When Hitting ‘Find My iPhone’ Takes You to a Thief’s Doorstep
nytimes.com
nytimes.com
Less than and a minute later i realized that i left my phone in the cab. I could still see him driving off and decided to just run incase he got my attention, but the guy sped away.
I walked back to the college gate and found my friends who were wondering what had got into me and why was i running. On explaining them what happened my friend offered me his phone. I Used his phone to call my cell atleast five times , hoping the cab guy would realize that there was a phone in the back seat and come back. Unfortunately that didn't happen. I went and sat for my exam , but was annoyed at my carelessness.
Tried my phone again only to find it switched off. This time was more than annoyed. I went to the police and also spoke to the other cabbies near the area i got a cab from telling them what happened. A few months had passed , I got another phone and forgot about it.
interestingly enough had the same exam but finals this time and was on my way to college. I spotted the cab guy who previously took my phone parked waiting for a passenger to hail his cab. I went upto him and confronted him . he said he didn't hav it and maybe I was mistaken. I knew his face and told him i wasn't and asked him to return my phone. This time i took down his cab no and told him if he didn't i would just hand his details to the cops .
He hesitated and said he would bring it back the next day , as he had given it away . I asked him to whom and he plainly said ,"Ma'am I'll bring it back to you. He gave me his no voluntarily".
I did get it back but it was slightly broken.
I figure its a big city vs little town thing.
And there you have it, the real purpose of the story, to push the killswitch agenda. Let's give the government full unfettered access to our mobile phones. What can go wrong with that?...
http://www.leginfo.ca.gov/pub/13-14/bill/sen/sb_0951-1000/sb...
A key quote: "The rightful owner [...] may affirmatively elect to disable the technological solution"
It's nothing like "giving the government full, unfettered access to our phones."
Here's the latest version: http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?...
A part I'm concerned about: "(d) Any request by a government agency to interrupt communications service utilizing a technological solution required by this section is subject to Section 7908 of the Public Utilities Code."
Skip to 7908 here: http://www.leginfo.ca.gov/cgi-bin/displaycode?section=puc&gr...
So, this kill-switch may not be 100% controlled by the device owner.
I'd be OK with a required/opt-out kill-switch only if I was the only person that could possibly brick my device with it. (That's a hard problem to make user-friendly and educate people about. A private key I create and store physically/securely somehow?)
Otherwise, I don't really own my device.
See also: http://en.wikipedia.org/wiki/Trusted_Computing "TC is controversial as the hardware is not only secured for its owner, but also secured against its owner."
Right now you can use various software to track down stolen devices, this leads to the owners to pursue the item and try to get back their property. While this method can be dangerous there 'could' be some type of support from law enforcement to help you acquire your stolen items. Instead they just "kill switch it" and now your item is useless to everyone, your only recourse now is to buy the item again.
This kill switch is really only good news for the companies that make these products.
One possible idea that might help is pooling fees similar to an insurance (lets say $20/item in advance or $50+ when stolen) and find private investigators that are willing to get it back for you. The PI will have the resources necessary to get the item back safely and you don't have to pay for a $400+ device.
What do you guys / gals think?
The customer with a private key? (...with no way it could be activated by the phone manufacture/service provider/legally forced by governments.)
Probably not, because it's not user friendly enough, or some excuse. It's a problem that needs solving so we actually own and control our property.
EDIT: Do you often downvote people just because you disagree with them? You said it yourself you haven't given it much thought and your reply adds nothing at all. If any reply should be downvoted, it's yours. Have a nice day.
I didn't downvote either of your comments. In fact I'm not able to downvote your second comment (which frankly I think does deserve downvoting), I think because it's a reply to mine.
I hope you also have a nice day.
The statement you mention is a quote, and a relevant one at that.
But let's be clear - there is no way in which a "killswitch" requires "unfettered access to our mobile phones." Indeed, the UK (and I believe the wider EU?) has a global register of blocked IMEI numbers to which mobile phones are added - while it's possible to circumvent this in various ways, there are also more steps that could be taken to achieve the required outcome without handing over the keys.
Or if you want to push it a bit further, it's not hard to design a system in which an owner can cryptographically prevent the use of their phone without handing the keys over to a third party. However, the struggle here is that users would not engage with this system well, rendering it pretty useless.
So. Being wrong, being wrong, meta noise, bad attitude. Any questions?
Edit: Down voting because you disagree? It's a problem that needs solving; I hope we can discuss it.
I'll try again:
No-one but ourselves should be able to brick our devices. We don't actually 'own' our property if we can't 100% control what and if it runs.
But that's a hard problem to solve in a secure and user friendly way.
...and there's not enough financial incentive by consumers (and certainly by device makers, cell networks, law makers...) to solve it yet.
A few weeks back, there was a theft at my place and I lost all my valuables (cash, credit cards, headphones) but most importantly my laptop. I'm tired and frustrated of going to Police station to inquire about it. I want to fix it!
Here is what I propose:
We can use the power of crowd to locate lost devices. I think most stolen laptops are sold second-hand in grey markets. If we can tell a buyer somehow that the laptop he is about to buy is stolen, there is a high probability that he will not buy it.
We can make a mobile app/website where anyone who has lost a laptop can enter basic details of his device ( Serial No., Model etc.) and whenever anyone is about to buy a second-hand laptop, he can check our app/website and immediately know whether the laptop is stolen or not. This can help people locate their lost devices and can lead them to the thieves.
What do you guys think? This is just one idea that can help people recover their lost devices. There might be many other ways, and we can brainstorm them here. Let's shoot!
PS: Please drop me a line if you are interested in working on this problem!
So it works in this sense, and while I really like the idea you're talking about, I don't think it'll work for a few of reasons:
1. This is apparently already happening (albeit behind the scenes, and probably only in some areas) 2. It seems unlikely that the seller of a stolen device will be willing to allow you to check the serial number against a database.
OTOH if you do decide it's worth pursuing and you want some technical resource, hit me up :)
Well if they are reluctant then you know it's stolen, so that's not a problem.
I expect that a seasoned thief would know to ship the stolen goods out of the area for fencing.
I don't think this is true. People buying cheap laptops on the grey/black market care about 1 thing - price. Most know int he back of their minds there is something shady about the deal but it doesn't bother them enough to say no to a low price.
Database of stolen devices is a nice project and maybe can lead to recoverd things, particularly expensive ones, like my $5k camera. But in the end it will prolong grief people who lost their things to various situations. If you device is used for work it is best to insure it and back up regularly. Most pros that use their hardware for work insure their bits of stuff. However hardware is notoriously cheap nowadays even very good laptop costs around 2K, where I have spend 5k in year 2004 for similar setup relevant to the time I was buying it....
I think a better solution is something like Tile is doing. http://www.thetileapp.com. Install a low powered Bluetooth beacon on every device and use the power crowd source in order to find that device. The two biggest things that would have to happen for it to work would be 1. A major manufacturer like apple would have to install it on every device in order build up a big enough user base to make it feasible 2. The ability to find the lost device would have to require no user input. Basically the person that lost the device would mark it as lost and then every iPhone would now know that and in the background would look for that Bluetooth device and if found would automatically send that location back to the user who lost their device.
It has some privacy concerns but I think this would be an effective way to find lost devices.
Devices like Tile, Trackr are available in the market but they are easily recognizable and thieves will detach them. If they can't be inbuilt due to any reason, there are two alternatives to make it work:
1) A paper thin version of above mentioned devices that can be pasted on laptop OR - 2) Replacing a keyboard key with any of the above devices
The hardware will do two things: 1) It will tell the location of the device and 2) It will 'factory reset' the device so that the data doesn't fall into wrong hands.
What do you think?
Also, Wifi can be used as a beacon. Wifi is usually turned on and broadcasts message to discover known networks.
I used to work for a company that recycled used cell phones and as you might imagine, it's very tempting for crooks to try and float their stolen goods there. Because of this, all serial numbers (imei) were checked against a trans national registry (checkmend in the UK). But even though this is commonly known in the UK, and we even advertised it on site, then we would still regularly get stolen phones in.
I think the bigger problem is that most stolen goods are sold directly to the new "owners". In most cases they probably know (or at least suspect) that they are buying stolen goods. They just don't care. Unless you make it a risk for them to buy it (E.g. they knew the police would eventually trace the item and they would face charges of theft), it is not going to stop. People have shitty morals.
And as I said earlier, I am not aiming for 100% success rate, even if we are able to help a few folks get their laptop back it will be our victory!
I think also there is quite some lots and found websites out there, so maybe it's a better idea to talk to them about implementing your mechanism.
I understand that it becomes useful once we reach critical mass, but it has to start somewhere. We have to take charge and help each other and stop depending on authorities.
If you set up a one-page infographic and linked to lock cables via Amazon referral links, you might even have the potential to make a few bucks to cover hosting, beer, or donating lock cables to a local underprivileged hackers' group.
What you are proposing is a good preventive measure, but stealing is a crime and we need to have better solutions to handle it whenever it happens.
- A paper thin version of above mentioned devices that can be pasted on laptop OR - Replacing a keyboard key with any of the above devices
The hardware will do two things: 1) It will tell the location of the device and 2) It will 'factory reset' the device so that the data doesn't fall into wrong hands.
What do you think?
> Checking by citizens and Police on Trace is FREE.
Whereas if phones can be located, it seems like a great opportunity for repossession companies to offer a phone retrieval service, and for police to aggregate data on recovered phone to identify theft rings.
I think phones fall under the same category as bikes - good resale price, low risk[1]. A kill switch doesn't have to be perfect, I think. It only needs to be hard enough to circumvent to make the effort worthless, the same way that the woman in the article found her phone despite it being relatively easy to circumvent the "find my phone" feature.
* Results may vary according to your city and country. [1] http://blog.priceonomics.com/post/30393216796/what-happens-t...
Even if kill switches can be circumvented and phones can be sold for parts - it significantly reduces the incentive for someone to steal phones, as selling them is more effort and less money; such changes do affect behavior of criminals.
We are still using short passwords instead of strong private keys; we give unencrypted access of our data to cloud providers to make things easier for us. How can ultimate authority/access of our property be made user friendly enough for joe user/sixpack?
Stolen phones ended up in Russia and India, after having their IMEIs reprogrammed by professional fences. Many carriers opposed mandatory IMEI blacklisting laws/regulations on the grounds it is ineffective.
This gives an expectation that killswitches also can achieve their crime reduction goals even if professional fences are able to circumvent the killswitches.
Every 5S owner I know actually uses TouchID. I'd guess around half of the 5/5C users I see bother to use the four-digit PIN, because it's a longer process to unlock.
Smartphones unattended on a bar will be a less attractive target when the default assumption is that it's locked, and would be a large undertaking to put it into a state useful for the thief's personal use or resale. Making locking convenient enough that everyone does it (and the phone's physical security strong enough that it's an actual ordeal to bypass) would build a herd immunity for smartphone owners.
Apple may in the future decide to do this, but I don't think any other OEMs could. They all have romance the carriers to get into stores and the carriers want good serviceability since the way you make money at places like AT&T is by cutting costs down to the bone. More unrepairable, unrefurbishable devices that need to be replaced with new units causes the opposite.
I can see a scheme where each device has a specific unlock/recovery keypair in its keychain out of the factory (or first activation). It could be requested from the manufacturer from the service center. This would at least have accountability ("AT&T Store #451, Employee #8 requested unlock key for Device #123456").
The manufacturer's service could deny the request if the phone was reported stolen, or contact the rightful owner via other channels before releasing it. Or just revoke access to service centers with a history of abuse (e.g., the thieves have an "guy" at a strip mall).
So, at purchase time, an iPhone isn't an expensive phone. But, if you have to replace it off contract, it's very expensive. When it gets stolen, that $200 phone suddenly becomes a $600 phone, which probably leads people to more drastic action, like following criminals to their homes.
If you can't afford to replace it, you probably shouldn't have bought it.