openhaystack

AirTags have a lot of privacy protections. The stalkers were only caught because they were dumb enough to use their own identifiable Apple IDs. Just creating one with a fake protonmail email will make it quite difficult, though you will also have to purchase an iOS device just for that. Still not unthinkable. You can even build your own tracker for some apple's network: https://github.com/seemoo-lab/openhaystack

I know :) [1]. It's just the usual response to any of those "creep stalks victim using Airtag" article popping up here repeatedly in the past. I first thought it was one of those again. [1] In case anyone wants to read a bit more about this: Secure Mobile Networking Lab has excellent information about how all this works: https://github.com/seemoo-lab/openhaystack and its linked references.

Would be much easier to script that all out and have a single Bluetooth device. https://github.com/seemoo-lab/openhaystack#how-to-track-othe...

I think it is important to mention that clever people already managed to reverse engineer the Apple "Find My" network/protocol to "make tour own airtag" : https://github.com/seemoo-lab/openhaystack This notably allow one to easily create a tracker that is silent and potentially smaller than an AirTag. Also easier to hid in a daily object since all you need is basically a nRF51822 and a battery. People who don't own an iPhone, or in general a recent iPhone might be tracked without their knowledge (and, obviously, their consent). The potential of misuse of this kind of tool is so great, we should really regulate against those.

> I feel like this is ignoring the fact that if any company other than Apple made these trackers, it wouldn't do this with anyone's phones. Right, and Apple have provided everything that AOSP would need to implement this, someone even made their own version of the entire Find My client long ago (https://github.com/seemoo-lab/openhaystack), so technically AOSP could even integrate using Find My, although I imagine Apples lawyers would have a field day with this if they did. Identifying the AirTags has also been implemented as a background service by the same organisation as above (https://github.com/seemoo-lab/AirGuard). > I guess they could make the packaging more tamper resistant somehow, but again this is kind of shifting the goals a bit. I don't think it's reasonable to expect that every device will be physically resistant to modificat

If I understood correctly, this still doesn't protect you against custom Airtags using embedded boards[1]. You could just use any serial number you want and maybe even incriminate other people by using the serial number of their authentic Airtag? [1] https://github.com/seemoo-lab/openhaystack/

Or you can load your own firmware to any other embedded device with Bluetooth and also make it totally undetectable from iPhones by changing keys frequently and making it appear like multiple different AirTags. https://github.com/seemoo-lab/openhaystack/