Hacker News Reader

malmelooon Track your devices via Apple FindMy network in Go/TinyGo

Except that custom tags like these do not require an Apple device in order to use them, so the size of the network is not increased. They only increase the load on the network. FindMy is not a P2P/mesh network; all these tags do is broadcast keys which are picked up by iDevices, which then upload those reports to Apple.

malmelooon Track your devices via Apple FindMy network in Go/TinyGo

The process of requesting locations for a certain tag is not tied to any Apple Account. In the instructions in the README, when logging into macless haystack, you can just use a burner account.

malmelooon Query Apple's FindMy network with Python

Oops sorry, that's unintentional. I've fixed this in the source, the next pypi release should support 3.13.

malmelooon Query Apple's FindMy network with Python

I responded to your other comment, but for other people who have the same question:

https://news.ycombinator.com/item?id=42482974

malmelooon Query Apple's FindMy network with Python

Sorry for the lacking docs; this has just been a little side project of mine and isn't supposed to be ready for the large public yet. Hence why I'm not the original submitter :-)

You don't need a jailbroken iPhone; a Mac or hackintosh should be sufficient. Some pointers to public discussions:

- https://github.com/malmeloo/FindMy.py/issues/4

- https://github.com/malmeloo/FindMy.py/issues/31

In the long term I would like to be able to pull the shared secrets directly from the iCloud keychain without having to use a mac, but the reverse engineering efforts are not quite there yet.

malmelooon Query Apple's FindMy network with Python

The latest version is 0.7.5: https://pypi.org/project/FindMy/

malmelooon Query Apple's FindMy network with Python

As far as I understand, the keychain is indeed e2e encrypted and it requires at least one of your other devices to be online in order to sync. However last time I checked Apple still fails the mud puddle test, so there does have to be some kind of master key that decrypts the data in the case of account recovery.

malmelooon Query Apple's FindMy network with Python

This, indeed. Quick addition: Apple only stores locations for up to 7 days, so I would recommend running it once per day or so if you don't need live data. If you do, be careful not to request too often (sub-30 mins) if you value your account dearly.

malmelooon Query Apple's FindMy network with Python

You're right, locating friends is not currently supported. I would assume that this feature is implemented by simply sharing your device's (already recorded) latest location ping with your friends, in which case this is also currently out of scope for the project - the library only intends to interact with the "other-devices-find-my-device" network in order to be account-agnostic.

On a separate thought, if Apple has not taken concerns such as the one you portrayed into account when designing Find My Friends then I would suggest not using the system altogether. At that point it's only a matter of time before someone figures out how to extract the data. But that's an entirely different story and a personal consideration you'll have to make.

malmelooon Query Apple's FindMy network with Python

Which version of MacOS are you using? I believe Apple has made changes to the keychain in the latest version which prevents the scripts from working properly.

The only Apple "device" I have regular access to is a hackintosh, so this stuff is frustratingly hard to debug. So far I've been relying on efforts from the community, but the scripts appear to be somewhat flaky and don't always work for everyone unfortunately.

malmelooon Query Apple's FindMy network with Python

Theoretically yes, once the AirTag is deployed the keys should be static and you should be ready to go. Apple should also not be able to "ban" the tag at some later point in time.

I would suggest signing into a separate Apple account that's under your control to pair the AirTag, however. Not due to the risk of being banned, but because I have the suspicion that removing an AirTag from your (friend's) account may prompt the device to instruct the AirTag to reset. But if you sign into another account, pair it using an iDevice and then log out, that shouldn't be an issue.

malmelooon Query Apple's FindMy network with Python

You're correct in saying that it would be challenging for them to overhaul the entire network, but this library directly makes API calls to Apple's servers to request location reports. So while the tags would likely keep working, they could totally block the library or your account if they really wanted to.

malmelooon Query Apple's FindMy network with Python

So far they don't really seem to care, however we've seen the lengths Apple is willing to go to when it comes to protecting their sweet revenue stream during their fight with Beeper. OpenHaystack has been functional for a long time, but they obtain locations from a running Mac, while this project directly accesses their API. This is also the most attention this project has received in a long time, so we'll see how that goes.

Over the past year only of my accounts has been banned by Apple, and I was using that one to request locations every 5-10 minutes 24/7 in Home Assistant, with no other usage of the account other than one registered hackintosh. I'm currently using another account that is querying data every 15-30 minutes, which has been working fine so far. You just need an account to anonymously download location reports, so if your throwaway gets banned just create a new one and things should work again. Just make sure to attach it to a real device or hackintosh at least once to "activate" the account's iCloud API.

I do just want to make it clear that I have no intentions on keeping this working "at all costs" - at least not without other people willing to help me out. The library is currently not even trying to be stealthy, and it can be easily detected using heuristics if they really wanted to.

malmelooon Query Apple's FindMy network with Python

There is an examples directory that covers basic usage: https://github.com/malmeloo/FindMy.py/tree/main/examples

Official docs: https://docs.mikealmel.ooo/FindMy.py/

I realize that the docs are rather empty right now; it takes a lot of time to turn my thoughts into text, which I do not really have at the moment. Contributions are welcome, of course ;-)

malmelooon Query Apple's FindMy network with Python

To the best of my knowledge, AirTag locations still cannot be obtained through the iCloud website. The locations it shows are simply generated by the devices themselves and uploaded directly to Apple. This library specifically only queries the FindMy network, which is the system that allows other iPhones (and iPads etc.) to "find" your devices.

The library also explicitly does not integrate with your Apple account, but only uses it to query encrypted location reports from Apple. This can be done with any account, even if it does not "own" the device, as long as you can generate the correct keys.

malmelooon Query Apple's FindMy network with Python

I'm not familiar with these tags, do they implement the FindMy protocol? If it's a proper 3rd party AirTag ("Works with FindMy") then it should be supported, see the AirTag example in the repository for more info.

malmelooon Query Apple's FindMy network with Python

https://github.com/malmeloo/hass-FindMy

It still has some rough edges, but I've been running it for a few months now for myself and some family members without any major issues :-)

malmelooon Query Apple's FindMy network with Python

Technically, yes! I have an experimental Home Assistant integration here, if you're into that stuff: https://github.com/malmeloo/hass-FindMy

However, do note that AirTags put themselves into "nearby" mode when they're near an owner device, at which point they become untraceable to the FindMy network (the system where other iPhones are finding your AirTag and uploading its location). That also makes it invisible to this library. It is however still possible to detect it using the BLE signal it is broadcasting in nearby state, which is supported by the library but not yet by the HA integration.

malmelooon Query Apple's FindMy network with Python

The short answer is that it doesn't. The iCloud website only shows devices that are actively uploading their location to Apple, such as iPhones and iPads. AirTags are not shown there, as they use the FindMy network instead (the whole other-devices-find-your-airtags mechanism). This library focuses on the latter.

Apple devices can query your AirTag's location because they sync its shared secrets through the iCloud keychain, which is used to generate temporary keys that can be use to download and decrypt the tag's location.

malmelooon Query Apple's FindMy network with Python

Hey everyone! I'm the author of FindMy.py. I'd like to use this moment to give a shout-out to some other people that deserve way more credit than me, as the project definitely would not have existed without them. If this stuff interests you then please do check them out, there is a dedicated section in the project's README (https://github.com/malmeloo/FindMy.py?tab=readme-ov-file#cre...).

If you have any questions, feel free to ask :-)