seemoo-lab

openhaystack

Swift2021–2026

seemoo-lab / openhaystack

openhaystack

Build your own 'AirTags' 🏷 today! Framework for tracking personal Bluetooth devices via Apple's massive Find My network.

Explore on GitHub Read Hacker News discussions

31Distinct people

39Mentions

0Explicit recommenders

14KGitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Build your own 'AirTags' 🏷 today! Framework for tracking personal Bluetooth devices via Apple's massive Find My network.

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

positive-security/send-my · linked in 2 of the same discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year39 dated mentions

Observed mentions: 2021-03-04 14:01:25 UTC to 2026-10-10 04:46:28 UTC.

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
2021	2021-01-01 00:00:00 UTC	2022-01-01 00:00:00 UTC	8	1	7
2022	2022-01-01 00:00:00 UTC	2023-01-01 00:00:00 UTC	7	0	7
2023	2023-01-01 00:00:00 UTC	2024-01-01 00:00:00 UTC	5	0	5
2024	2024-01-01 00:00:00 UTC	2025-01-01 00:00:00 UTC	10	1	9
2025	2025-01-01 00:00:00 UTC	2026-01-01 00:00:00 UTC	5	1	4
2026 (partial)	2026-01-01 00:00:00 UTC	2027-01-01 00:00:00 UTC	4	2	2

What Hacker News says

39 sources

notemaker·Oct 10, 2026

> 1. "Don't use safari" Why? Like everything else, it's tied to your Apple account. You risk losing your browser history etc. You _can_ export it if it happens, but it's easier to not have the issue in the first place. > 2. Is there an alternative to "Find My" that I can use with AirTag? https://github.com/seemoo-lab/openhaystack maybe? I haven't tried it.

In Ask HN: My Apple ID is locked for a week, Apple is a single point of failure

Bluestein·Sep 13, 2026Submission

OpenHaystack is a framework for tracking personal Bluetooth devices

2 points · Open discussion

mook·Aug 17, 2026

I remember somebody trying to hook into the Apple Find My network (that is, do things with AirTags). They did that by… being a Mail.app plug-in or something to get the correct entitlements? That certainly sounds like the wrong permissions. Ah, it was OpenHaystack: https://github.com/seemoo-lab/openhaystack#installation

In Apple's App Tracking Transparency treated its own apps better than rivals

BrandiATMuhkuh·Aug 10, 2026Submission

OpenHaystack: Reverse-engineered Apple's Find My network

6 points · Open discussion

np1810·Apr 2, 2025

Cool idea and this was nostalgic as well... I created a similar application to communicate and send beacon signals over SMS (using Twilio) without Internet (as internet went down) during emergency SoS situation motivated by 2015 Chennai floods... Suggestion: You can possibly try if you can use OpenHaystack [1] to send some "unknown tracker found nearby" alert to any nearby iPhone even if the receiver device doesn't have your app installed or use the FindMy network to send arbitrary data for your app's communication. [2] [1] https://github.com/seemoo-lab/openhaystack [2] https://github.com/positive-security/send-my

In Show HN: Offline SOS signaling+recovery app for disasters/wars

hackernudes·Feb 27, 2025

Here is my quick summary: Apple devices listen for BLE advertisements of a certain form to indicate a "Find My" network lost device. The lost device advertisements mainly contain the public key part of a key pair. The public key does not fit in the in payload of the advertisements, so it is stuffed into the address field. Edit: Only 46 bits of the full 224 bit public key is stored in the address field. In general anyone can make a "lost device" advertisement as demonstrated by OpenHayStack[1]. The requirement is the address field needs to be fully controllable. BLE advertisements have a header that indicates what kind of address is present (specified by 3 bits: Public, NRPA, RPA, Random Static). The lost device advertisements are supposed to be "Random Static", but the researchers found that Apple "Find My" listeners ("finders") will acce

Read the rest

pt advertisements for any address type. They use this fact to generate the private key part of a public key that matches an existing host adapter BLE address. The host adapter BLE address cannot generally be changed unless user has root/superuser privileges. This step is computationally expensive. However, private keys can be precomputed (rainbow tables) because a large chunk of the address is a manufacturer code (OUI). [1] https://github.com/seemoo-lab/openhaystack

In Turning a Bluetooth device into an Apple AirTag without root privileges

internetter·Feb 27, 2025

How does this differ from https://github.com/seemoo-lab/openhaystack Edit: It works without root. Follow up question: Can these discoveries improve openhaystack?

In Turning a Bluetooth device into an Apple AirTag without root privileges

abalaji·Jan 27, 2025

Looking through the code, it looks like this uses your personal Apple Mail entitlements to pull the locations that get collected by devices on the FindMy network: https://github.com/seemoo-lab/openhaystack/blob/8d214aa5eb68... I wonder if this were also possible by making an Apple developer account.

In Openhaystack: Build 'AirTags' – track Bluetooth devices via Apple's network

thunderbong·Jan 27, 2025Submission

Openhaystack: Build 'AirTags' – track Bluetooth devices via Apple's network

459 points · Open discussion

alphan0n·Dec 21, 2024

I’ve been using FakeTag[0] and OpenHaystack[1] coupled with a vibration sensor to notify me when various things happen around my house. Inspired by this [2] article. It’s worked flawlessly for ~2 years. [0] https://github.com/dakhnod/FakeTag [1] https://github.com/seemoo-lab/openhaystack [2] https://hackaday.com/2022/05/30/check-your-mailbox-using-the...

In Query Apple's FindMy network with Python

l8rlump·Dec 20, 2024

https://github.com/seemoo-lab/openhaystack/?tab=readme-ov-fi... These won’t inform, I believe.

In A 10-Year Battery for AirTag

denysvitali·Aug 24, 2024

Yes, with a strong emphasis on the proprietary part. Apple and Google both have their own networks. All the Apple devices (and now, rolling out, all the Google Play Services enabled devices) scan for nearby Bluetooth LE beacons (that use their protocol) and upload (with some cryptographic operation) the location of the device who found the beacon, together with the accuracy (signal strength) to a proprietary server (Google or Apple). Then, with the respective apps, the key holder can retrieve the reports for a given key hash and decrypt them to get the previous location. Technically speaking, anyone with the key hash can fetch the encrypted location reports from Apple / Google servers, but they can't decrypt them. On top of that, the key is rotating every 15 minutes (AirTag in paired mode) and there is no way to know that two keys are con

Read the rest

nected... unless you own the main key that is used to derive the rolling keys (see "update" and "diversify" in the linked paper). Now, all of this is fantastic, until you think of this as a monopoly. Apple and Google get an interesting tax on every device that gets built and joins this network (IIRC it's 4$ for partner devices in the Apple network). My problem with this is that no-one else other than Google and Apple can build an "open" network - you'd have to find a way to push your code to everyone's devices. I'm surprised no-one is investigating this unfair practice. See: https://doi.org/10.2478/popets-2021-0045 and https://github.com/seemoo-lab/openhaystack

In Did you lose your AirPods?

solarkraft·Aug 20, 2024

There are a few projects for this. Check this out: https://github.com/seemoo-lab/openhaystack/tree/main/Firmwar...

In FindMy Flipper – AirTag and SmartTag Emulator

mintplant·Aug 19, 2024

How? The README [0] states that a Mac is required. Do you mean that you use the Find My network to keep track of your Linux machine's location (as described in [1]), but not to locate devices (which requires either macOS or a proxy server running on macOS)? [0] https://github.com/seemoo-lab/openhaystack?tab=readme-ov-fil... [1] https://github.com/seemoo-lab/openhaystack/tree/main/Firmwar...

In FindMy Flipper – AirTag and SmartTag Emulator

rekoil·Aug 19, 2024

You can, there's been ESP32 firmware out for years that does this: https://github.com/seemoo-lab/openhaystack/tree/main/Firmwar...

In FindMy Flipper – AirTag and SmartTag Emulator

Showing the 15 most recent of 39 sources. Enable JavaScript to search and browse every indexed mention.