News for hackers. Stuff that matters.
Re:Apple Introduces AirTag by crazygringo on Tuesday April 20, 2021 @03:06PM (#26879741)
AirTags are anonymous to other end users.

Obviously Apple is internally maintaining an association between the AirTag's permanent identifier, and its current temporary signal identifier.

This isn't E2EE or anything.

Re:Apple Introduces AirTag by theshrike79 on Tuesday April 20, 2021 @04:52PM (#26881495)
"Your AirTag sends out a secure Bluetooth signal that can be detected by nearby devices in the Find My network. These devices send the location of your AirTag to iCloud — then you can go to the Find My app and see it on a map. The whole process is anonymous and encrypted to protect your privacy. And itʼs efficient, so thereʼs no need to worry about battery life or data usage."

"Only you can see where your AirTag is. Your location data and history are never stored on the AirTag itself. Devices that relay the location of your AirTag also stay anonymous, and that location data is encrypted every step of the way. So not even Apple knows the location of your AirTag or the identity of the device that helps find it."

So no, Apple actively doesn't want to know anything. I'd wager a guess that the airtag query system is using the same kind of method as the COVID tracker API.

Re:Apple Introduces AirTag by 0x426577617265 on Wednesday April 21, 2021 @02:55AM (#26886206)
This would also reduce the amount of received legal process from LE agencies, since data is not accessible by Apple.
Re:Apple Introduces AirTag by mercutio2 on Tuesday April 20, 2021 @03:13PM (#26879861)
Huh? It certainly is E2EE.

"Whether attached to a handbag, keys, backpack, or other items, AirTag taps into the vast, global Find My network1 and can help locate a lost item, all while keeping location data private and anonymous with end-to-end encryption."

Re:Apple Introduces AirTag by omegaworks on Tuesday April 20, 2021 @03:31PM (#26880187)
Even with E2EE it makes sense that it is still possible to differentiate "registered, known" tags from "unknown" tags. Unknown tags won't reveal any information about who owns them, but they will still transmit on the same frequencies and with the same protocol as your air tags.
Re:Apple Introduces AirTag by crazygringo on Tuesday April 20, 2021 @03:31PM (#26880182)
Is the E2EE applying to the Bluetooth ID's?

I think it's referring to other aspects of the system -- this sentence is specifically referring to location data, not Bluetooth ID's.

In any case, my point remains that obviously Apple has to be internally associating the Bluetooth ID's with owner ID's.

Re:Apple Introduces AirTag by blep-arsh on Tuesday April 20, 2021 @05:24PM (#26881922)
They aren't. The tag generates and broadcasts a public key that is rotated every 15 minutes. A nearby "finder" device receives a broadcast, encrypts its location with the received key and sends it with a hash of the public key to Apple's anonymous location directory. The owner (who keeps the same key pair rotation algorithm running from the same seed key) can look up a bunch of key hashes for a range of 15-minute intervals and then fetch and decrypt location payloads. No device or account IDs are transmitted in the process.
Re:Apple Introduces AirTag by crazygringo on Tuesday April 20, 2021 @05:29PM (#26881985)
Ah ha, got it, thanks -- I was definitely incorrect then. Wish I could edit my original comment to say "never mind" but the edit window passed.