News for hackers. Stuff that matters.
Re:Apple and Google deliver support for unwanted tracking al... by vlovich123 on Monday May 13, 2024 @07:46PM (#40349931)
Think about it this way - without AirTags and with AirTags + anti-stalking, your bike theft scenario is unchanged. Without airtags and with AirTags without anti-stalking, your personal safety scenario is worse. Those are the discussions I remember when I worked on CoreLocation at Apple. It had nothing to do with running the numbers, at least pre-development. I would be slightly surprised if someone tried to put numbers to that - Apple is pretty values-based when it comes to those kinds of decisions.

The stalking issues go well beyond personal safety. Police officers, judges, politicians and cops who now have to worry about someone chucking a $25 airtag in their car which is much easier to do innocuously and those people have power to craft regulations and laws. Abortion rights are even more contentious now & stalking comes up there.

There just isn't a scenario where opting in the entire world-wide smartphone community into enabling mass stalking at a never before price point is a net positive - there just aren't enough poor people with stolen bikes to shift that equation. There's a reason AirTags destroyed Tile - Tile's network is laughably small & would always be that way compared with the reach you get at the OS level. That drastically shifts the threat model.

Re:Apple and Google deliver support for unwanted tracking al... by kstrauser on Monday May 13, 2024 @07:59PM (#40350023)
We'll never know. The personal safety issues are important and I'd never argue otherwise. Having cheap, effective crime deterrence seems like it could be a nice thing if you could wave a magic wand and remove the stalking angle. Apple keeps adding features to those ends, like the new Stolen Device Protection updates, that shift the risk-reward math for device thieves. I could still buy a cheap used phone and stick a SIM in it, hide it in a victim's car, and use that to track them without alerting them to it. And still, we get nice tools like Find My because more people are likely to lose their phone or have it stolen than to stalk their exes with it.

I understand the personal safety issues. They're important. I get it. That doesn't stop part of me from wishing I could use these cheap, convenient lost item devices to help me track down stuff that wasn't exactly accidentally lost.

Re:Apple and Google deliver support for unwanted tracking al... by vlovich123 on Monday May 13, 2024 @09:24PM (#40350611)
Buying an old phone or watch and using FindMy is a compelling counter argument. The problem is that the cost of that is meaningfully higher - it’s a $25 one time purchase vs ~$50-100 + a recurring ~$30/month. The size of the device is another one - the phone or watch is substantially bigger than an AirTag (or how small an AirTag could become over time). Finally, a phone or watch has a much shorter battery life to support tracking. You could trade off accuracy for a much longer battery life, but you’re still capped to maybe a couple of days or even a week if you really know what you’re doing. That’s compared with ~1 year of unattended AirTag use.

As for crime prevention, I think you’re overestimating how much of a benefit that would have. Stolen device protections remove the value from the stolen device. That’s not the case for your stolen bike - thieves don’t actually care if you can track the device because a) knowing where your stolen property is doesn’t actually aide in it getting recovered b) as long as they can move the stolen product along quickly enough the information becomes too stale to action on it (remember - police usually need a search warrant). My cousin’s car got stolen with AirTags in it but he got lucky in that the police did something about it - plenty of news stories of AirTags in cars with people trying to get the police to do something and the police not being able to for a variety of reasons. And that’s cars which are orders of magnitude more expensive than bikes that police won’t bother with. Look up VanMoof theft stories to convince yourself that tracking is useless: https://www.reddit.com/r/vanmoofbicycle/comments/zbexyr/upda...

Re:Apple and Google deliver support for unwanted tracking al... by diebeforei485 on Tuesday May 14, 2024 @01:45AM (#40351993)
Smart watches are not meaningfully larger than airtags if you take the wristband off, and a cheap prepaid plan for $5 or $10 would be more than sufficient. You also don't need FindMy because the cell network itself can triangulate.

There are also dedicated devices, such as this one - https://www.t-mobile.com/devices/iot/syncup-gps-tracker-devi... - and lots of companies in China make similar products.

There is a genuine need for anti-theft technology. Apple doesn't have to address that market, likely because they're afraid of brand damage, but stalkers already have plenty of options available.

Re:Apple and Google deliver support for unwanted tracking al... by vlovich123 on Tuesday May 14, 2024 @10:32AM (#40355622)
As I said, the battery model is drastically different for active trackers. 7 days of surreptitious monitoring vs 1 year changes the risk profile of noticing these trackers / how many you can have before the logistics of recharging all of them wears on you. And if you’re unlikely to recharge each of these every single day, your protection drops on average to 3.5 days.

It’s not just brand damage - passive tracking using every single smartphone opted into the tracking vs active tracking where you have to expend more battery AND pay for an ongoing cellular connection each month is a tangibly different use-case with different threat models.

Re:Apple and Google deliver support for unwanted tracking al... by diebeforei485 on Tuesday May 14, 2024 @07:28PM (#40361337)
> And if you’re unlikely to recharge each of these every single day, your protection drops on average to 3.5 days.

This math doesn't make sense to me.

Re:Apple and Google deliver support for unwanted tracking al... by vlovich123 on Tuesday May 14, 2024 @11:27PM (#40362787)
I'm assuming you're waiting until the end of the 7 day battery life to recharge it (e.g. you recharge every Sunday) and I'm assuming the probability of a theft is uniformly random throughout the week. Thus, on average, you'd expect stolen devices to only have half the battery left because there's equally many stolen on the first day (7 days of battery left) as on the last day (0 days), equally many stolen on the second day (6 days left) vs penultimate day (1 day left) etc etc. At scale, that would average out to stolen property having attached devices having half the advertised battery life.

You can argue that you'd be more dilligent about recharging but I'd counter that at scale you'd be the outlier. On average I'd actually expect an average battery life when stolen closer to 0 because people wouldn't be diligently recharging them & reattaching them (i.e. either the battery life would be 0 or the device wouldn't be attached to the desired property).

Re:Apple and Google deliver support for unwanted tracking al... by diebeforei485 on Wednesday May 15, 2024 @11:36PM (#40374979)
I don't think people would only charge when the battery runs out. More likely people would charge weekly, say on a weekend night or during their weekly WFH day or something like that.

A 14-day battery life would then mean an average of 10.5 days of protection, which isn't too bad.

> You can argue that you'd be more dilligent about recharging but I'd counter that at scale you'd be the outlier.

I don't know about this. For bicycle users, charging their rechargeable headlights and taillights regularly (typically once weekly) is very much a habit already. This is just another thing to charge at the same time, which is a time they aren't riding their bicycle.

Re:Apple and Google deliver support for unwanted tracking al... by nsagent on Tuesday May 14, 2024 @10:56AM (#40355865)
Thanks for sharing your experience at Apple. It's really valuable to understand exactly how decisions are made at big tech companies, especially for sensitive issues like this.

That said, I'm saddened that the approach seems shortsighted, since it doesn't sound like it considered a holistic picture, but rather was based on a specific value judgement. This seems to put other issues, like the whiplash around the approach to CSAM into perspective.