Hacker News Reader

Consider theft. Now the thieves have the victims phone number to attempt to further steal from them. Or if there is an audible sound, they know the police is coming after them and can drop the airtag and avoid apprehension.

This is a two edge blade. Personally, if I was going to use an airtag I would use it to protect myself in case of theft. Now, the thieves can locate the airtag due to a notification and move it to an unsuspecting other victim, which will then move on to press charges against me, and I will have to defend myself in court. I don't see the appeal.

Right, or even consider the original case where you have an AirTag on your keys for if you lose them - given a name and a phone number, someone who finds your keys can quite possibly figure out where you live and use the keys.

Most things you lose are both less dangerous lost and worth less to a criminal (and hence less likely to induce someone to become a criminal) if they can't be tied back to you. Don't put "If found, return to 123 Main Street" on your keys, don't put "Apple Confidential" on your USB keys, don't engrave "Property of North West" on her Switch, etc.

Hm, how easy is it to get an address from a cell phone number these days? Maybe Apple could only include the Apple ID?

My goal would be to provide enough information so that, if the AirTag's owner is someone the victim knows, they'll be able to determine who it is. Apple needn't provide enough information to identify random strangers, because most stalkers aren't random strangers. (And, the AirTag is appealing due to its ease of use; it would be easier and cheaper to buy a GPS tracker than set up a burner iPhone.)

It may not be possible to do this in a completely harmless way to the AirTag owner, but I do think potential victims should get more priority here. Telling everyone to file a police report isn't great IMO, because potential victims may have all sorts of reasons for not wanting the police involved.

But Apple is already saying you shouldn't use AirTags for cases of theft. The AirTags already attempt to alert people to their presence, including with sound.

"Don't expect to be able to use AirTags as an anti-theft device" is very different from "AirTags should allow thieves to do even more harm to you"

Lose a pair of keys? With that system in place anyone who finds them can trivially find out what door they open.

If I understood correctly, this still doesn't protect you against custom Airtags using embedded boards[1]. You could just use any serial number you want and maybe even incriminate other people by using the serial number of their authentic Airtag?

[1] https://github.com/seemoo-lab/openhaystack/

If they can link serial numbers to appleids it would imply that they could block non-apple devices? Unless the Apple serial numbers are also randomly generated or something? (Might check the apple docs later)

If your threat model includes someone "just cloning your airtag and planting a clone", I think you've got big issues you need to deal with.

Now if only I had sand paper around.

In theory I think you just need to get it closer to an iPhone, no print needed.

I honestly can't tell if you're being sarcastic but this is horrifying.

I wonder how this would work. Even if you do find the Apple ID the AirTag is associated with, how do you find the person associated with the Apple ID? You can use any name you wish there as far as I know.

If you have an iPhone, it would be hard to fake your phone number.

It could be a burner phone, but if you're going to put in that much effort you might as well get a GPS tracker. And, chances are the stalker is probably someone you know.

> And, I don't think there's any technical reason Apple couldn't do it, right?

Technical no; Adding a fraction of a penny to engrave the uuid on the tag is a non-starter.

But they offer free engraving anyway???

Well, Apple could potentially make users download an app to read the UUID (hopefully not iOS-only), although obviously printing it would be better.

this would violate privacy laws like gdpr

Why and how?

I'm quite familiar with gdpr, btw -- and I don't see how being able to look up a uuid or some other nonsequential identifier via a site to find the owner obviously violates it. There's a strong legitimate interest case for anyone in possession of a global tracking tag being able to find out the owner, I would think.

You dont know the circumstances for why an airtag is where it is, what if a parent sewed one into their kids clothes or bag or shoe, but got ripped out or something?

Apple should know who possesses the airtags at the very least, and if an airtag is reported lost/stolen, that info could be conveyed back to the person who found it, but nothing more until Apple has then liased with the "owner" to find out what to do next. Obviously this can be automated to some degree.

I don’t want some asshole who steals my keys to be able to look up my name. How is that a good idea?

the problem is an api that returns someone’s pii without authenticating they are allowed to see it.

a uuid on its own is not a problem. but if you can take one and establish a link pii then the uuid becomes a pii risk.

The far bigger problem is the airtag itself, which spews unpermissioned tracking data without any consent required.

There is consent. If you don't want the "spewed tracking data", you can disable the Find My Network completely.

Apple has made no attempt at getting consent from whomever the airtag is on. Maybe if you have an iphone it could alert you.