you proximity & direction.
I continue to think Apple should have never released AirTags to the public, and should discontinue it. It's a very limited income stream, with limited use cases, and significantly increases the average person's risk of stalking.
Practically all positive social media coverage of AirTags involves someone tracking a stolen stolen items (car, bike). Those use cases are dead, since thieves with iPhones will get alerts, and most thieves with Android will know to scan for AirTags. And since most lost items turn into stolen items after a few hours, that removes most use cases involving losing objects in public.
That leaves "finding your keys within your home" as the only truly "officially supported" use case. Is that worth all the problems, and brand damage?
People will argue that stalkers could always buy trackers, but Apple increased their availability, ease-of-acquisition and ease-of-use by orders of magnitude. AirTags are cheaper than competing GPS trackers, most of which require subscriptions.
I remember seeing a chills-down-your-spine Apple Watch Series 7 TV ad, that featured beautiful remote nature landscapes, with the audio of 911 calls made from people's Apple Watches whose lives were saved by their Watch. Probably one of Apple's best and most impactful ad in the past decade. Compare that to AirTag's impact on Apple's brand. Why did Apple even bother?
So for stolen items, it is also useless.
It's not. I've recovered my phone after it was stolen by simply showing up to the house it wandered off to the next morning.
I've done this a number of times for friends (perhaps not really the brightest idea in retrospect) and you'd be surprised at how many folks simply apologize and hand it over when confronted. If they refuse, at least you tried.
Plenty of folks will take matters into their own hands for a $1,000 device that may be a source of their livelihood. Not everyone can simply walk away from that and absorb the loss.
Do these people expect to extort a finder's fee? I just don't think "criminal" enough to understand the value of a stolen phone.
> Plenty of folks will take matters into their own hands for a $1,000 device
I was once mugged at gun point and the 2 guys took my wallet/cash/phone. For some stupid reason, I thought it a good idea to kindly ask for my wallet and phone back by convincing them the phone was several generations older, it would be locked as soon as I returned home, as well as any cards in my wallet being canceled. Also, just to avoid the pain in the ass of dealing with the banks and not going to the DMV for a new ID. The 2 guys laughed, and gave me everything back except the cash. To this day, I don't know what made me think that was going to happen. However, as soon as I turned the corner, I was on the phone with 911.
About a decade ago when El Salvador was more dangerous, cell phone theft at gun point or knife point was more common. And well SIM cards used to be easier to remove from phones.
So the "good thieves" would allow you to remove the sim card from the phone before stealing it from you.
There were also times where the thief would be "pickier" than you, so if you had a very old or a damaged phone they would just give you your phone back after mugging you.
Two tricks were faking an ugly phone while carrying without a battery cover and cover it with duct tape. Or carrying a hidden good phone and a visible old phone.
I work on a busy robbery squad in London and iPhones are absolutely the target, whether they're locked or unlocked.
We can have nice things even if they can get abused, stalkers are going to stalk and have superior alternatives without Apple. These new features are solely intended to scare them off into using their old methods. So if stalkers are going to do what they do anyway, I might as well find my items, thanks.
Edit: Also, in your own point, you say "AirTags are cheaper than competing GPS trackers, most of which require subscriptions."
Has a tracker costing too much ever stopped a stalker? For a creep, the difference between $25 one time and $10-20 a month for a more-accurate GPS tracker is unimportant. They'll pay the price of Netflix to continue their creepiness.
Remember that stalking isn't a profession; it's often a crime of opportunity, with plenty of reported cases of e.g. people slipping GPS trackers into spouses' cars/bags before or during divorces.
Those people aren't sophisticated, and might go on Amazon and see Tiles that won't work (sparse detection network), or GPS trackers that cost the same as AirTags and have a monthly subscription. Or they could just pick a spare AirTag they have, and use that, because they know their spouse has an Android and wouldn't detect it.
Again, the problem isn't that AirTags have been nerfed into uselessness because of anti-stalking protection. The problem is that AirTags still, to this day, present a major Android stalking risk (no AirTags notifications on Android with Apple's app, you have to manually scan), and Apple seems uninterested in doing anything about it (or even promising to do anything about it, since this announcement doesn't mention Android).
It is foolish to underestimate stalkers and stereotype it as just a crime of opportunity.
> "problem is that AirTags still, to this day, present a major Android stalking risk"
Ironically, so did Tile for the last 8 years, and Samsung's own Galaxy trackers for Android, but there is no outcry about them. Also, considering how long Tile has been on the market, this doesn't seem like a new issue. Also, Apple has built-in "Find My Friends" in iPhone. A stalker could just flip that on without telling the person being stalked (assuming he/she is close to him/her), and the phone would be tracking them, no tag necessary. Yet nobody ever hears about this being abused much.
> "AirTags have been nerfed into uselessness because of anti-stalking protection"
Hey, if I lose my wallet in my own home, it's great. If I can't find my wallet at the gas station, I can figure out where in the car it fell. There are plenty of ways it is still plenty useful. Also, if you are complaining about uselessness, maybe Apple should roll-back some anti-stalking protections but you'd be against that too.
This leaves you in the impossible position of wanting Apple to restrict it more (reduce stalking) and simultaneously unlock it more (to improve utility), all while competitors don't bother with stalking prevention at all.
I never said Apple should unlock it more, I said they should discontinue it, and their executives displayed poor judgment in approving the product.
I never argued that AirTags were nerfed into uselessness, I responded to your argument that they were nerfed into becoming useless for stalking, which I don't think is true.
> Ironically, so did Tile for the last 8 years, and Samsung's own Galaxy trackers for Android, but there is no outcry about them
Plenty of people have iPads catching dust in drawers, who would never have bought Android tablets (or any tablet) if the iPad had never existed. It's the power of Apple's marketing. Anytime I argue against AirTags, I argue that availability is a game-changer, and nobody actually tried to address this argument convincingly.
- Someone at a club or rave might impulsively or drunkenly decide to remove the AirTag they use for their keyring, and slip it into someone's pocket. They might never have bought a tracker if Apple didn't have one.
- Again, the iPad-catching-dust-in-a-drawer argument. Plenty of people buy Apple products on a whim who would never have considered that product category if the Apple product didn't exist. iPads popularized tablets, Apple Watches popularized smartwatches (at least among US teens), AirPods popularized bluetooth earphones). Apple's marketing doesn't just increase sales for their products, it promotes the entire product category. People hear about iPad, are interested, and might buy an iPad or a cheaper competitor; when they would never have bought a tablet if the iPad hadn't created a "halo effect". You can argue the effect is less for AirTags, but don't tell me it's nonexistent!
- The copycat effect is strong among criminals. Ransomware attacks were almost nonexistent, and became common very rapidly, as awareness spread among criminals, as they rushed to take advantage of the opportunity before the crypto, legal, or antivirus ecosystems catch up and make it less rewarding. In 2009 around 1 in 13 stalkers used trackers of any kind; that number's surely gone up between 2009 and 2021 (AirTag release), but you really think that number won't go over the next few years, partly because of increased popular awareness of trackers?
> It is foolish to underestimate stalkers and stereotype it as just a crime of opportunity.
I said often a crime of opportunity, not always (or even mostly), and that those for whom it was a crime of opportunity, weren't sophisticated. The average bank robber might have done a good deal of research on bank security systems and circumvention. The average stalker might not think of using GPS tracking unless he's reminded of their existence, since there are so many other methods (likely, most stalking is online nowadays). Hence my "availability" argument.
It’s so frustrating to see this kind of thoughtless Apple criticism based on brand only when they so many things that are actually bad.
AirTags are better in nearly every way to the competition. They have considered design factors, like privacy, that no one else has. Yet, they are the bad guys that should never have released this product.
Apple should be releasing products like this. They offer significant improvements over their competitors because they consider more than pure profit seeking. AirTags without privacy protection is the same as everything else available, is cheaper to make and easier to design.
I like Apple pushing the bar here. Because their products are perfect, and balance different trade offs, they encourage other manufacturers to fill those gaps. This is a win that wasn’t happening when Tile was the dominant player.
https://help.apple.com/pdf/personal-safety/en_US/personal-sa...
(also a web version: https://support.apple.com/guide/personal-safety/welcome/web )
(and yes, it covers AirTags).
Every Android user needs Airguard, which will scan constantly for airtags. It's open source
I bet you Google has had conversations about integrating some kind of airtag tracking feature into their software.
The OP is right. Airtags are not the greatest idea and the abuse of them is disastrous for people who are not on the apple ecosystem.
The attitude of apple so far has been horrible... Their app sucks.. only works when you open it.... They can do better but refuse to, because they don't care for our safety unless we buy an Apple product.
Sorry but that's unacceptable
Can you pay for that subscription of a tracker with an anonymous payment? If someone was to find a tracker, and even having to go through court orders of whatever type, the subscriber could be found out. I think that would be the bigger deterrent for a thinking stalker than the price as that's the cost of doing business. (shivers from making stalking out to be a sane thing) Lot's of plausible deniability, "oops, i lost that sometime ago, and totally forgot to play dark pattern UI games to end my auto-pay subscription. totally wasn't me, we swears it."
Very true, the only real difference is that Airtags are simply a better product, but that means their use as stalking devices (along with their legitimate uses) is now much more practical and casual.
I think the real long-term solution is for Apple to open up the U1 chip/protocol so at the very least Google/Tile/Samsung are able to implement the same countermeasures Apple has, if not use it in their own tracker devices. It would probably cost them revenue, but I imagine it would be worth it compared to the negative press they're getting from this, particularly since they're also making huge strategic missteps wrt App Store 3rd party payments.
I relate to it and respect it, but it's doubtful anyone would switch to iPhone because of AirTags. Samsung and others also make trackers, and you don't need the Find My network if you lost your keys inside your house, any tracker will do.
> Not only are air tags useful, but I'm sure that there are people who would be willing to switch to iOS surely to get access to airtags.
After a Google search, I can't find a single anecdote of this from reddit or elsewhere. I doubt it's even a blip on Apple's balance sheet.
Perhaps removing them from the Find My network and only operating locally would be a better option, but I just can’t see them going back on it at this point.
They just didn't have the reach that Apple has, by far.
I am so happy that these exist.
I mean, increase from 0.00001% to 0.0001% is still significant and yet I still wouldn't worry about it in the slightest.
>I continue to think Apple should have never released AirTags to the public, and should discontinue it
This discussion is specifically about what Apple should do, so I don't see how this is relevant.
We should also stop producing cars because someone may crash someone.
Almost every technological device (or even a simple device) can be abused in wrong hands, nothing to do with Apple or AirTags.
i don't think the jury is out on airtags just yet. it's clearly revolutionary technology in terms of reach, for better or worse.
I think there's probably a little gender bias at play in your risk estimation. I too am not particularly worried about someone stalking my 6ft ass - but I'd say a majority of my female friends have experiences with stalking at some point in their life.
With statistical arguments, why do we spend so many resources on prevention of anything, e.g. cancer, when it only impacts a small number of people?
This kind of argument always comes down to choice. You care or you don't. Hard to argue. If you don't care about the fate of those "few", mostly women, well... there is no law of physics that I could throw at you, my negative judgement of your argument is not based on anything hard. Which is the case for a huge amount of such choices. You can have a society based on and steered by pure statistics and benefits, but what you will miss is that the very nature of such a society changes because you cannot put that into numbers.
The core of the argument is qualitative, which does not lend itself well to number-based reasoning.
I don't know why would you say such a thing.
Let me give you another example - the chance of getting stabbed on the streets of London is probably comparably miniscule to being stalked.
And now if we extend that argument - almost 100% of people getting stabbed are men.
Does that mean that as a man I should start wearing a knife-proof vest? Is me refusing to do so "not caring" or that "it's only statistics for me"?
After all, people getting stabbed have a 100% risk of getting stabbed - that's a pointless statement if I have ever seen one.
I just don't understand the aggression of that statement - just because my gender is statistically unlikely to be stalked doesn't mean that somehow I suddenly don't care, or that women shouldn't care - just that in your daily life you should really consider how big of a risk something really is.
>>With statistical arguments, why do we spend so many resources on prevention of anything, e.g. cancer, when it only impacts a small number of people?
That isn't the argument though. We aren't arguing spending or not spending money to prevent a small number of cases(in which case I'd say absolutely this money should be spent). I replied to someone who said AirTags should be completely and entirely banned over a very small number of cases where they were used maliciously.
To use the cancer comparison - it's like someone saying that we should ban bacon worldwide because it's a known factor in certain cancers. I'd also argue against it, because the risk to any one individual from eating bacon is absolutely miniscule.
So: sort out the privacy implications with a low-priority product like AirTag first.
But I am not a guessing person. ;)
One could argue it's pretty distasteful to try to cash in on people's fears.
Survival food? Fear.
Antivirus software? Fear.
Expensive Organic Cat Food? Fear (of the inorganic cheap food).
LifeLock? Fear.
Insurance of any kind? Fear.
Solar panels for off-grid? Fear (of the grid going down).
Your cousin's extensive gun collection? Fear (if things get bad).
And so on...
Solar panels is pretty much targeted as a way to avoid high utility bills, trying to go green, etc. If you're in a circle of consipiracy types, then maybe the off-grid aspect is preached more. Mainly though, it's just about avoiding the bills, and maybe avoiding power interruptions. That requires batteries though. That might qualify as fear advertising.
I was personally eager to pay for the cellular-equipped Watch as long as I was getting one, because even without an explicit data plan, if you fall off a bike, it will call 911 for you automatically unless you tell it not to.
That's insurance of a kind I couldn't purchase prior to that, in a form I would actually use and have on me if this actually happened. Fine by me.
The older you get, the more ways to fall down and need 911 start to exist. I'm okay with Apple "cashing in" on that.
I didn’t want my tile part of their “network”, I didn’t want other tile users to relay the location, I didn’t want my phone relaying other tile users’ locations. I didn’t want my tiles location going to any server at any point. I just wanted a to be able to make my wallet beep if I’m near enough to it for it to be in range of my phone. But the rest of the “features” couldn’t be disabled, so I threw my tiles out.
does 2) get updated if someone deletes the app?
Or with decent operational security can you purchase and activate airtags in an untraceable way?
If you can that undermines your point, however if you can't then your making a very good point.
If a user has that level of tech savvy, there are plenty of other cellular GPS devices they could use.
I suspect they could get several cellular GPS devices for the cost of an iPhone + some AirTags - meaning they could easily offer up one or two sacrificial ones for easy finding in order to hide a smaller one "in plain sight" (as it were.)
Or they could just hire a private detective to do some stalking for them.
Or someone even less scrupulous for even less money, I'd assume?
People are subjecting themselves to voluntary surveillance and it's amazing to watch, Apple's promise to cooperate with "Law Enforcement" in most of the world was chilling. J Edgar Hoover would have creamed his pants - "Did you say MLK Jr. has several airtags? I want daily updates on where he's going."
Most criminals wouldn't be doing what they're doing anyway if they were clever or did a modicum of research on what they can actually get away with.
You misunderstand how airtags work. Airtags can't track an android user. It can only track people with iPhones (and possibly other apple devices).
> Your AirTag sends out a secure Bluetooth signal that can be detected by nearby devices in the Find My network. These devices send the location of your AirTag to iCloud — then you can go to the Find My app and see it on a map.
Airtags broadcast their ID via bluetooth and then any nearby iPhone with "Find My" enabled will be looking for these signals. If something is found, it sends the information to Apple and Apple then makes it available to the Airtag user.
The person or object doesn't need a phone (be it Android or iPhone) to be tracked. All Airtag needs is to be detected by someone else's iPhone.
Why are Android users vulnerable? Because iPhones will automatically warn you if a tag that isn't yours stays near you for a long time while Android users have no idea. Apple released an app for Android, but it requires users to perform manual scans...
You as Android user live in a an apartment block. Your neighbor below has iPhone. Your neighbor keep getting warnings on his phone that unrecognized AirTag is nearby. He can’t find any and doesn’t speak with you about it.
When moving across the city it would be even worse as there is no neighbor that would get the tracking warnings.
Source?
That is hardly true. Case in point - my wife put down her keys at a store and managed to leave without noticing (this was early after AirTags hit the market). I was driving and we left without recognizing that a few hundred dollars of keys had been lost.
Later that day, we noticed. She called a few stores all said there were no keys found. We then tracked the AirTag - and in fact, it was at the store. We returned and were able to locate it, at one of the registers in a lost and found. We never would have found that it not for the AirTag.
Since then, we’ve used them to not leave things behind, to find things lost at home and elsewhere. There are indeed many legitimate uses despite your want to claim otherwise.
What do you mean by "a few hundred dollars of keys?" Do hardware stores charge more than a few dollars per key in your area? Were these private keys to a crypto wallet?
Edit, more things that are expensive:
- if you live in an apartment with nfc entry, they might charge an arm and a leg to replace it, even if the actual device is only a few dollars
- IDK how much it costs to replace an apartment mailbox key, but I've been warned that if you lose one they need to re-key the whole mailbox
- maybe you don't feel safe with a house key in the wild and need to re-key your house (same for your car/s)
- if you have work keys, they might over-charge to replace lost keys
https://www.apple.com/shop/product/MMN73AM/A/airtag-herm%C3%...
That's just theft — plain and simple. The only half valid argument I've heard is to discourage carelessness leading to loss of the key and weakening of the building security. But that's moot in places where the garage gate is broken and left open half the year (my current place) or where people can casually wait for someone to walk in and tail gate them without anyone complaining.
By the way, I purchased a proxmark a long time ago to play with and to date, it has paid for itself many times over, by allowing me to carry my building keys the way I like to (cards vs bulky key fobs) by duplicating them where otherwise it would cost $100 or impossible.
Can't wait for keys on Apple Wallet to become mainstream.
Some tags are easier to read than others. But so far, with a bit of digging around the net, I've been able to read various key cards and copy them.
In my case, with a London apartment, it's an "Administrative Fee", £150 to replace your lost fob.
Then for my costs as an individual, it was not only that fee, but also new locks for external door(s) and mail box, another administrative fee for the communal meter cabinet/room key, new Kensington lock and a car key/fob when my wife's keys were "lost in a known location yet never again found".
That is to say, "losing" those keys is a £300-500 affair.
- U2F authentication keys
- really expensive AirTag holders (https://www.apple.com/shop/product/MMN73AM/A/airtag-herm%C3%...)
A replacement key for my wife's car costs $1,200. And it's not even a newer, or expensive car.
It's been a long time since you could get many car keys done at a hardware store.
And it's not even the electronics anymore. One locksmith I called said it's about the fancy engraving. They can't afford the tools to do that kind of work, and they just refer people to the dealer and to suck up the $1,200.
Now that I think about it, I wonder if that might have been covered under insurance.
I didn’t make up those numbers.
Its a clever little device that will let you rekey a lock yourself with a new key as long as you still have at least one of the original keys.
If you're living in an apartment complex or skyscraper, re-keying can get extremely expensive.
I once left my umbrella in a hire car. It took me 2 weeks to realize it was missing. Turns out no one touched it and I could see it on the map, in the parking lot of the hire car company. So I showed up, and within minutes, we pinned down which car it was in. Without Airtag, I would not even remember where I could have possibly left it, after two weeks! Learnt my lesson to turn on separation alert after that.
Now I need a smaller Airtag for my sunglasses — expensive and easy to leave behind.
Needing an Airtag is like needing a case for your phone. A lot of people keep dropping their phone so they put a case on it. In 13 years of owning a smart phone, I've never dropped mine. But I don't claim that phone cases are only useful if you throw your partner's phone off the balcony after a fight.
Normally I buy $10 umbrellas from Australia's big hardware store chain. They aren't great but they're easily robust enough to last for a year or two. (Cheap umbrellas from anywhere else tend to break if you look at them funny, and they rust if you get them wet.)
I'd be willing to pay $120 AUD (or $80 USD) for an umbrella that was seriously good quality, recognising that the economics imply that it would need to last for at least a decade to be cost competitive.
https://au.davekny.com/ has good stuff although I haven't had one long enough (only 5 years) to attest its durability.
They also have some promising guarantee terms: https://au.davekny.com/pages/lifetime-guarantee
My partner has probably been through about ten umbrellas in the same time-span, because she was reluctant to spend the modest extra amount for something she doubted would last so long. I recently bought her the same model of umbrella from MUJI, although it’s too early to say whether the company has maintained the build quality.
I think it’s this one (but hard to tell on their awful website) https://www.muji.eu/pages/online.asp?PID=14951&qclr=45503441...
It's why Amsterdam bicyclists don't ride $5000 bikes.
*Especially in Tokyo. If you drop a wallet full of cash on the street in Tokyo, someone will chase you down to return it. But if you turn your back on your umbrella in Tokyo, kiss it goodbye. Then you have to steal another one.
How civilized, I thought, that a company would provide free umbrellas to shoppers when it rains, and so I took one.
Turns out that's where you out your umbrella when entering the store...
Sports direct (of all places) ships them to Australia and they are around half of your budget (https://au.sportsdirect.com/fulton).
Totally agree with your point.
You are missing the point.
They are not the target audience, but they are affected negatively by it regardless. It's for Apple users at the expense of everyone else.
The criticism is not about the individual utility of airtags, it's about how it creates a privacy issue for everyone who is not an Apple user.
And you should read past the first line.
> The criticism is not about the individual utility of airtags, it's about how it creates a privacy issue for everyone who is not an Apple user.
In the same manner, it’s not about utility of individual phone cases, it’s about all the plastic waste it creates for the whole planet.
> Display alert with sound: When AirTag automatically emits a sound to alert anyone nearby of its presence and is detected moving with your iPhone, iPad, or iPod touch, we will also display an alert on your device that you can then take action on, like playing a sound or using Precision Finding, if available. This will help in cases where the AirTag may be in a location where it is hard to hear, or if the AirTag speaker has been tampered with.
People lose stuff all the time. That's why most public places have Lost And Founds.
And none of these problems are airtag specific. You can buy fairly accurate GPS trackers for about $30 that don't even have the android scan feature.
Also, AirTags look far more innocent, giving a plausible deniability excuse to a potential stalker. Oh, that's where I lost that key, it's on the floor of your car! With specialised tracker that excuse won't work.
Is that a feeling or something you can source?
It is the usual Apple strategy for decades. AirTags product play was the technological groundwork for UWB and possibly AR/VR. They always need a product, hobby or something adjacent to iron out all the problems. Chip Packaging, Next Gen OLED, Low Power Profiling all landed on Apple Watch first before they moved to iPhone. The Sound work on AirPod before they moved to HomePod and later MacBook and iPad.
This way they could spread their R&D and gain synergy across product range.
On the subject of tracking, I am not entirely sure AirTag, or the idea of Tagging ( so to speak ) is as useless as you claim it to be, but I am also extremely uneasy with the concept of AirTag. Like many if not all things in life, the road to hell is paved with good intentions.
If you have an Apple AR/VR headset, you could just stick tiny AirTag-like trackers in your environment and the headset could use those for location.
[0]: https://f-droid.org/packages/de.seemoo.at_tracking_detection
I feel like this is ignoring the fact that if any company other than Apple made these trackers, it wouldn't do this with anyone's phones. The fact that these work out of the box with iPhones is a bonus, not an entitlement that any phone of any brand should have full support for them without installing any apps and without the user even knowing that the product exists.
> All a stalker needs to do, is remove the speaker.
I guess they could make the packaging more tamper resistant somehow, but again this is kind of shifting the goals a bit. I don't think it's reasonable to expect that every device will be physically resistant to modifications that would enhance illegal use. An iPhone with the speaker removed and screen cable cut to look dead would make a pretty good tracker too.
> AirTags are cheaper than competing GPS trackers, most of which require subscriptions.
If you are risking prison time to commit premeditated violence, I think you can spare a few extra bucks for the best technology available. I'm pretty sure professional hitman services run well into the trunk loaded with bags of cash territory.
Isn't this the whole clue, rather than just a bonus? When someone slips an AirTag on to you every single iPhone in the world forms a sort of ad-hoc spying network against you. Without you or the iPhone's owners knowing.
Right, and Apple have provided everything that AOSP would need to implement this, someone even made their own version of the entire Find My client long ago (https://github.com/seemoo-lab/openhaystack), so technically AOSP could even integrate using Find My, although I imagine Apples lawyers would have a field day with this if they did.
Identifying the AirTags has also been implemented as a background service by the same organisation as above (https://github.com/seemoo-lab/AirGuard).
> I guess they could make the packaging more tamper resistant somehow, but again this is kind of shifting the goals a bit. I don't think it's reasonable to expect that every device will be physically resistant to modifications that would enhance illegal use. An iPhone with the speaker removed and screen cable cut to look dead would make a pretty good tracker too.
This. Plus, the noise AirTags make isn't the only way of finding them, you get the notifications, and soon (when the changes mentioned in the article are implemented) it'll be easier to find them using precision finding.
Stolen iPhones should already be parts only because of activation lock.
They expect me to consent to having my physical location tracked by Apple in order to avoid having my physical location tracked by someone other than Apple. Unbelievable.
What am I missing here-- it seems like it would have been trivial for Apple to add a microphone and have the AirTag stop sending location if the speaker isn't working. And have the firmware check the speaker is actually emitting sound, so no amount of physical rewiring can defeat it.
Anyone know why they didn't do this?
Finding a detached ski in titty-deep backcountry powder. AirTags can be literally life saving.
This isn't really under Apples control though. But I guess they could go out of their way to provide an AOSP pull request, that would be big of them.
Then offered a solution only to it's own customers.
That's some dystopian Apple shit right there.
Without that network it wouldn't work, you can't do this over the public internet without a swarm of physical devices you control on the other side. Companies like Apple remotely controlling devices used to mainly be a personal issue and thus a personal choice, you can just opt out of Apple to avoid it.
There is no opt out of Apple airtags.
Now every Apple user is an Apple snoop, your choice to use Apple affects _everyone_ around you... quite literally.
You sure have a lot of strong opinions on what apple "should" do.
Don't like it? It's a free market. Don't buy it and if you're afraid of being stalked, check out the app they released.
I wonder how come all you people come out of the woodwork now that Apple released this thing, yet when Tile did there was no such forced concerned anywhere.
The fact that this post from Apple even EXISTS is direct acknowledgement of this being a horrible, dangerous mistake.
I know what they were trying to achieve, but it isn't worth the misuse by a long shot.
People will think it's not a problem until someone is tracked with one and killed.
The only thing I can think of (besides not selling them) is to open them up so they can be used with Android, and work with Google to add support for them to Android's OS.
Some noteworthy bits:
> we innovated with the first-ever proactive system to alert you of unwanted tracking
If that's true, then Apple just raised the privacy bar and now Tile and other small players need to up their game to stay relevant.
There is also lesson to learn here: whoever makes a tech/product popular is the one who gets the heat for all its shortcomings/problems. It doesn't matter how many existing small players were doing a horrible job for years.
> As an iPhone user moves, Precision Finding fuses input from the camera, ARKit, accelerometer, and gyroscope to guide them to the AirTag
This is something that's not appreciated. The UWB chip on the Airtag can only help iPhone know how far away it is from the tag. It's 3D modelling of the world through camera vision that helps triangulate and guide the user via live on-screen direction.
Next time you think why we need tech X, just remember that you can't foresee what it'll enable in the future - (and before you comment "all AR stuff to find my keys faster?", re-read the previous sentence again).
But tech wise, I think UWB combined with AR is the tipping point for the application you mention. Bluetooth is unfortunately too coarse to be very useful in locating items. It's still useful in locating stores in a shopping mall though, and that we haven't seen yet.
I thought the MMIO antenna array would have indicated a rough direction of the signal.
But perhaps that isn't accurate enough to be useful? Since the distance is accurate to a few cm and the iphone is moving, it can use it's own calculated position from the computer vision data to apply multilateration to multiple UWB distance samples over time.
No they didn’t. This “feature” is garbage for the people who actually buy it. It makes putting air tags on things shared by a bunch of people a huge pain in the ass.
“Freaking people out who are on the bus with you because you forgot your phone but have your keys” is not a selling feature.
The parent comment said "You can chose to stop getting an alert if a particular device is following you". I don't see how what they said applies to your scenario, given your scenario is literally the opposite.
Since you weren't near the airtags, you couldn't have stopped them from beeping/following you. But whoever was at your home near the airtags (presumably the person who put them in the fridge) had the ability to disable them from beeping/following them.
I'm one of those people who has 10 Airtag, who lives with others and haven't had this problem. As far as I (and many others) am concerned, "Apple just raised the privacy bar and now Tile and other small players need to up their game to stay relevant."
> If that's true, then Apple just raised the privacy bar
Except that's only true for Apple users. Fuck everyone else I guess.
subtext: buy Apple, lest you get robbed or stalked because of Apple
The fact that there were open source unwanted AirTag finder Apps on the PlayStore way before Apples official app arrived perfectly demonstrates how much Apple really cares about privacy. They only „care“ about the privacy of the people who pay them to care.
They do seem to have dropped the ball on their Android app. Majority of reviews on that app is people complaining that it doesn't do background scans!
Not sure if there is a technical limitation in doing so on Android, but if not, I hope they make, what seems to be a small effort to make things better for Android users.
So I don't think it's a technical limitation.
Aaahh, that is why Apple’s app refuses to help me find my cat in dark apartment at night! It just says “It is too dark” and provides a button to turn on flashlight.
Chefs knives are great for cooking and are inexpensive and easy to purchase; they can be very dangerous weapons in the wrong hands so we make it against the law to use them in that manner. Maybe that's the best we can do with AirTags.
What? I've lived in several western countries and I've never had a knife purchase that was tracked or controlled in some way.
There's only one place I know of that controls ownership of chef's knives: the Xinjiang region of China.[1]
Not disagreeing with or commenting on that policy at all, but I had no idea knives were treated so seriously in the UK (and presumably elsewhere).
Meanwhile in much of the US, not only can you can openly carry a gun around, you don’t even need a permit.
Just wow.
The world is vast and strange.
They have knife bans because they never let their citizens have guns, so there are knife attacks, so they ban knives.
That's why terrorists when they can't sneak AK47s in, rely on vans to run people over, that's why there are bollards everywhere.
Chemical attacks, axes and such can also be used to kill or harm people.
People will find a way to kill people. Guns are an equalizer for weaker humans against stronger ones.
I conceal carry everyday. I don't want to be in a knife fight and I don't want my life to depend on me being stronger than the other person.
You hope not to ever use it, you have it everyday just incase, you practice regularly to stay sharp.
https://www.independent.co.uk/news/uk/home-news/tesco-axe-at...
https://www.thesun.co.uk/news/4153298/gang-axe-attack-london...
https://www.theguardian.com/uk-news/2017/jun/14/man-jailed-2...
https://www.standard.co.uk/news/uk/woman-injured-east-london...
British people absolutely have freedom to own guns, just perhaps not in the way Americans do, but yes they are in no way forbidden nor is anyone's freedom in danger - I know lots of British people with guns, way more so than where I'm originally from(Poland). You apply for a permit, then a local officer comes over to your house to just make sure you have somewhere safe to store it and that's basically it, go and buy yourself a gun, no problem at all. If you know anyone who lives on a farm they will most likely own at least one shotgun, for shooting rabbits if nothing else.
Second, the ownership license does not entail right to actually carry the firearms. Brits used to have this right, but it’s now gone forever, especially as handgun ownership is effectively banned altogether anyway.
UK only has twice as many guns per capita as Poland, by the way, and I think a lot of it is actually a remnant of era when Brits had more freedom.
I don't think knife bans have anything to do with the the 2A or the lack thereof. Knives can be seriously dangerous weapons, and in an urban environment, the stealth afforded by a knife over a gun presents further menace.
Guns are already banned and there weren't many with civilians already so it was effective.
So that leaves knives as the main weapon of choice. There are mainly knife attacks, so there are knife bans.
Texas has numerous bans on knives, despite letting their citizens have guns. Your causal logic is incorrect.
It's not, I'm sorry you can't follow the simple logic that people pick up a knife because they don't have a readily available gun, so there are more knife attacks than anything else, so they ban knives more aggressively.
> Texas has numerous bans on knives,
Texas does have bans on specific types of knives, but not a blanket ban or anything w/ length.
It's like saying because full autos are banned Texas has a gun ban.
I get that this statement sounds intuitive to you, but I would challenge you to substantiate a correlation between gun restrictions and increased violence with bladed weapons with some data before talking about causality. I personally think the majority of such violence is opportunistic, so I would be surprised if such a correlation were truly borne out by any data.
> Texas does have bans on specific types of knives, but not a blanket ban or anything w/ length.
When I was growing up in Houston, it was a felony to carry anything with a blade over 5.5" on your person. (I distinctly remember my scoutmaster warning us about locking or fixed blades >3.5", but that may have been a Houston or Harris County ordinance.) It looks like this was effectively repealed in 2017 per https://www.houston-criminalattorney.com/texas-switchblade-l...
New York is a shithole and terribly ran, of course the murder rate is higher, especially these days.
There's a lot of gang violence and pickpocketing, knives are the goto choice, especially since it's so hard to get a hand gun legally in that city. Better to carry a knife otherwise you're a default felon.
"Be Prepared" was considered a perfectly valid reason at one time. Still is in hmm. Many places.
[1] https://www.onlondon.co.uk/the-number-of-homicides-in-london...
They're in every kitchen, how are we to prevent them from being carried out of the nearest one? Ask yourself!
The list of good reasons to carry a pocketknife which are aren't shanking someone is unenumerable and lengthy. It's an absurdity and I despair when I have to see Brits pretend to the logic of it out of some misplaced solidarity. Kudos for the NHS but the knife loisense fills me with pity for what a once mighty nation has become.
[1]https://www.gov.uk/buying-carrying-knives [2]https://www.losangelescriminallawyers.com/los-angeles-knife-...
It’s just a difference in culture. Despite the stabbings, Americans will not tolerate knife control to the same degree.
I believe it was at a museum or another public attraction that a police officer saw the knife in its holder on his belt, stopped him, demanded he surrender the knife, and told him he'd be arrested if he didn't.
He was very upset - he'd had that knife for decades.
> Precision Finding: This capability allows recipients of an unwanted tracking alert to locate an unknown AirTag with precision. iPhone 11, iPhone 12, and iPhone 13 users will be able to use Precision Finding to see the distance and direction to an unknown AirTag when it is in range. As an iPhone user moves, Precision Finding fuses input from the camera, ARKit, accelerometer, and gyroscope to guide them to the AirTag through a combination of sound, haptics, and visual feedback.
I guess this probably only works for people who have iPhones, but it still at least makes tracking somebody using an AirTag a somewhat risky proposition (for example, if a person is stalking somebody using this technology and knows their target has a non-iPhone, they never know if that person might have a friend with an iPhone).
If a thief has my bag I definitely don't want them knowing they're being tracked. Maybe I don't quite understand something about this announcement.
When my father’s Android was stolen we called the cops and they told us to the park a block away from the thief’s house (last ping from Find My Device) and wait for them. They took a report from us, confronted the thief at his house, and got the phone back. The thief claimed that he found it at the post office and intended to return it, but the phone was in airplane mode (accessible from the lock screen) so that was clearly never gonna happen. This was in San Jose.
This makes me wonder, could Apple go further?
What if Apple put up a web page where anyone could type in the serial number of any AirTag they found, and instantly see the name and phone number of its owner? Apple could even print the website URL on the back of every future AirTag (albeit presumably in tiny print).
I bet that would make stalkers think twice! And, I don't think there's any technical reason Apple couldn't do it, right?
What I'm not sure about is whether this would be an invasion of the owner's privacy. But, if you're using AirTags to only track your own belongings, when would this ever come up? The owner's privacy seems less important than that of an unwitting victim, since the owner can choose to not buy an AirTag.
I'm quite familiar with gdpr, btw -- and I don't see how being able to look up a uuid or some other nonsequential identifier via a site to find the owner obviously violates it. There's a strong legitimate interest case for anyone in possession of a global tracking tag being able to find out the owner, I would think.
Apple should know who possesses the airtags at the very least, and if an airtag is reported lost/stolen, that info could be conveyed back to the person who found it, but nothing more until Apple has then liased with the "owner" to find out what to do next. Obviously this can be automated to some degree.
a uuid on its own is not a problem. but if you can take one and establish a link pii then the uuid becomes a pii risk.
Technical no; Adding a fraction of a penny to engrave the uuid on the tag is a non-starter.
In theory I think you just need to get it closer to an iPhone, no print needed.
This is a two edge blade. Personally, if I was going to use an airtag I would use it to protect myself in case of theft. Now, the thieves can locate the airtag due to a notification and move it to an unsuspecting other victim, which will then move on to press charges against me, and I will have to defend myself in court. I don't see the appeal.
Most things you lose are both less dangerous lost and worth less to a criminal (and hence less likely to induce someone to become a criminal) if they can't be tied back to you. Don't put "If found, return to 123 Main Street" on your keys, don't put "Apple Confidential" on your USB keys, don't engrave "Property of North West" on her Switch, etc.
My goal would be to provide enough information so that, if the AirTag's owner is someone the victim knows, they'll be able to determine who it is. Apple needn't provide enough information to identify random strangers, because most stalkers aren't random strangers. (And, the AirTag is appealing due to its ease of use; it would be easier and cheaper to buy a GPS tracker than set up a burner iPhone.)
It may not be possible to do this in a completely harmless way to the AirTag owner, but I do think potential victims should get more priority here. Telling everyone to file a police report isn't great IMO, because potential victims may have all sorts of reasons for not wanting the police involved.
It could be a burner phone, but if you're going to put in that much effort you might as well get a GPS tracker. And, chances are the stalker is probably someone you know.
"Apple can provide the paired account details in response to a subpoena or valid request from law enforcement"
Hmm
But also Apple can pair the serial number of the physical tag with the account that registered it. I think this requires the actual tag to be retrieved. The serial number isn't transmitted in the clear; it's gotta be read off the tag case.
That's my understanding of it anyway.
It prevents identifying who an air tag is identifying its location to. It prevents identifying what air tags you're searching for.
It is unclear to me how either property is useful to protecting someone from being tracked by someone else's air tags.
Who owns the tag (assuming someone has it in their possession) is not end-to-end encrypted.
"E2E encrypted, we can't even read it, unless you use iCloud, or we get a NSL, or if we feel like being a MITM today".
HN discussion: AirGuard: Protect yourself from being tracked by AirTags and Find My accessories (298 points, 150 comments) https://news.ycombinator.com/item?id=28577951
AirGuard is great. They optimized the app to the point that it doesn't even show up in my Android device's battery usage statistics anymore. It's a set and forget app that scans for AirTags in the background automatically, but also when you trigger a manual scan. It's free and open source.
Apple's Tracker Detect app for Android (https://play.google.com/store/apps/details?id=com.apple.trac...) doesn't have automatic scanning, and requires the user to open the app and tap the button to manually scan for AirTags. It also forces the user to wait 10 minutes before they can make the AirTag emit a sound. I'm glad that the Technical University of Darmstadt made a better solution and released the source code, too.
You can choose to supress indefenitly.
Source: have iCloud family with like 10 airtags.
Of the four pack I bought one is useful for finding my keys, one is a PITA in our car, and two I never got around to using.
Just a month ago the German activist Lilith Wittmann used an airtag to corroborate the suspicion that a branch of the German government she (or anyone else who should) never heard about before called "Bundesservice Telekommunikation" (Federal service of telecommunication) is just a front for the Bundesamt für Verfassungsschutz (Federal Office for the Protection of the Constitution, the federal domestic intelligence agency). Unfortunately I only found this [0] article in english quickly, a longer piece by herself in German can be found at [1].
[0] https://www.imore.com/german-woman-uses-airtag-find-governme...
[1] https://lilithwittmann.medium.com/bundesservice-telekommunik...
Point is it should be at minimum opt-in possible because without it it clearly misses the obvious connection to a selling point of Apple (family sharing).
"If a Find My network accessory that's separated from its owner is seen moving with you over time, this alert is displayed"
In my experience, it's generally more than the few minutes someone that grabs a purse will keep the purse before looking for cash/whatever.
A car is, of course different. I had the brilliant idea to put an airtag in my car so I could find it if I forgot where I parked. Then I got a call from a very worried SO that borrowed my car that thought they were being stalked (there's a history there of issues, so yeah, fun times).
Specifically, you get a cryptographic secret when you pair the key, it broadcasts as a bluetooth beacon with encrypted messages based on that secret and current time, that get reported up to an Apple service.
When you want to see your accessories, your device will compute the encrypted messages at appropriate times and have apple search for them.
However, there's no network push to an AirTag available to tell it to rotate keys. You could grant more people to see a tag by sharing the secret - but you then could not remove that permission without physically resetting the tag.
I suspect the solution will eventually be having derived keys from the secret and date, and date-based "leases" for permissions - I share the current key to allowed peers. That would mean revocation might be represented in the UX immediately, and take a day (or some other time period) to actually start to fail cryptographically.
I might have a secret key for the AirTag, and the encrypted messages derive a new key each day based on the current date, then encrypt a check-in message based on the current time.
If I share the secret key, its permanent access until a hardware reset of the AirTag. If I want to share "for a while", I just share a bag of those derived keys for the date range. The UX might represent it as not having a date range, and my devices which know the secret just periodically share out the derived keys when online to give out keys, and effectively make it so that any revocation of permission takes a week.
The other option is for me to be able to share enough information with Apple's servers that (on permission change) it blocks the AirTag web service query itself. That won't help you with any shared secrets allowing someone to detect its the same tag even after MAC rotation.
Ultimately, maybe we're better off just losing things sometimes.
There is not much tech that lacks unpreventable malicious use. Needs to be expected for pretty much anything.
https://mashtips.com/remove-airtag-speaker/
Or just buy a pre-modded one.
https://uk.pcmag.com/mobile-phone-accessories/138509/silent-...
"Your scientists were so preoccupied with whether or not they could, they didn’t stop to think if they should." - Dr. Ian Malcolm
Wouldn't this make unwanted tracking essentially impossible?
If a bike's Find My support randomized its MAC on every broadcast, it may very well not be possible to tell that it is not a new device each time. That might not be allowed per the licensing agreement, and that might be something that Apple has heuristics to detect and alert on.
I mean the thief will get notified, but what are they going to do? Dismount tires, disassemble steering assembly, remove the grips, undo the saddle, bottle mount, Garmin mount, bash guard, lights, etc? This all takes time and skill, it can’t be done on the spot and if they dragged the bike home or to a fence they have already disclosed the location.
Also this: https://www.amazon.com/EFEALL-Anti-Theft-Protection-Compatib...
And this: https://cults3d.com/en/3d-model/various/fork-cork-inspired-s...
People complaining about airtags being nerfed were misusing them in the first place
You can only have 1. Can’t have both.
I sense the "you're holding it wrong" philosophy never really changed at Apple.
I'm happy to see some actual numbers but it seems the devices have been used far more often to deter actual, serious crime than to cause it. Perhaps they should focus on improving the product for what it's actually good for and not nerf it's core functionality because of the extreme edge case of a few bad actors.
Samsung has a similar product called SmartTag and it's also quite good from what I've seen, and on cursory glance seems to not be hyper focused on "fixing" this "problem".
Alternatively, if (with an actual warrant, and involvement of the airtag owner) the police could link location trajectories of any phones that travelled with the stolen airtag, that’d be nice. Not sure how to avoid abuse with that scheme.
Local trackers have been around for a long time. I had a "TV remote finder" years ago that you'd stick to a TV remote (or keys), and it would beep when activated by a second device. More recently, Tiles work pretty well, assuming you don't need direction finding. Personally I don't regularly lose anything large enough to benefit from an AirTag. I need it for things like individual AirPods.
But a small device with a worldwide range and no subscription fee that I can attach to a car or suitcase? That's a novel capability. I have one in both cars and my electric skateboard.
I was sorely disappointed when they announced the new Apple TV remote, and it didn't have airtag built into it.
Even then, it is unreliable. The last time my son misplaced his iPad (a week ago), after I put it back on the charger it didn't start beeping (I had told it to make a sound via Find My) until about 12 hours after it was turned back on. Simultaneously I got the notification that it had been found. Not too impressive, IMO.
An AirTag, though, would have its own rechargeable battery and would be able to locate the iPad for a year after it got lost. In my ideal implementation it would work just like a regular AirTag, the only difference being a circuit to keep the battery charged, and being embedded inside the case of the iPad.
It won't be long before they have tiny mics, too. And the little speakers they have, of course, can be disabled.
We on HN should really band together to do something about this. There is already https://github.com/seemoo-lab/AirGuard which is cool. What else could be done? I can think of some general directions:
1) Fill their network with noise somehow. If there are lots of tags, or tags pretending to be other tags, then information on which tag is where will be less valuable
2) Make something that forces existing tags to out themselves (should they have working speakers)
3) Jam their radio signals. Probably illegal in the U.S. under FCC rules, but perhaps there's a way to do it where you're not actually jamming, you're merely doing something else that causes them to not work.
4) Find some reliable way of identifying them via a wand, your phone, etc.
5) Apply political pressure to make this sort of thing illegal (especially for the authorities)
6) Make laws that say if you're using spectrum to build a mesh network, it has to be open to everyone
On an unrelated note if you have any FCA vehicle thieves have a programmer that plugs into OBD2 that will delete yours keys from the car and pair theirs in under 2 minutes so they can crank the car and drive off. It’s not even the relay amplifier attack that affects a lot of other cars.
For a company that 'values privacy', how do they think it's acceptable to only advertise this information now?
They've never advertised this information. Are you also up in arms about that?
https://www.apple.com/privacy/government-information-request...
Apple has a privacy report card for every app on their store, a whole “data linked to you” section.
If that is necessary for apps, why is that not necessary for a product that literally can track you?
It should not be buried.
Then subject them to malicious users before releasing them to see what sort of ideas they can come up with in a few days, and mitigate those before general release.
Go schedule a room at Defcon, give people AirTags, and see what they do. If they neutralized your mitigations in an hour, well... other people can figure that out too. That the speakers are so easy to disable... well, yeah, you should have figured that out before release.
I'm a bit concerned about Apple's internal ability to reason about malicious actors. This is the second time in recent history they've released a shiny something, only to discover it torn to shreds in very short order by people. The whole CSAM hashing algorithm being as weak as it was to manipulation should not have been a surprise to them - but it sure seems like the system was designed without considering that the first hashing algorithm was trivial to intentionally collide.
"Buy an iPhone to prevent people from tracking you, and if you want to see where the tracker is, buy a really new one!" is some sort of sales pitch, certainly, though this new set of things sounds so prone to false positives and annoyance that I'm not sure how long it will be until people just turn the whole thing off (if that's an option).
It's a neat concept, but doesn't seem to have survived contact with reality and humans very well.
That may be understating it a bit. I honestly can't decide which is greater.
Airtags as-is are nerfed for non-technical reasons as to make them more or less useless to me, despite their ability to be incredibly useful.
For example:
Due to the nag/anti-stalking alerts I can't put them on dog collars due to day-care visits. No way for others to whitelist a tag on their phone, or any way to silence it.
Same goes now for the car. It's annoying to just toss one in each trunk in case of theft or whatnot, since the cars are shared.
The privacy concerns have more or less turned this product into something of a very narrow usage band - aside from a personal bookbag or whatnot I don't see many other realistic uses at this time. Not useful for hiding in my power tools, etc. etc.
I had pretty high hopes for these for some peace of mind (dogs), and I live in a high crime area so being able to track my expensive items has proven useful in the past. I was excited about expanding on this use until they started crippling them.
I think there was a brief surge in people abusing them because they thought AirTags were untraceable, which they very explicitly are not. As apple says in the article they can directly go from an AirTag to the account that owns it.
Its also only like 6-8 months old at this point.
Honestly, in my personal opinion I feel that only thing that's really different is the company's notoriety. It's no fun to bash Tile (people just don't have any beef with them), but kinda fun when it's Apple. And that they've actually sent out a viral idea ahead of product release focusing attention on this aspect (so, naturally, it echoes back).
Slightly less, but still very importantly, there's the fact that by design you can't see if someone is tracking you unless you buy another Apple product, which wasn't an intrinsic engineering limitation, but just a choice that Apple made for their own profit.
Of course you have to know about it and it only provides scanning when the app is open instead of constantly doing it in the background like iOS.
As was the risk of getting jail time if you use it to stalk someone. Something you don't really worry about with a generic GPS tracker. That handy, convenient AirTag will give the police your address.
Apple clearly put some thought into how the product would be misused, and added some features for that - but then appears to have not bothered having actual (simulated malicious) users test those features to see how they'd bypass them. Things like "removing the speaker" seem oddly trivial, yet there's no indication Apple even thought through that situation. It wouldn't be too difficult to design something in which the deliberate disabling of the speaker rendered the device useless after a few days, yet would be unlikely to trip in normal use. They're pretty well sealed.
"Red teaming" something like this in the early design phases is often useful to be able to figure out how to mitigate these sorts of attacks, and Apple, far too often lately, seems to be in a "...they did what? No, they can't have... we didn't think they'd... ugh, OK, let's add something to support that..." mode.
And if they don't have family sharing support, as seems to be the case from the other comments here, it clearly means they weren't tested with any sort of realistic use case, because "Oh, yeah, my wife's keys in her purse keep making my phone go off when we're driving together" seems a common use case to discover in testing.
I don't think a company should be responsible for all malicious uses, but when those uses seem utterly trivial to manage (remove speaker, your tracking target uses Android and like almost all Android users hasn't downloaded Apple's app to check for AirTags following them), I think they've missed something really important in the design phase.
For example:
> deliberate disabling of the speaker rendered the device useless after a few days
That only kicks the can. Now people will silence the speaker from outside, for example by covering the whole AirTags in superglue and foam to muffle all vibrations.
Which makes it larger, harder to hide, and easier to find. Go try - see how much foam it takes to reasonably muffle the beeper. It'll take a lot more than you think.
Use your own thinking, how would a red team go about silencing the device.
Also, try covering your phone speaker holes with your finger. See how effective that is.
Unlike e.g. facial recognition, AirTags are not even some new breakthrough, just some well-known existing technologies made a bit more mainstream/commonly available (can't even say "more affordable", the price point hadn't changed). Yet, it causes an uproar.
Technological genie just cannot be put back in the bottle and it's only gonna get worse in the future, as tech will become smaller, smarter and more magical.
We've allowed, collectively, anything that falls in the "tech" realm to deploy first, ask questions later, and more or less force society to conform. I think it's been absurd, we see more and more backlash against it, and rightly so. A company shouldn't be able to just ignore the law and do whatever they want because they use computer chips, but we've seen more or less exactly that in a number of cases.
- Uber/AirBnB can be seen as venture-capital funded, money losing ways around existing taxi/hotel/rental laws, and their tendency to expand into a market without permission and then demand the right to stay there against the laws that prohibit exactly such things, is an example of this model. - The various "Dump tons of scooters in a city without asking, profit, and make cleanup the city's problem" is another example here. It's littering, really, but somehow tech companies involved get a pass because it's neat. - Literally every "We collect all the behavioral data you don't realize we're collecting to improve our models of you so we can sell better advertisements to our actual customers" business model does the same thing - take first, ask permission never (or, at least, try very hard to never have the topic come up).
I'm not OK with this, and I hope more and more people aren't OK with it either.
> I hate to say this but it really feels that our assumptions of privacy are becoming outdated and there's no going back.
Privacy shouldn't be something subject to the current state of technological surveillance. We should, as a society, decide what privacy ought to be, and then limit tech companies accordingly.
Europe seems to be making decent headway on this front, with "No, you can't just keep doing that..." rulings against tech companies. I hope that spreads.
Cool, that's a societal change - awareness.
I can't argue against your ridesharing datamining examples. I can't say the data they've hoarded is actually valuable - just based on the fact almost all their ads are complete misses. I've yet to see any personal data hoarder company to be able to actually pull off anything sensible, not that some ML model realizing nonsense in lines of "meatbag bought a sofa, meatbag must love sofas, let me show him all the sofa recommendations" (lol). Anyway, that's not the point. I don't fancy this data collection and sure agree it's not a bad thing to stop it. Just as I'm fed up with small prints, shrinkwrap licenses and other things we pretend people read and understand that they don't.
When I wrote my comment I thought about somewhat different things. Tracker devices or face recognition is different because it can be done in what marketing calls a "privacy-respecting" way, on device. Yet, it's a fact if someone can point a camera on you, they can match you with their previous data, and if someone can plant a device on you (and devices get smaller and smaller every few years) they can know your location. And it's not about companies producing something, it's about the technologies itself, when the technology can be used for both good and bad things. Like a knife or a laser pointer.
It doesn't make sense to me to tell companies to not produce such technologies. It's impossible to make technologies be usable for good things and not usable for bad things. A knife is always a weapon (or it's not a knife and you can't use it to make yourself a sandwich), a key tracker can always be used to stalk (or it won't be ever useful to find stolen things). But some people are so desperate for "safety" they do want to nerf anything that can be even theoretically abused to absolute uselessness.
Things like this is what bothers me.
The speaker could be defeated, but the anti tracking stuff cannot be stopped without breaking the basic functionality.
If you’re demanding that companies must go to great length to avoid abuse of their products why aren’t you demanding the same from tile? Why not the myriad gps trackers on Amazon? It’s not unreasonable to demand that Amazon ensures every such tracker they sell has speakers and anti abuse features.
I agree, however, this thread is about Apple's AirTag devices, and complaining about Amazon's incredibly vile sales practices seems at least somewhat off topic for it.
What's happening now though is people are attacking apple because AirTags anti-abuse features work, and people have identified when they're being stalked.
We haven't heard stories like this about tile, not because it doesn't happen, but because the complete lack of any anti-abuse features mean that victims are unaware they're being tracked.
First the reality: Malicious actors interested in, e.g., tracking other people or other people’s things without their knowledge or consent, have many other options. To defeat them, an Apple product just needs to be somewhat less convenient/useful/cost-effective than some of the many other options.
Second, the perception: Apple needs to convince their customers and potential customers that they care and they’ll do something when there’s an issue.
As released, they pretty much had number one covered, though improvements are always good. So they are mostly working on number two… it’s good when there are actual improvements, but that’s not the main point.
Not to mention I could probably make a crappy GPS tracker with none of these alerts and stick it to people's stuff. It may be clunky, but there are plenty of good hiding places. Or I could just get this[0]. Or this[1]. Or any of the dozens of trackers I can find on Amazon that would be perfectly good for stalking.
[0]: https://www.amazon.com/Amcrest-LTE-GPS-Tracker-Geo-Fencing/d... [1]: https://www.amazon.com/LandAirSea-Waterproof-Magnetic-Person...
When I get in my car with my wife, we both get a notification that an AirTag is following us, because my wife is potentially stalking me with her purse and keys. I can silence this notification for only one day. I can't disable it, because that's what a stalkers or abusive boyfriend would do. They randomly beep and boop to notify me that they exist, and I'm being stalked, and to put my phone near the offending AirTag so I can see the serial and last four digits of the owners phone number.
If someone were actually stalking me, I probably wouldn't notice.
I think the whole concept is almost doomed, if you're to be satisfied. The purpose of an AirTag is to track a thing. The desire of a stalker is to track a thing. I don't think these two identical problem spaces can exist together, in some harmonious way, that would satisfy people with your concerns, without constant annoyance. Just imagine if these were more popular and you did something crazy like, got on a bus, or went on a plane, walked any reasonable distance down a street with someone in your proximity.
I would love to hear a solutions that doesn't result in constant notifications. I also think it's completely silly to say "We'll we just have to restrict location track of anything, because there are bad people out there. Period." If the metric is to stop all the bad, then technology needs a huge lobotomy!
I think there will always be headlines about stalking and abuse, and people claiming Apple didn't do enough (even though it's so annoying as is), regardless.
I can see that concern, but family sharing ALREADY lets you share iDevice locations at all time. That's a superior form of stalking compared to AirTags... So I just don't get this concern. It might just be perception though. From a PR perspective this is a bad time to release any feature that could be perceived as reducing AirTag stalking alerts.
Yes, it does. It really, really does. The absolutely human-toxic nature of most modern consumer tech ("You buy me, I feed you ads, and collect absolutely as much data as I can to improve the ads other people pay me to deliver to you!" model being the core complaint here) has done a huge amount of damage to humanity.
There are upsides, but we culturally seem horrible at actually evaluating things fairly. Always-on devices, constantly sending notifications, are just horrible to every aspect of humans - and the more we learn about just how horrible the are, the better the companies involved refine their ability to "drive their users nuts" for more eyeball-time to view ads, desired or not.
So, yes, if what you get out of my writings are that we should radically pull back on what consumer tech is and can do, you're evaluating my position quite accurately.
I think we need to change the metric. Every tool humans have ever invented can be used maliciously. So we have fallback options, like punishment, to mitigate that. Apple needs to make you read and acknowledge a notice when you get an AirTag that says quite clearly that they know the serial number and will happily provide your contact info to authorities on request. And then police need to actually arrest people for misusing tags to stalk.
The solution here is to restrict airtags to finding your own stuff only. That takes away some of the utility but also all of the stalking risk.
The “an AirTag is traveling with you” alerts haven’t been defeated as far as I can tell. Apple tweaked some of the time periods after launch but the core technical mitigations are the same.
I agree the current situation is non-ideal, but it’s not clear to me this is from a lack of sufficient pre-release pentesting.
Perhaps not, but they're meaningless to the >50% of the population that doesn't have a modern enough iPhone as their daily carry phone.
Having moved back to a flip phone, I literally have no way to identify if such a tag is being used against me.
A quick look on Amazon UK suggests that there are plenty of cheaper options and, whilst not many, there are options of a similar size to the AirTags.
Now, admittedly, none of them have the same feature set as an AirTag but if you're at the point of buying GPS trackers to stalk someone, I doubt you're thinking about the technical distinctions.
Regarding CSAM, I have not seen any credible threat model with those hash collisions.
> "Buy an iPhone to prevent people from tracking you, and if you want to see where the tracker is, buy a really new one!"
The tracker beeps, and displays information to Android phones, also. They did what they could to make it easily findable.
Obviously each air tag is associated with an iCloud account, so this could be quite an effective move on Apples part.
The Tiles were useful while they kept charge. Apple has a lot larger participant network as well than the tile network.
I guess they're hoping Tile (or whoever else) will feel obligated to create similar nerfs or annoyances on their trackers? I thought this was interesting because this is one time vertical integration (having a huge network of iPhones) is putting an Apple product at a competitive disadvantage
I hope someday we have a fully open global tracking network, not affected by Apple an Mozilla and all the rest who seem to want to destroy any technology that can be used to invade privacy, regardless of how many legitimate uses it has.
Apple has some permission stuff that apparently degrades Tile on their platforms IIRC.
For web specs you can't just think "I could do this cool thing", you have to say "what can a random popup ad do with this". Our experience with WebGL shows permission dialogs are a bad experience, and people will also click "yes" to make them go away. Most users report "would you like notifications" from websites as being spam/annoying.
It's generally common knowledge that all sites are tracking you in all ways that they can and any time they ask for a permission it's to spy on you. Users who actually are more concerned with privacy probably will not click every random button.
Which is in itself one bit of trackable information, but that's about it.
Battery status is very useful for kiosk applications. Web Bluetooth is obviously great for all kinds of IoT things.
The more dangerous ones like Bluetooth can require you to explicitly select a target, and most people will notice something is wrong if they see MyBonerBest.io wants to connect to a list that includes their watch and light bulbs.
EU Cookie consent is somewhat changing that all, by training people to click yes on prompts faster than their eyes could even focus on them.
If there is a risk, it's probably more that people click out of reflex than out of not understanding, which can be partly mitigated with improved UI.
I think the Amazon Sidewalk has a lot of potential in this space as a viable alternative to the iDevice network apple has. Google should def release competition that can leverage their device network too, considering their comparable hardware penetration.
It was also strange that they told people by notification that an airtag was with them, but didn't let them search for it using precision finding. Why would they do that?
It is better than nothing. The limitation on background scanning is likely due to Android + diverse hardware not providing a low-power way to do such a thing.
The more effort Apple takes to bind an Apple ID to a real world identity, the more consequence comes from abuse of a tag. The alerting serves to make that consequence more likely.
For your bike, I would recommend something from here: https://www.cyclingweekly.com/group-tests/find-your-stolen-b...
How does this work if one doesn't own an iPhone?
With 100.000+ installs it seems only a very small percentage of Android users is aware or cares
Apple's own app is almost useless as it only works if the user performs manual scans... but who does that?
Say someone put a tag inside their backpack, their backpack gets stolen. The person stealing it can then just open their App, see there's an airtag in the bag, report it and kill its signal.
I don't track keys but I track my wallet and my wife does not need or ever ask for that.
I'm really not exactly sure what happened here in this "update", other than "FYI, we'll give out information after being subpoenad" and "we'll also include a dialog to say "don't track people with these"."
"So, basically nothing, then?"
A louder tone? I thought a lot of the issue was that people using them nefariously were disabling the speaker entirely, or buying AirTags that others have helpfully pre-disabled for them.
Apple don't care a jot about privacy. This became clear with the CSAM debacle. That's why I left their ecosystem, and I'm very happy with my new phone running GrapheneOS.
The problem is that by leveraging Apple devices to get worldwide geolocation and data service effectively for free, they make tracking trivially easy in a way that no other entity could.
Thanks to Apple's usage of their own proprietary network, both difficulties are automatically negated.
In principle, Apple has the ability to match the AirTag to a phone number (if they do this or not, I don't know).
Now you just have to walk into an Apple Store with $20 cash and set up a fake Apple ID.
Vodafone curve is a commercially available gps tracker that is about the same size and cost of an airtag. A vodafone sim is £3 a month, and you can sign up for a pre paid sim card without a credit card or providing identifiable info. There is a bike version that ties into a bike tail light for charging. The battery life can be much longer this way.
There are non cell based ones like the See.Sense AIR, the battery life is generally much longer
+
$5 Pre-Paid SIM https://www.amazon.com/SpeedTalk-Mobile-Tracking-Locators-Wi...
This would be much less alarming than some tracking device or an AirTag, especially if you put some innocent looking picture on the Home Screen, so it looks like some kid dropped their phone in their purse, on accident.
Reading this comment thread, I assume many here would agree that we should ban all small smartphones.
[1] https://www.androidauthority.com/best-small-android-phones-7...
maybe they should make airtag operators accumulate freely tradeable data credits and iPhones reject relaying location data without a balance of credits
helium network works this way
for airtags it would make bad behavior more expensive and maybe another way to track bad actors or disable their ability to be a bad actor.
or not. just saw the free part
If they were really concerned about privacy, they'd make set a higher bar to track things across their network - eg. Require Filing an official police complaint of the loss and submit the paperwork to get access to the tracking - win/win. You could still allow local Bluetooth tracking within range of the phone like Tile as that can conceivably be used only for personal items.
Instead, they're pushing the responsibility of safeguarding from their spying tools back to people
I'm sure they're going to be very soon be hit by a lawsuit from someone rich who doesn't really care about how much it costs to take them on. Their legal seems to have been asleep at the wheels.
You can use a hammer to break into a house. Still legal to buy and sell hammers.
That really should do it. I mean, in the unlikely event that a message to first time users doesn't solve the problem of people being stalked using AirTags, go ahead and keep working on the other updates. Belt and suspenders. But my guess is, it won't be necessary.
They should consider adding a message for iPhone users to tell their friends with Android phones that they "should be really careful not to get tracked by AirTags, because there's no way they'd know about it".
/s
Just remember to add the Tile app too, it does the same thing.
I expect that this will be about as effective as the antipiracy warning at the beginning of every movie is.
> and that law enforcement can request identifying information about the owner of the AirTag.
Haven't there been a lot of stories of victims going to police with an AirTag, but this not happening?
> iPhone 11, iPhone 12, and iPhone 13 users will be able to use Precision Finding
How convenient. Now you need a modern, expensive Apple product to protect yourself from stalkers.
To be honest, this is more about technical capability than an intentional lock-out.
If older phones simply don't have the hardware to do precision finding, what would you propose Apple does? No precision finding for anyone?
You can still find the AirTag just fine, you just won't get the fancy "hot potato" animation and precision distance/direction that UWB offers.
Airtags as global trackers should not exist. Finding things locally is a completely different use case.