Hacker Accesses Internal ‘Tile’ Tool That Provides Location Data to Cops
(www.404media.co)
from overflow64@lemmy.ml to privacy@lemmy.ml on 20 Jun 2024 21:50
https://lemmy.ml/post/17105433
from overflow64@lemmy.ml to privacy@lemmy.ml on 20 Jun 2024 21:50
https://lemmy.ml/post/17105433
#privacy
threaded - newest
Paywall.
But by the title, very disappointing to hear.
Not surprised though.
archive.ph/yJgue
They also share personal, location, and motion data with third-party advertisers as well as driving analytics services.
…zendesk.com/…/16038777217175-Life360-Privacy-Pol…
Oof. Us and over one hundred of our closest friends.
heh.
where’s the proof that they do?
Pro-tip: anytime they say “may” they mean “do”.
I prefer hard evidence to FUD
I am not uncertain, there is no doubt. You should be afraid.
Pro tip #2.
Any time they have your stuff - they will use it (sell it) sooner or later. Zero knowledge is the answer
I’m shocked, shocked I tell ya!
Clearly, someone was not thinking of the children
Add this to the list of products I won’t buy. Not that I would have before, but now it’s a rule rather than a preference.
thats probably a helluva list, easier to list corpos who are NOT doing it instead.
Very disappointing. Does Apple sell Air Tag data to 3rd parties?
Yes. They all do.
AirTag location data is encrypted. Apple doesn’t know where they are.
Right, apple definitely doesn’t have access to the info on the products they make and sell to the public.
Do you know how encryption works?
Have you verified their encryption method? Where is the source code? Where is the third party public audit that verifies that it’s implemented properly with no other means of access?
Blindly trusting that they say it’s encrypted is basically the same as no encryption
This is made up fantasy land paranoia. Charlie Day with a big board shit.
Yep apple is secretly grabbing data that not one privacy expert has found. Just like those sneaky Alexas that are always listening to me.
Here is the documentation regarding third party verification of their security claims.
support.apple.com/en-ca/guide/…/web
I’m assuming for some reason this is not good enough for you?
I mean, None of these appeared to specifically be about the air tag. But it is at least does help show a general overall commitment to security. So it’s not as if it’s not a huge point in favor of trusting that the airtag data is safe
On top of being privacy focused themselves, they are only working with AI parters who also pass a third party code review verifying that zero user data is stored.
Shit on Apple for not being repairable, sure. Shit on Apple for their walled garden, sure. But shitting on Apple over privacy is insane. They are they only big tech company that actually cares.
I used to hold the same opinion you do, but after reading this article, reality caught up with me:
nytimes.com/…/apple-china-censorship-data.html
If you want a shorter version of this that puts the consequences into perspective, I recommend one of Cory Doctorow’s blog posts: pluralistic.net/2021/…/unhealthy-balance-sheet/#t…
Taking the above behavior into account, Apple’s value proposition for anyone that cares about digital sovereignty is extremely brittle. I’ve decided not to invest any further into their tech. Is it the worst evil that roams earth? No. But does it logically follow that you should defend all their practices? Also no.
After reading the above, it shouldn’t surprise your that Apple spies on their users too, if only a bit less than, say, Facebook/Meta: pluralistic.net/2022/11/14/luxury-surveillance/#l…
Hope you can approach this with an open mind. I know it’s hard, I certainly didn’t want to start doubting what I thought was a valiant defender of consumer privacy. Cases like the San Bernardino shooter were testaments for Apple’s commitment to me. It turns out that’s only half the story though.
<img alt="" src="https://lemmy.world/pictrs/image/98903645-a748-451a-9720-42c199fa31ac.gif">
Do you know how decryption works?
Yes, only the person with the key can decrypt. Apple doesn’t have the keys.
That’s what the NSA said about DES. Fun fact: they were lying.
Learn your crypto war history.
They also “Didn’t have them” in the past and then gave them to the NSA. 🙃
Source? As far as I know they didn’t claim to not know location until iOS 17 release. Up until then they could access that info, and were required to give it up provided with warrants. This has been a reason Apple has actively been limiting the data they have access to. They cannot be compelled to give up data they have no way of accessing.
They sell AirTag location data? I honestly find that hard to believe. What’s your source on this other than big tech bad?
They don’t have one. It’s the new “Alexa is spying on you”.
Apple cannot sell your AirTag data, because they don’t know it. It’s all encrypted.
You read the leaflet. Nice.
Not relevant. I was just trying to say that you have to be very gullible to take a company’s word at face value.
Sure, it’s encrypted, but there might be a way for them to decrypt it.
It lives in the same place as your other inaccessible data, which Apple has been unable to produce when served with warrants for iCloud data and the like.
They say the same thing about some of the other data that they encrypt, but then they store the encryption private keys on their servers.
Encryption doesn’t mean they can’t see the data. It means only the people with the private keys (and those who can crack the private keys or a device with the private keys) can see the data.
One must know if the data is encrypted both at rest and in transit. What type of encryption is used. Where the private key is stored. And what are the protections in-place where the key is stored
They do outline all of that, explaining how it works. The private key pair and secret are never sent to Apple. And yes, it’s end-to-end encrypted of course.
help.apple.com/…/apple-platform-security-guide.pd…
Page 202 of you care to learn how it works.
Is the source code public so we can verify the implementation matches the spec?
It’s not open source if that’s what you mean. If you think that stops people looking at code then I’ll have some of what you’re smoking please.
If you’re genuinely interested in how the Find My system works Here’s a good paper on it. The papers publishers even have an open source tool to connect to Apples Find My network which is neat.
With proprietary software you have no way of knowing. Also avoid SaSS (service as a software substitute)
They should have hired their own hackers like Thor from piratesoftwear to find their own weaknesses. There are a lot of hackers out there that run services like that, and these companies should take advantage of that.
I’m sure they do, likely have their own internal security team as well as contract security work out. The purpose of hiring hackers isn’t to make the company unhackable, it’s to make it harder, more time consuming and costly to hack the company.
Aiming for a future in IT security, I find this branch of computer science somewhat ironic. You basically work to make your future work harder, i.e. you make things more secure, making your job of finding vulnerabilities even more difficult. Still a sucker for it, though
F
I used to be a big user of tiles from their early days but when they sold to that shady company I threw them away and did the California privacy right action for them to delete my data
I always thought the surveillance state was stupid even for the powerful. The problem is exactly what happened. They surveil their own security forces out of necessity. But if that info leaks it makes those proxies 1000% more vulnerable than the public they’re subjugating since way more people have a grudge against police and military personnel than some dweeb that watches Rick and Morty.
Authwall. Can’t read. Please always copy and paste the article contents into Lemmy when you share it
I’m not OP but running it through Wayback Machine worked for me: web.archive.org/…/hacker-accesses-internal-tile-t…
If not here’s the text of the article (but the link has a bunch of images too that might be useful):
Thank you!
No worries!
So can we now track the location of police? That sounds like valuable data that should be public
We need an open source smart tag. I recently researched how the landscape has changed and, as an android user, still nothing good in available. I’m not sure if I remember right, but Google’s find my device was supposed to be open source or at least open spec? Might be worth looking into how easy it would be to code a lil firmware for this network myself. As much as I’d love a tag for things I cannot lose, the current options are throwing money away for no actual useful tracking (Samsung), forfeit your privacy (Tile, perhaps others), sell your soul (Apple).
There’s a few 3rd party solutions that are compatible with Google’s find my device coming out this year. Pebblebee just released a few trackers, and iirc chipolo is working on one too.
“This post is for paid members only”. Sounds like a dare
I guess that crosses Tile off of my list of tracking devices for my belongings. Would I have to deal with an apple airtag then?