News for hackers. Stuff that matters.
Re:Emulating AirTags to upload arbitrary data via Apple's Fi... by refulgentis on Wednesday May 12, 2021 @10:31AM (#27130757)
This is starting to remind me of when Intelligent Tracker Prevention(tm) was released and instead was a super cookie leaking history. http://blog.lukaszolejnik.com/curious-case-of-privacy-vulner...

I'd be much more comfortable with Apple being Privacy, Inc. if they kept their commitment to it, too often it looks like engineers got overrode by marketing. It's v unlikely a privacy engineer signed off on something, with so many side channels, with real world consequences, compromising a billion + iOS devices

Re:Emulating AirTags to upload arbitrary data via Apple's Fi... by whoknowswhat11 on Wednesday May 12, 2021 @10:54AM (#27131056)
Um - I think you are totally missing the point - Apple is doing probably the only fully encrypted system - vs tile and friends where everything lives in a database. This is not compromising billions of iOS devices, which frankly remain FAR FAR more secure than 80% of the competitor handsets which in many cases seem to ship with backdoor built in by their mfgs.
Re:Emulating AirTags to upload arbitrary data via Apple's Fi... by refulgentis on Wednesday May 12, 2021 @12:05PM (#27131886)
Hmm, lots to unpack there, I'll stay focused on my iPhone,...I'm not so sure...the lead article on HN yesterday showed you can track people unrelated to tag's routes, live. https://www.intego.com/mac-security-blog/i-mailed-an-airtag-...

I've gathered there's a beep if this is going on for 3 days, but...still not comfy with this. And this isn't a particularly fringe opinion, plenty of comments on the article wondering how to opt out:

Re:Emulating AirTags to upload arbitrary data via Apple's Fi... by bngybmgrglflps on Wednesday May 12, 2021 @08:12PM (#27136802)
"Beep as anti-stalking measure" is somewhere between marketing spin and gaslighting. A lost AirTag chirps to serve its primary function of being recovered.

The timer is 3 days[1], which observers (Forbes, WaPo) agree is surprisingly unreasonable for this use case. We can infer it was never a serious design consideration.

On Android, decent Bluetooth is a gamble, but scanning will theoretically find one[2].

[1] https://daringfireball.net/linked/2021/04/20/moren-fine-prin... [2] https://lifehacker.com/try-using-a-bluetooth-scanner-app-to-...

Re:Emulating AirTags to upload arbitrary data via Apple's Fi... by conradev on Wednesday May 12, 2021 @10:44AM (#27130919)
This blog post actually demonstrates the opposite of the point you are trying to make.
Re:Emulating AirTags to upload arbitrary data via Apple's Fi... by fastball on Wednesday May 12, 2021 @11:03AM (#27131163)
You only read the title, didn't you?
Re:Emulating AirTags to upload arbitrary data via Apple's Fi... by refulgentis on Wednesday May 12, 2021 @12:00PM (#27131828)
Not constructive :( Getting downvoted through the floor on Apple comments for the first couple hours is a time-honored HN tradition at this point, but I'm hoping you can help us break that habit: a big contributor is aggressive comments like this that assume an agenda.

I know you can come up with something more substantive than guessing I didn't read the article. To wit, easy quote that backs what I read, and I assume I'm mistaken, given your feedback:

'The details should come as a surprise to everyone because it turns out that ITP could effectively be used for: - information leaks - tracking the user - fingerprinting'