While you're correct, I think there is something to be said about the popularization of the technology. Most people aren't aware of GPS trackers other than movies and think they are much harder to come by. AirTags are also less nefarious by nature. If you get caught with a GPS tracker on your person that's pretty suspicious. If you're caught placing an AirTag on someone's car it's easier to pretend you dropped it and are looking for it. I'd also say that the popularization increases the chance of use in the moment. You already have the AirTag and can decide do that tracking. With the GPS you have to do forward planning. I do think there's a difference here that could lead to more people being tracked. Crimes of opportunity are different than planned crimes, and I assume much more common.

It is good that Apple is notifying users when being followed. But it seems that too many false positives are getting people to ignore the messages. Though this is a hard thing to combat.

> If you're caught placing an AirTag on someone's car it's easier to pretend you dropped it and are looking for it.

That doesn't make any sense. If someone catches me placing an AirTag in the undercarriage of a car, it's pretty difficult to pretend that I dropped it there.

Depends how you were caught. On your back reaching up? No. On your knees? Yeah. Consider that this tag was placed in the wheel well, which doesn't require getting on your back and would only take a few seconds. It isn't like someone is there for a significant period of time. Especially since you can then produce said AirTag after inquiry and people will generally believe the claim even if suspicious. All you have to do is create _reasonable_ doubt. That's different than _certain_ doubt. This is because weird stuff like that is much more common than nefarious acts (though we remember nefarious acts more easily). I think you are likely overly estimating yours and the average person's awareness. Scam artists and magicians exploit these kinds of effects frequently and with an extremely high success rate.

Well if you were caught squatting down, with your hand literally in the wheel well of the car, again, that makes it pretty hard to argue you dropped something there. That's what we're talking about here.

Your hand is in the wheel well for a fraction of a second, just enough for a magnet to stick. You can still say "oh I was just picking up my air tag" and it'll be fairly reasonable. I'd buy it if it were done so you didn't look like you were fiddling with the car too long.

Yeah but the scenario we're talking about is:

> If you're caught placing an AirTag on someone's car

So you're actually literally caught with your hand placing the AirTag on the car.

Your argument isn't very convincing. AirTags are one of the few location tracker that the public can recognize by sight and identify its use. This makes AirTags much less effective for use by malicious actors than other generic black-plastic case electronics.

My friend just had someone jack up his car and hack off a catalytic converter with a hacksaw in broad daylight, to steal it. How long does it take to place an airtag, 3 seconds? I think the chances of you being caught placing an airtag are slim to none.

A bit of an off-tangent: does your friend live in Seattle? Because catalytic converter and bike theft in broad daylight have become a staple here, but it is definitely not the norm in other cities.

So I wouldn't judge how easy it is to do something like that in general, based on a city where the prosecution is notorious for letting all kinds of criminals get released the morning after, which leads to the police not bothering with "minor" crimes like this (i.e., what's the point, if they will just get released the morning after and you waste both your time and the department time).

Catalytic converter theft is big everywhere, unfortunately. It's most common in larger cities, but it's worth the effort for thieves to travel out of town as well.

[catalytic converter theft map] is a productive search with some graphics, some dating back years: https://www.google.com/search?q=catalytic+converter+theft+ma...

Not intending any greater point about AirTags.

Cat theft, and petty property crime in general, is way worse in the cities that decline to prosecute which basically boils down to "the west coast and a few pinpoints on the east coast."

I hear this opinion (or something like it, basically that property crime is only an issue in the west because city governments are not harsh/violent/punitive enough) repeated often.

My anecdata: I live in a city where cops can and do whatever they want to people without serious oversight. Petty theft is met with both maximum violence and prosecution. it does not seem to have much effect on crime rates.

Washington, DC, does not decline to prosecute, but there was a rash of catalytic converter thefts in my neighborhood not that long ago. I'd have guessed that these thefts are tied to the popularity of hybrid vehicles, in particular Priuses.

cat theft?!

I would assume dogs have higher resale value on Craigslist

Citation?

nah, it's a town in UK

I can't make sense of what's going on with prosecutions there, sometimes I hear about people getting away with major crimes, other times some poor sod gets charged for possessing 'material useful to terrorists', The Anarchist Cookbook, which you can buy on Amazon.

https://www.bbc.com/news/uk-england-northamptonshire-5892603...

It's only less effective if it's somewhere that can be seen. I think most people don't check the insides of their wheel wells more than, well, at all. In which case the device could be neon green and it wouldn't matter for the purposes of visual detection.

You clearly have near 0 relationship with the public. The public can't identify an AirTag; most have hardly heard of the thing. And even if they did, someone's story of dropping a thing would convince 99% of people who want to be doing anything else than running BS detection on some weird person they've happened upon.

> Most people aren't aware of GPS trackers other than movies and think they are much harder to come by. AirTags are also less nefarious by nature. If you get caught with a GPS tracker on your person that's pretty suspicious.

These are used in RC a fair amount, not sure why it'd be anymore suspicious than having an AirTag

Security by obscurity is not security at all. Thinking you were safe because “people didn’t know about it” is not safety at all! Bad people are going to be bad. They don’t need AirTags for that. Knowing it can happen is far better for everyone to know about than living in a false sense of security.

As someone who has been in this field professionally for almost 20 years, my thoughts on this have changed quite a bit. The idea of condemning security through obscurity traces back to cryptography, not security in general. In cryptography, you want the security of your protocol to not depend on the protocol being secret, but the cryptographic keys themselves being secret. There are a lot of good reasons for this, the main one being that the whole point of cryptography is to create protocols that can survive public scrutiny and thus are more easy to implement and more robust.

So for example, without cryptography you'd need to secretly pass a message by courier who might take a secret route, constantly changing his route and delivery time. With cryptography, you can encrypt and sign the message, and then broadcast it over an insecure channel. The second option is much easier than the first. So the whole enterprise of cryptography is based on the principle of abandoning the confidentiality of the protocols themselves.

But there are many situations that require security which are outside of cryptography, because the security of the overall system cannot be reduced to high entropy secrets, and in that case, there is some security benefit that is obtained from obscurity.

For example, we are concerned about username enumeration because we understand users choose weak passwords that might be found in databases, so we do not publish usernames and consider it a vulnerability when usernames are leaked.

As another example, we consider information disclosure consisting of stacktraces leaked to the user to be a vulnerability.

Similarly, there are data centers that cannot just get up and move, and so locations and protocols of these installations are also kept secret.

So while it's true that things which are hard to change should not rely on secrecy in order to maintain their security level, and we should constantly be improving and hardening our protocols so that they can resist public scrutiny, nevertheless it's not the case that all protocols have been or are able to be improved so that their security properties are reducible to high entropy bit strings - in fact most systems don't fall into this category and most will never fall into this category - and for these systems, part of the security will continue to rely on obscurity, even though we are painfully aware of the drawbacks of this approach.

Even in cryptography, there can be value in obscurity.

For instance, suppose you have a system that uses the latest well-known encryption algorithm. You keep the keys secure. Of course.

Now suppose you have an alternative version of the system which super-enciphers all traffic with a fixed and physically protected key. Clearly, if that key is known then the system is no harder to attack than a system without the super-encryption. If the key to the super-encryption is not known, this adds considerable security against, say, successful key interception. Essentially, you are adding diversity of mechanism so that attackers have to multiply and diversify their attacks.

So security-by-obscurity can be a useful adjunct. It just can't be the whole story. Also, it isn't something you should talk about which means that the conversation about such techniques tends to be dominated by people who don't have practical experience with expert and well-financed adversaries.

The intelligence community is very well aware of these factors. That's why they try to protect the integrity of their hardware so much. That also why they don't talk much about the pragmatic aspects of their encryption machines.

Obscurity is not a good primary line of defense. But there's no reason why-- all else being equal-- it can't be part of a more robust setup. The more obstacles the better: like simply not using standard port #s for services so that it takes more than a quick scan of common ports to find something. Simple, and sure easy to defeat, but it takes you off the list for the lowest having fruit of targets.

Security by obscurity is actually pretty good security. Obviously but fool proof, but pretty good. Of course it depends on how good your obscurity is. Plain text passwords are not very obscure. And thus is mainly where the phrase comes from.

Great for business' network effects: you have to have an iPhone 11 or above (U1 chip) to avoid being tracked

Behind its "privacy" PR, Apple is secretly nudging people to buy more iPhones again...

Past tricks to make people upgrade:

1. Slowing down: https://www.bbc.com/news/technology-51413724

2. "Other" storage: https://developer.apple.com/forums/thread/666721

You're surprised a company making a product wants consumers to buy their product?

How does the "slowing down" story keep coming up when it's clear it was the best solution to the problem "what to do when users have the same battery for 3+ years and the device literally cannot sustain itself anymore".

Not surprised, just a hypothesis on hidden tactics behind.

As for your question, do you really trust in Apple's PR? "Privacy, green, ethical labor"

Oh almost forgot, another case:

3. https://www.cbc.ca/news/thenational/complete-control-apple-a...

Well, the way I see it is that in the counterfactual world where they didn't downclock, someone who doesn't "trust in Apple's PR" would conclude that the lack of downclocking is so that phones would turn off randomly, nudging people to buy a new phone.

Or they will just be left with a poor brand experience and switched to Android.

Using this logic, please explain the pattern with #2 and #3.

It’s doesn’t require the U1 chip.

3 days: https://www.youtube.com/watch?v=sPqiQiKN284

I see: https://www.pcmag.com/how-to/apple-airtag-tips

Not so good for Android: https://play.google.com/store/apps/details?id=com.apple.trac...

What’s your point?

AirTags don’t require the U1 chip. It is required for precision finding.

Seems like I’m entertaining a bad faith argument.

My point is that people without iOS 14.5 (older iPhones), iphone 11 or later will either be forced to upgrade or switch from Android (bad app reviews) to avoid being tracked - a dirty trick by Apple to gain customers.

Some people might brush notifications - either be 3 days as the reporter suggested (self tag) or right away as OP (stranger's tag)

Just a hypothesis, but Apple has a history of doing this as seen in 1,2,3 above. Its PR is genius, always spinning the narrative.

#3 update: https://www.youtube.com/watch?v=9l3f1KrMQeo

iOS 14.5 goes back to iPhone 6s which came out in 2015. It seems more than reasonable that it wouldn't support devices older than that.

No iPhone or Android device available actually prevents you being tracked.

No smartphone prevents someone wanting to track you from using a cheap GPS tracker, Tile or another old cellphone to trace your location.

Airtags aren't made for tracking people and are actually the only tracker that will alert anyone at all of their potentially unwanted presence.

Trivially possible? I wouldn’t know how to use or where to buy a GPS tracker. I’m sure it’s not super hard. But not as easy as an airtag.

But now anyone with an iPhone can buy a $25 device and track anyone. I would guess that Airtags are also smaller than gps trackers.

> where to buy a GPS tracker.

Have you heard about amazon.com? There are multiple around $20 devices there.

so if you want to track people/pet, are the word that spring to mind "GPS tracker" or "air tag"? What happens when you google "GPS tracker"? NOTHING shows up?

Before AirTag which was only a year ago, did bad actors just sit there thinking to themselves: "man I wish there was a technology to track people, I wish I knew what it's called"?

I thought that too. Google GPS tracker and the first result are trackers for about $30. They come with a SIM Card and and a Online Service for $5 so you can track the tracker. Also comes with an alarm if someone removes the tracker. This is really trivial...

But still not as trivial as an Airtag. You need an iPhone and an Airtag. That’s it. No extra service. No waiting non-Prime or non-Apple shipping for a tracker to arrive.

The first results in Google for me are $50 and are about 10-20x the size as an Airtag. Also multiple parts.

And, the units off Amazon have to be purchased with a credit card + shipped to your house. AirTags can be bought with cash much more anonymously. (Though I’m not sure how/if Apple can identify the associated iPhone if presented with a warrant.)

Walk into a hobby shop, buy a GPS tracker for a RC/drone, pay cash…

I am wondering:

- Would a GPS tracker placed at this position be able to catch the GPS signal? If I understand it correctly, an airtag communicate via bluetooth and would get the location from a phone in range?

- An airtag do not require a SIM card. Are they easily traceable or is it hard to get to the owner?

A GPS tracker in the wheel well would have no problem getting signal, GPS receivers have gotten spookily sensitive in recent years. And that's a genie that won't go back in the bottle.

> An airtag do not require a SIM card. Are they easily traceable or is it hard to get to the owner?

I turned my laptop into a functional airtag one bored day. Not sure how to get the data from apple with a Mac because it requires a bit of hackery due to them not having a public API but it can be done using their email app IIRC.

They store the encrypted location data on their servers so without the private key nobody can read it which also means nobody can determine who owns the tracker — I’d imagine they could use access logs or something to figure out who’s been reading the public key which the tracker broadcasts.

TFA could have not thrown the airtag away, read the serial number off it and used that as a “clue” methinks.

I actually want to get an esp-32 and turn that into a airtag but I’m lazy and would also need to buy a Mac so…though I’m not too lazy to code up a little daemon which will set off the beeper on every airtag in range once I get ahold of one.

I see some parallels here to cases like "Google Glassholes"[1] or the "Sony see through camera" [2]. Both turned to be PR problems, even though technically the companies did not do anything that was not already otherwise possible.

[1] https://nypost.com/2014/07/14/is-google-glass-cool-or-just-p... [2]https://bettermarketing.pub/sonys-see-through-camera-disaste...

In Australia to activate a sim you need a form of ID, if you were to put a sim card in a GPS tracker you could easily be identified. air tags not so much.

Easy, use a foreign SIM and roam. This is pretty common for IoT devices.

Still, even if not linked through purchase, the device will communicate back to a number controlled by you, fairly directly. A lot of obvious and hard-to-mask effort to emulate something that's provided as a COTS package with far harder tracking back to you.

TL;DR: this was possible previously, for fairly determined and advanced users; now it's available to anyone on a whim.

> In fact, this is news we're hearing about because of the steps Apple took to make it harder to use these devices for bad purposes.

I've got Android. Where do i see a warning?

Ps. No, people with Android will not have a Apple app installed. It's the wrong solution for that problem.

How is it the wrong solution? An app is required for any of this to work/be detected. Either everyone jumps on the same bandwagon (Google joins Apple or something), or you install the app for the bandwagon that exists.

? No.

An app must be installed to detect abuse, who would install that preventively?...

For setup, sure that's possible as an app. But my comment was "where do i see a warning", as in : detect abuse.

A protocol should be implemented, so it can be implemented on a more broad os level.

In reality: no one will install an app for a potential abuse and i can't imagine someone would think otherwise. The people that are getting conned are obviously not the users configuring the AirTag.

> An app must be installed to detect abuse, who would install that preventively?...

> A protocol should be implemented, so it can be implemented on a more broad os level.

I don't understand, this is what I'm saying. "Either everyone jumps on the same bandwagon (Google joins Apple or something), or you install the app for the bandwagon that exists."

You need the software installed. Either everyone jumps on the same bandwagon and everyone provides the app/system service with their phone, for the same protocol, or everyone has to install an app/system service that supports whomever's specific protocol. This has been the case long before apple, with Tile, Samsung, etc.

> who would install that preventively?

With the unfortunate consequence of causality and forward direction of time, everyone that has a phone that doesn't already have it as a system service, until everyone jumps on the same bandwagon and agrees to supporting one specific protocol. What's the alternative here? Regulate all tracking devices so they can't be sold until all phones can detect them?

> AirTags will also beep if they're separated from their owner.

Why didn't the AirTag beep in this situation? She said she went around the car trying to find it.

They begin beeping at a random time between 8 and 24 hours after separation, not immediately. Probably it was still too soon?

It's a tricky timing to work out, I guess. You want to warn people about trackers near them, but you don't want someone e.g. leaving their tagged bag in their locker to cause loud beeping after 30 minutes.

I’m sure it’s trivial to physically disable the beep speaker.

Indeed, a Google search is enough to find guides, and I assume most bad actors would be aware of this.

Well, anything that involves precise drilling isn't really what I'd call "trivial". But it's definitely doable.

"GPS trackers designed to be magnet-attached to a car which report their location via cell signal cost ~$20 on Amazon. You then tend to need to pay for either a SIM card or a subscription to the device maker's service -- bringing you up to about the cost of an AirTag. These are much harder to detect, as you might imagine."

Yes ... but Apple has built a mesh network to report the position of people who don't want to be tracked ... and clearly are being tracked. And it's very possible my own iphone is being used in the service of an evil actor. That feels ... different. Ethically -- if not technically.

"It's tricky to make something that lets you find where you dropped your keys while walking the dog that can't also be used for nefarious purposes." This seems awfully blithe. I suspect you aren't a woman. Or that you don't have daughters old enough to live on their own.

> Yes ... but Apple has built a mesh network to report the position of people who don't want to be tracked ... and clearly are being tracked.

Sure, but you could say the same thing about the cell network. Same argument applies to the cell GPS trackers I mentioned.

> And it's very possible my own iphone is being used in the service of an evil actor.

You can turn if off if you want. `Settings > Apple ID > Find My > Find My iPhone` and uncheck `Find My network`. I do appreciate that the power of defaults means that you personally disabling it doesn't really do much to the overall situation, though.

And both should be simple for the police to link to the owner, if they are reported. Maybe a bit less so for a SIM card, but that AirTag is registered with someone’s phone

"So not even Apple knows the location of your AirTag or the identity of the device that helps find it."

Correct. And if you read that carefully, it does not say that Apple doesn't know who the owner is. The owner, in this case, is not whose phone reported the tag.

neither of those statements say anything about identifying who purchased the air tag and what apple account is tied to the air tag.. you do realize that for someone to be able to find the location of the airtag, it has to be tied to their icloud account? the airtags have a serial number. it's trivial for apple to identify what icloud account is associated to the tag by serial number..

I suspect your estimate of the commonality of such behavior reflects more on you and your social group’s predilections than anything

> I suspect your estimate of the commonality of such behavior reflects more on you and your social group’s predilections than anything

I said nothing of the commonality, only the relative proportions. You're the one assuming things in absolute terms.

Do you disagree that there's probably more people out there wishing to cause someone to lose sleep vs. steal cars and abduct people? If so, see above quoted text.

>Wanna take a guess as to how many assholes out there just want to make a mouthy cunt from the bar lose sleep

Hey it might be easy to forget we're talking about a real person here, and I'm sure you mean this is how a hypothetical person could be perceived by another hypothetical person, but this kind of language directed at a victim of a stalking attempt feels really icky.

Just emphasizing the reality of how assholes in bars can view and treat people, which is part of the point being made; it's icky, and there's plenty of that to go around. Now there's AirTags at their disposal, for better or worse.

For the record I'm a mouthy cunt in a bar after a few drinks.

Why exactly is it lower effort than a cellular GPS tracker from Amazon? They're around the same size, and roughly the same cost.

> Why exactly is it lower effort than a cellular GPS tracker from Amazon? They're around the same size, and roughly the same cost.

Apple is going out of its way to assist in making AirTags discoverable while physically hidden and anonymous.

Some random cellular GPS tracker from Amazon gives the tracking capability, but how does one make it seem threatening while highly discoverable? You'd have to leave it out where physically visible, making the whole charade substantially less convincing.

When you open a GPS tracker you find a SIM and that's enough to identify the owner in any country that requires an ID to get a SIM. AirTags are anonymous by design AFAIK. Furthermore the owner is spared with the burden of getting a SIM (time and cost), ID or not.

AirTag also has an account linked to it. It’s required to function. In fact, if you find an air tag, you can scan it and it shows the serial and the last four digits of the owners phone number. I’m sure Apple will give the full details to the authorities, if requested.

While I'm sure there are countries that require that, you don't have to provide an ID to get a SIM in the United States. You can go buy one off the shelf (with service included) at Walmart for around $10, in cash.

> that's enough to identify the owner in any country that requires an ID to get a SIM

The process that it takes to identify the owner of a SIM card is no different, and likely more difficult, than the process to identify the owner of an AirTag.

How is a common consumer-grade device not less effort than intentionally purchasing, setting up, and deploying a custom spy gadget? They're totally different levels of effort and investment (dollar-'cost' being a small part of it). With an airtag you can even get plausible deniability in a lot of cases.

> This is news just because it's an Apple device being used for something that was already trivially possible.

> GPS trackers designed to be magnet-attached to a car which report their location via cell signal cost ~$20 on Amazon. You then tend to need to pay for either a SIM card or a subscription to the device maker's service -- bringing you up to about the cost of an AirTag.

So you're saying Apple made it even more trivially possible. Not only does it cost the same, it now requires less effort.

In one way. In another way, the only way the tweet author knew was because Apple alerted them to the fact that they were being tracked.

Other trackers would not do that. It seems Apple actively put effort into thwarting this kind of use.

meta irony! The device that informed you that another device was tracking you is, of course, already tracking your every move.

They did the bare minimum so that once in a while creepy stalkers will get noticed. Should we give them an award?

Nah, just recognize that the tech already was out there, for a lower cost, in a form factor that won't notify you you're being tailed

This isn't a new thing and Apple takes steps that, for example, Tile doesn't to prevent their products from being used for nefarious purposes

I do recongnize that. Does only the first person selling a dangerous product deserve scorn? "X did it first!" is the excuse of a toddler.

They've also made it easier than gps trackers (no sim card needed), probably safer for stalkers (does Apple have a way to report AirTags used for crime and/or find out who owns it?) and it's more effective than Tile.

It also favors their own ecosystem, because only iphone owners get warned. (no I don't consider beeping enough, finding something that beeps intermittently is notoriously difficult).

Beating up on Apple for making something LESS able to be abused and more transparent/understandable just seems disingenuous though?

The difference in level of abuse for something that will actively draw attention to itself after some period of time vs something of the same cost that was previously widely available and was more subtle and would not, is pretty big. And it is in the favor of Apple not being abusive or favoring abuse.

So if there exists anyone who does something slightly worse, everyone else gets a pass? Our prisons will be emptier at least.

So if someone makes something better and not a good idea to abuse, they’re terrible?

"better" does not mean good. This _is_ easy to abuse, which is my issue with it.

The protections in the system feel more like PR shields than effective deterrents.

I'm saying anyone who wanted to do this already could, and Apple's version is worse at being abusive than what they could already do.

Sticking trackers onto the cars of people parked near bars isn't really a thing you do on a whim.