Thanks! Have you considered evaluating the “AppClose” platform in a similar fashion? It is used in family / civil cases to my knowledge. Perhaps another worthwhile avenue of study, perhaps not. Thank you for your time.
mspecter 1 hours ago [-]
Interesting! Hadn't heard of it.
ollien 1 hours ago [-]
It's interesting to me that other trackers have end-to-end encryption. I wouldn't have expected it but makes sense for the threat model.
> Providerslike Apple and Google achieve location indistinguishability by end-to-end encrypting location information using a public key embedded in BLE advertisements emitted by a tag
Though it makes me wonder... What's the private key? If the public key is attached to the tag, how is the device getting it? I'm guessing it gets shared during pairing.
Very cool! I only skimmed Section 4 a bit, but that's really cool!
I was going to ask how the web UIs possibly work if the location is indistinguishable, but I went to the Google Find Hub, and it appears you can't view the location for tags unless you enter your phone's pin code / pattern lock. This must either communicate with the phone or the keys are stored on Google's end.
EDIT: I turned my phone off, and I can still get the location of my keys... surely this doesn't mean the key is stored on their end? Wouldn't be very good E2EE in that case :)
izacus 4 minutes ago [-]
The encryption key is derived from your PIN, it doesn't need to access the phone to do a new derivation.
miki123211 33 minutes ago [-]
AFAIK, there's a pre-shared key exchanged during pairing, and you then calculate keypairs based on (key, timestamp).
Rotating your keypairs in that way prevents attackers from identifying you across time. E.G. if they link a particular keypair to you — let's say at an Airport security gate — that doesn't let them know you've entered a lawyer's office a week later, because that's done under a different, unrelated public key.
I dont get why this is really an issue when there are devices on Temu you can easily buy that are actually designed for stalking. Why would anybody with a genuine nefarious purpose spend their time hacking a tile when they can just buy a generic Chinese gps transponder?
Karliss 2 hours ago [-]
Generic GPS transponder (containing GPS receiver + some kind of data connection) will have limited battery life.
Systems like Tile, AirTag can last much longer with smaller battery and overall dimensions by offloading GPS and long data transmission to other devices. Strength(and dangers) of devices like this is in the size of tracking network not necessarily the hardware itself. Even better if you don't have to plant the tracker onto victim, because victim bought it and is intentionally carrying with themselves.
duxup 1 hours ago [-]
In that case you have to plant the transponder yourself.
In the case of Tile, everyone using Tile has tagged themselves (unknowingly) for you.
The consumer who didn't know they tagged themselves would understandably have a complaint.
InsideOutSanta 2 hours ago [-]
Criminals, particularly heavily disordered ones like stalkers, are usually not the smartest people in the world. So increasing the barrier of entry just a little bit might substantially decrease their practical access to this type of technology.
1 hours ago [-]
cindyllm 1 hours ago [-]
[dead]
mplewis 1 hours ago [-]
Suppose the person you want to stalk has bought a Tile that they use for themselves, not knowing that these devices are insecure. If you scan for that device, you can follow that person without even having to plant a device on them. You don't have to hack their Tile.
braiamp 2 hours ago [-]
Because it serves a nefarious purpose: to smear the company that makes these devices. I would not be surprised if this is part of some kind of campaign designed to restrict or damage someone.
EdwardDiego 2 hours ago [-]
You went straight to conspiracy?
braiamp 1 hours ago [-]
The title obviously has a slant, because the text of the article doesn't support it. So, yeah, I'm saying the title has a specific goal in mind.
Dylan16807 1 hours ago [-]
The text seems to support it to me, but more importantly "saying the title has a specific goal" isn't answering the question. Yes the title is calling out the company. What takes you from there to some kind of broader campaign.
2 hours ago [-]
kefabean 3 hours ago [-]
Does anyone know whether https://mygrid.app/ is trustworthy? Development had been glacial, but looking at their website it seems they finally support degoogled android which is a huge step forwards.
octoberfranklin 3 hours ago [-]
BBP;DR (Broken Bot Protection; Didn't Read)
Loops forever at
blog.adafruit.com
Performing security verification
This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot.
gruez 1 hours ago [-]
I never understood this. You can pass turnstile challenges on tor browser in a linux/windows VM, of all things. What unusual browser config are people using to trigger a block?
Y_Y 1 hours ago [-]
I use a DPRK VPN
chrisjj 7 minutes ago [-]
[delayed]
stackghost 3 hours ago [-]
Passing the security verification succeeded for me (firefox on a mac, with ublock origin).
dreamcompiler 3 hours ago [-]
This explains why I'm seeing commercials for Life360 now for the first time ever: They've developed a new revenue stream by selling everybody's location to advertisers.
Now deleted from my family's phones.
PLenz 3 hours ago [-]
That was always the revenue stream, the devices were just a way to get you to give it to them. It's been a minute since I was current on who gets what in the HMD world but I think that data ultimately flows to Placer.ai
alt227 2 hours ago [-]
Whats the connection between an advertiser knowing your location, and ads from Life360?
mplewis 1 hours ago [-]
Life360 increases their marketing budget when they have a profitable way to sell user data so they can get the devices into the hands of more target users.
kotaKat 2 hours ago [-]
"But, but, the Tile TOS says they'll fine a stalker a million dollars!"
Life360 is such a skeevy bullshit company.
mawadev 2 hours ago [-]
What the hell is Tile?
evanjrowley 2 hours ago [-]
cross-platform forerunner of the Apple AirTag
internet2000 2 hours ago [-]
AirTag alternative
alt227 2 hours ago [-]
Thats what google is for.
kerrieshitz 2 hours ago [-]
[dead]
user00005 2 hours ago [-]
It isn't that difficult to just not lose things.
People love to over complicate their lives with technology, giving up money and privacy in the process.
rafram 1 hours ago [-]
There are plenty of times when you have to trust someone(s) else with your belongings, sometimes for a very long time - say, airline baggage, bus luggage compartment, hotel left luggage, or gym lockers - and it's useful to have a tracker (ideally a more secure one, e.g. AirTag) in case anything goes wrong.
And even if you're the type of person who never lets their bags leave their sight, nobody is immune to their keys slipping out of their pocket in a taxi.
[1] https://akumar805.github.io/
[2] https://annaraymaker.dad/
> Providerslike Apple and Google achieve location indistinguishability by end-to-end encrypting location information using a public key embedded in BLE advertisements emitted by a tag
Though it makes me wonder... What's the private key? If the public key is attached to the tag, how is the device getting it? I'm guessing it gets shared during pairing.
I was going to ask how the web UIs possibly work if the location is indistinguishable, but I went to the Google Find Hub, and it appears you can't view the location for tags unless you enter your phone's pin code / pattern lock. This must either communicate with the phone or the keys are stored on Google's end.
EDIT: I turned my phone off, and I can still get the location of my keys... surely this doesn't mean the key is stored on their end? Wouldn't be very good E2EE in that case :)
Rotating your keypairs in that way prevents attackers from identifying you across time. E.G. if they link a particular keypair to you — let's say at an Airport security gate — that doesn't let them know you've entered a lawyer's office a week later, because that's done under a different, unrelated public key.
Systems like Tile, AirTag can last much longer with smaller battery and overall dimensions by offloading GPS and long data transmission to other devices. Strength(and dangers) of devices like this is in the size of tracking network not necessarily the hardware itself. Even better if you don't have to plant the tracker onto victim, because victim bought it and is intentionally carrying with themselves.
In the case of Tile, everyone using Tile has tagged themselves (unknowingly) for you.
The consumer who didn't know they tagged themselves would understandably have a complaint.
Loops forever at
blog.adafruit.com Performing security verification This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot.
Now deleted from my family's phones.
Life360 is such a skeevy bullshit company.
People love to over complicate their lives with technology, giving up money and privacy in the process.
And even if you're the type of person who never lets their bags leave their sight, nobody is immune to their keys slipping out of their pocket in a taxi.