News for hackers. Stuff that matters.
Re:Apple Introduces AirTag by mercutio2 on Tuesday April 20, 2021 @03:13PM (#26879861)
Huh? It certainly is E2EE.

"Whether attached to a handbag, keys, backpack, or other items, AirTag taps into the vast, global Find My network1 and can help locate a lost item, all while keeping location data private and anonymous with end-to-end encryption."

Re:Apple Introduces AirTag by omegaworks on Tuesday April 20, 2021 @03:31PM (#26880187)
Even with E2EE it makes sense that it is still possible to differentiate "registered, known" tags from "unknown" tags. Unknown tags won't reveal any information about who owns them, but they will still transmit on the same frequencies and with the same protocol as your air tags.
Re:Apple Introduces AirTag by crazygringo on Tuesday April 20, 2021 @03:31PM (#26880182)
Is the E2EE applying to the Bluetooth ID's?

I think it's referring to other aspects of the system -- this sentence is specifically referring to location data, not Bluetooth ID's.

In any case, my point remains that obviously Apple has to be internally associating the Bluetooth ID's with owner ID's.

Re:Apple Introduces AirTag by blep-arsh on Tuesday April 20, 2021 @05:24PM (#26881922)
They aren't. The tag generates and broadcasts a public key that is rotated every 15 minutes. A nearby "finder" device receives a broadcast, encrypts its location with the received key and sends it with a hash of the public key to Apple's anonymous location directory. The owner (who keeps the same key pair rotation algorithm running from the same seed key) can look up a bunch of key hashes for a range of 15-minute intervals and then fetch and decrypt location payloads. No device or account IDs are transmitted in the process.
Re:Apple Introduces AirTag by crazygringo on Tuesday April 20, 2021 @05:29PM (#26881985)
Ah ha, got it, thanks -- I was definitely incorrect then. Wish I could edit my original comment to say "never mind" but the edit window passed.