AirTags are Apple’s hotly anticipated tracker tiles, little tags that will show up in the Find My app on your phone, letting you find lost keys or keep your checked luggage safe. But are AirTags private? Might they leak private information and let other people find you? Probably not. “I will use them if they’re not too expensive,” iOS app developer Graham Bower told Lifewire via direct message. “It can’t be worse than an Apple Watch.”
How AirTags (Probably) Work
Apple’s Find My feature, built into all recent portable Macs and iOS devices, is a masterclass in smart design. Finding a lost phone is easy—in principle. Thanks to GPS, the iPhone always knows where it is. And if connected to the internet, it can tell you. Find My lets you track your devices even when they have no internet connection. It can also work with items that never, ever connect to the internet. Things like Bluetooth tracking tags. AirTags, in other words. It works like this: The AirTag (or your phone) broadcasts an always-changing public key via Bluetooth. This key is picked up by any passing iPhone or other Apple device, and used to encrypt that device’s current location. The stranger’s iPhone uploads this encrypted location, plus a cryptographically hashed version of that public key, to Apple’s servers. The hash is used as an identifier if you use the Find My app to track your lost tag, and the encrypted location data is sent to you. The trick is, only you can decrypt that data, so only you can see the location. It’s all done safely and anonymously, and because there are Apple devices in every corner of the world, it should all work pretty well.
What Could Possibly Go Wrong?
If we assume that Apple’s tech is bulletproof, there are still some possible exploits. One is that somebody could slip their own tag into your car, clothing, or belongings to track you. This seems perfect for stalkers and a dream come true for the police. But Apple already has thwarted that scheme—as long as you carry an Apple device. If your iPhone detects that an AirTag is following you, it will send you an alert. In the beta version of iOS 14.5, the Find My app has this setting enabled by default, but there is a setting to toggle the warning off. The Find My settings also have a section for adding “items” to your tracking setup. See the screenshots below. The “help” links in these setup screens currently lead to blank pages on Apple’s site. Because your AirTag, iPhone, iPad, or Mac, and presumably in the future, your AirPods and other accessories, all are broadcasting Bluetooth signals, it is theoretically possible for someone to detect those signals. Although they can’t get any information from those signals, the very presence of an Apple AirTag blip over Bluetooth betrays the presence of an Apple device. Ultimately, the test is in how well this performs in public. The twist is that Apple has been using this tracking method since iOS 13, which launched more than a year ago, and there have been zero “-gate” scandals since then. Any future problems, then, will most likely be with the more disposable nature of AirTags, compared to other Apple devices. One can imagine short-term stalking would still work until the victim receives the alert. Otherwise, this seems like an incredible way not to lose your keys ever again.
