How we built the new Find My Device network with security and privacy in mind \ stacker news ~privacy

How we built the new Find My Device network with security and privacy in mind security.googleblog.com/2024/04/find-my-device-network-security-privacy-protections.html

3207 sats \ 12 comments \ @ek 9 Apr privacy

The Find My Device network locates devices by harnessing the Bluetooth proximity of surrounding Android devices.

Imagine you drop your keys at a cafe. The keys themselves have no location capabilities, but they may have a Bluetooth tag attached. Nearby Android devices participating in the Find My Device network report the location of the Bluetooth tag.

When the owner realizes they have lost their keys and logs into the Find My Device mobile app, they will be able to see the aggregated location contributed by nearby Android devices and locate their keys.

Interesting, it's a mesh network. Not sure why they call it "crowdsourced device-locating network". More friendly for normies?

I can see this being useful but I am also worried about implications further down the road like people getting used to it and not caring how it's implemented anymore (assuming they would even care now).

Also, I understand that with "even if it's offline", they mean it's Bluetooth which is independent of internet access but does this mean you can't disable Bluetooth anymore?

What also confused me is this as mentioned in #499445:

thanks to specialized Pixel hardware, Pixel 8 and 8 Pro owners will also be able to find their devices if they’re powered off or the battery is dead.

How does this not need a battery? Did they include a dedicated battery similar to "CMOS batteries"?

I think this is another prime example of consumer tech that is at risk to be abused by anyone but especially state actors. The other prime example is the Internet of Things.

Thinking more about this, this might be the Internet of Things but instead of things it's phones running Android and instead of internet it uses Near-me area networks.

Hacker News discussion

view all related items

4 replies \ @ek OP 10 Apr

Wait, I'm dumb. It's not a mesh network. I misinterpreted "crowdsourced" here:

crowdsourced device-locating network

It saves the location data end-to-end encrypted in the cloud from which the devices of the owner can read and decrypt it. In a mesh network, the devices themselves would relay the information.

Kind of funny that I originally thought that's how it works even though I also thought:

Mhh, that would work reliably? Are there really this many Android devices out there?

121 sats \ 3 replies \ @davidw 10 Apr

It also probably saves to the cloud the Bluetooth identifiers of all the devices in your vicinity that are pinging for Bluetooth signal (if it doesn’t already). They wouldn’t state that, but technically very possible/likely given it’s Google.

Even some privacy advocate who is using a pair of headphones and a dumb mp3 player can be located in such a scenario, for the simple fact that they have paired those headphones previously with their phone. Even if they left their phone at home. Given that people don’t share their waxy bluetooth earbuds with one another, therefore there’s a 97% chance they were also there with you. Chain surveillance attribution, on steroids.

100 sats \ 2 replies \ @ek OP 10 Apr

Sounds like we are in for a rude awakening of side channels in privacy.

101 sats \ 1 reply \ @davidw 10 Apr

Definitely, but we will get pocket-sized jammers & scramblers, all in due time.

31 sats \ 0 replies \ @ek OP 10 Apr

At least regular-size jammers are already common for criminals:

George Alhosry, who owns the Kwik Market & Deli on Roxford, said the store’s Wi-Fi was down much of Sunday. It’s unclear whether that was connected to the heist. But Wi-Fi jammers have become a common tool of theft gangs during their burglaries of homes in Southern California because they knock out many security cameras that could capture video or stills of them or their vehicles.

pretty embarrassing if your security cameras get knocked out by jammers, lol

60 sats \ 3 replies \ @WeAreAllSatoshi 10 Apr

Is this any different than apples equivalent that’s been around for a while? Isn’t this basically how AirTags work?

0 sats \ 2 replies \ @ek OP 10 Apr

I think so but according to this HN comment, they couldn't agree on a protocol

60 sats \ 1 reply \ @WeAreAllSatoshi 10 Apr

Yea, makes sense. I guess my main point in identifying that is: this is nothing new. It’s just finally making its way to android

0 sats \ 0 replies \ @DEADBEEF 10 Apr

Exactly. Android is just finally catching up to Apple’s FindMy network.

150 sats \ 0 replies \ @davidw 10 Apr

Like much of consumer tech today, this is a solution in search of a problem.

There is bliss in being offline. I can only sense we’re going to learn the hard way with our hardware, and how few use cases actually require our devices be online.

We’ll all eventually be clamouring for devices that actually turn off (and cut circuits) the moment you turn them off.

25 sats \ 0 replies \ @siggy47 9 Apr

Sounds like a nightmare to me. I'm keeping my old pixel.

1 sat \ 0 replies \ @Coinsreporter 14 Apr

I was thinking to buy a Pixel as my next phone, thanks mate! I'm now happy with what I have..