Apple's Find My feature requires two devices, boasts extreme security safeguards

Posted:
in General Discussion edited June 5
A report on Wednesday digs deep into Apple's new Find My service, an upcoming iOS 13 and macOS Catalina feature that leverages encrypted crowdsourced data to pinpoint the location of a missing or stolen iPhone, iPad or Mac.

Find My
Apple executive Craig Federighi introduces Find My at WWDC19.


Apple SVP of Software Engineering Craig Federighi unveiled Find My onstage at the Worldwide Developers Conference on Monday, touting the new tool's ability to track the location of iOS 13 and macOS Catalina devices even when they are offline.

A high level overview of the technology revealed Apple is leveraging its massive user install base to power Find My. Target devices send out Bluetooth beacon signals that are picked up by nearby iOS or Mac machines, which relay the identifier and their own location information back to Apple for later perusal by Find My users.

The entire process, from beacon generation to crowdsourced location data gathering, is automated, encrypted and designed in such a way that disallows bad actors -- and Apple itself -- from snooping on unsuspecting device owners.

"Now what's amazing is that this whole interaction is end-to-end encrypted and anonymous," Federighi said. "It uses just tiny bits of data that piggyback on existing network traffic so there's no need to worry about your battery life, your data usage or your privacy."

Apple provided additional context on the inner workings of Find My in a discussion with Wired. The publication broke down the system into a series of steps, the first of which reveals Find My requires at least two Apple devices to function.

When setting up Find My, the at least two Apple products generate a cryptographically strong private key that is shared between registered devices through end-to-end encrypted communication. This key is stored locally, presumably in iPhone's Secure Enclave or Mac's T2 chip, for later use.

A public key, which can only be decrypted with the aforementioned private key, is also generated and acts as the beacon sent out to nearby devices via Bluetooth. This public key rotates frequently (the exact timing was left undisclosed) and in such a way that new numbers cannot be linked to previously used key versions.

The Bluetooth beacon is broadcast to nearby devices, which automatically pick up the signal, intertwine their own location using the public key and send this information along with a hash of the public key to Apple's servers.

With the data stored in Apple's cloud, users looking for a lost device open Find My on a second Apple device to conduct a search. The second device sends a hash of its own public key to the cloud, which is matched with the stored beacon key. How, exactly, Apple is able pair two rotating public keys is at this point unknown.

Finally, Apple transmits the encrypted location of the lost device down to Find My user devices, which decrypt the information using the stored private key.

Find My debuts with iOS 13 and macOS Catalina this fall.
«1

Comments

  • Reply 1 of 26
    fastasleepfastasleep Posts: 3,078member
    It’s seemingly small stuff like this that’s really at the heart of Apple’s innovation. This is amazingly cool stuff. 
    SoliStrangeDaysAppleExposedlolliverMacQcGeorgeBMacMisterKitgregoriusmtmayracerhomie3
  • Reply 2 of 26
    SoliSoli Posts: 9,175member
    It’s seemingly small stuff like this that’s really at the heart of Apple’s innovation. This is amazingly cool stuff. 
    +1.

    The day before "Dub Dub" I was talking about how I wish Find My Mac was able to work more like Tile and Trackr, but through all Apple devices, since the chances of a stolen Mac of mine being connected to the internet would be very slim.
    fastasleepcornchipwatto_cobrajony0
  • Reply 3 of 26
    StrangeDaysStrangeDays Posts: 8,242member
    It’s seemingly small stuff like this that’s really at the heart of Apple’s innovation. This is amazingly cool stuff. 
    Indeed it is. Innovation doesn’t always mean some shiny new product, it’s often small and invisible. For every scenario where people claim Apple isn’t innovating anymore (because they expected a holographic 3D comm device or some nonsense), there are multiple instances of cool thinking like this. 
    AppleExposedlolliverMacQcGeorgeBMacmacplusplusMisterKitfastasleepgregoriusmracerhomie3cornchip
  • Reply 4 of 26
    I am amused by the prospect of a criminal's own mobile phone providing the location of the apple device they had just stolen.
    berndogAppleExposedlolliverGeorgeBMacmacplusplusMisterKitfastasleepgregoriusmtmayracerhomie3
  • Reply 5 of 26
    KuyangkohKuyangkoh Posts: 344member
    I am amused by the prospect of a criminal's own mobile phone providing the location of the apple device they had just stolen.
    Like the recently busted after $16 million and 7 years in the making? So Apple didn’t catch this schemings?? I am amazed
    cornchip
  • Reply 6 of 26
    GeorgeBMacGeorgeBMac Posts: 4,939member
    Another example of the truly amazing engineering Apple's staff is capable of.

    This stuff doesn't come easy.   It's the result of lot's of hard work, creativity and problem solving.

    I can see this schema coming to somebody in the shower as a vision -- but only after they had spent many long hours agonizing over the details from every angle.  But then followed by many more long hard hours pouring over it to prove it is a bullet proof solution -- and then even more to actually build it.

    Bravo to the Apple Engineer(s) who thought of this!
    AppleExposedracerhomie3cornchipwatto_cobra
  • Reply 7 of 26
    boxcatcherboxcatcher Posts: 157member
    The use of the word "intertwine" in this article is odd ... why not just say, "encrypt" (since that's what it does...)?
    cornchipwatto_cobra
  • Reply 8 of 26
    It’s the Batman cell phone scene realized. 
    heli0scornchipmaltzwatto_cobra
  • Reply 9 of 26
    kevin keekevin kee Posts: 1,046member
    I can see this to be realised in more ways in the future. Using the billion iDevices masses out there by way of low power blutooth beacon to transmit data and information, bypassing internet altogether, connect and interact, pinpoint anyone/anything location, finding a crimininal in a few seconds, searching for a certain items, all with a secured encryption.Thanks god for the encryption, because it could be easily abused too, like use it for mass data collections and hacking.

    But for now, if it worked perfectly, it would be subtly an amazing tech hidden behind 'Find My' apps.
    watto_cobra
  • Reply 10 of 26
    kevin kee said:
    I can see this to be realised in more ways in the future. Using the billion iDevices masses out there by way of low power blutooth beacon to transmit data and information, bypassing internet altogether, connect and interact, pinpoint anyone/anything location, finding a crimininal in a few seconds, searching for a certain items, all with a secured encryption.Thanks god for the encryption, because it could be easily abused too, like use it for mass data collections and hacking.

    But for now, if it worked perfectly, it would be subtly an amazing tech hidden behind 'Find My' apps.
    Pied Piper's dream fully realized! Hah.

    But seriously: "When setting up Find My, the at least two Apple products generate a cryptographically strong private key that is shared between registered devices through end-to-end encrypted communication"

    Is this something a part of their CrytoKit? Like using Blockchain? Would be a great use if so.
    watto_cobra
  • Reply 11 of 26
    heli0sheli0s Posts: 15member
    Was is so hard to call it the “Find” app? 
    boxcatchercornchipforgot username
  • Reply 12 of 26
    fastasleepfastasleep Posts: 3,078member
    kevin kee said:
    I can see this to be realised in more ways in the future. Using the billion iDevices masses out there by way of low power blutooth beacon to transmit data and information, bypassing internet altogether, connect and interact, pinpoint anyone/anything location, finding a crimininal in a few seconds, searching for a certain items, all with a secured encryption.Thanks god for the encryption, because it could be easily abused too, like use it for mass data collections and hacking.

    But for now, if it worked perfectly, it would be subtly an amazing tech hidden behind 'Find My' apps.
    Kinda like this, maybe?

    https://appleinsider.com/articles/19/03/21/apple-looking-at-ways-to-simplify-device-connectivity-including-generating-a-mesh-network-in-an-emergency
    edited June 5 GeorgeBMacforgot usernamewatto_cobra
  • Reply 13 of 26
    iOS_Guy80iOS_Guy80 Posts: 192member
    It’s seemingly small stuff like this that’s really at the heart of Apple’s innovation. This is amazingly cool stuff. 
    Indeed it is. Innovation doesn’t always mean some shiny new product, it’s often small and invisible. For every scenario where people claim Apple isn’t innovating anymore (because they expected a holographic 3D comm device or some nonsense), there are multiple instances of cool thinking like this. 
    Ditto, just wish someone could explain it to me in layman’s terms.
    watto_cobra
  • Reply 14 of 26
    sflocalsflocal Posts: 4,674member
    Seriously slick stuff.  

    Android could never get this kind of cohesion between devices.
    racerhomie3cornchipStrangeDaysdigital_guywatto_cobra
  • Reply 15 of 26
    boxcatcherboxcatcher Posts: 157member
    Is this something a part of their CrytoKit? Like using Blockchain? Would be a great use if so.
    Yes.
    No.
    watto_cobra
  • Reply 16 of 26
    kevin keekevin kee Posts: 1,046member
    sflocal said:
    Seriously slick stuff.  

    Android could never get this kind of cohesion between devices.
    Theoretically they could, but practically without a standard protocol, it would be a nightmare.
    But imagine if they did that, how close are we to https://en.wikipedia.org/wiki/AI_takeover

    watto_cobra
  • Reply 17 of 26
    22july201322july2013 Posts: 738member
    "Now what's amazing is that this whole interaction is end-to-end encrypted and anonymous," Federighi said. "It uses just tiny bits of data that piggyback on existing network traffic so there's no need to worry about your battery life, your data usage or your privacy."
    "Tiny bits of data"? Put the following text in a terminal window: "ls | MD5". The resulting hash is hardly "tiny", it looks to me like 128 bits of data. And Apple's hashes may be even larger than that. Multiply that by a billion(?) devices transmitting once per minute and that's a lot. I'm not sure how it can piggyback either. There's no such thing as a free lunch or a perpetual motion machine. This sort of innovation is hard to get right. Remember, you aren't just needing to protect yourself from the US government, people also need to be protected from malicious governments like the majority of governments in the world today, many with billion dollar budgets for hacking who are legally allowed to hack their own citizens.

    crowleyforgot username
  • Reply 18 of 26
    I get the part about needing two Apple devices to sign into the Find My service, But going forward must customers always use those same two devices?

    I'd most likely register with my iPhone and MacBook Pro, but rarely leave the house with both. I'm far more likely to tote an iPad, oPhone and Ample Watch.


  • Reply 19 of 26
    kevin keekevin kee Posts: 1,046member
    "Now what's amazing is that this whole interaction is end-to-end encrypted and anonymous," Federighi said. "It uses just tiny bits of data that piggyback on existing network traffic so there's no need to worry about your battery life, your data usage or your privacy."
    "Tiny bits of data"? Put the following text in a terminal window: "ls | MD5". The resulting hash is hardly "tiny", it looks to me like 128 bits of data. And Apple's hashes may be even larger than that. Multiply that by a billion(?) devices transmitting once per minute and that's a lot. I'm not sure how it can piggyback either. There's no such thing as a free lunch or a perpetual motion machine. This sort of innovation is hard to get right. Remember, you aren't just needing to protect yourself from the US government, people also need to be protected from malicious governments like the majority of governments in the world today, many with billion dollar budgets for hacking who are legally allowed to hack their own citizens.

    We don't exactly know how Apple does this behind the scene to keep it as tiny as possible. My guess it would be a compressed bit? But it's more likely that only 1 device are allowed to be piggyback at 1 time, and the 1 time is prob less than a nanosecond. With that logic, it makes sense that load is practically zero to any device.
    watto_cobra
  • Reply 20 of 26
    GeorgeBMacGeorgeBMac Posts: 4,939member
    kevin kee said:
    I can see this to be realised in more ways in the future. Using the billion iDevices masses out there by way of low power blutooth beacon to transmit data and information, bypassing internet altogether, connect and interact, pinpoint anyone/anything location, finding a crimininal in a few seconds, searching for a certain items, all with a secured encryption.Thanks god for the encryption, because it could be easily abused too, like use it for mass data collections and hacking.

    But for now, if it worked perfectly, it would be subtly an amazing tech hidden behind 'Find My' apps.
    Yes, good observation.

    Now all those who would trust Google to do something like this, raise your hands!
    watto_cobra
Sign In or Register to comment.