Query Apple's FindMy Network with Python
174 points
by nkko
5 hours ago
| 11 comments
| github.com
| HN
pixelmonkey
2 hours ago
[-]
This looks great. If this Python implementation of the FindMy API actually works, it would be a major technology quality-of-life improvement for me. I hope Apple lets it stay alive.

Everyone who shares location with me does so over Find My, and my family insists on using AirTags. As a 100% desktop Linux and mobile Android user, it is one of the few things that I always need to remote in to my Mac Mini to access because there are no x-platform FindMy apps and the FindMy iCloud web app does not have feature parity to the macOS and iOS apps. One of a long list of offenses where Apple refuses to make things easy for x-platform friend groups and families. Very annoying.

reply
nulltxt
1 hour ago
[-]
Does Blue Bubbles work for this? They have find my built into their app
reply
bronson
47 minutes ago
[-]
Kind of? Right now it feels like it's glued on the side and a good proof of concept. It takes a lot more panning and zooming than it should. But it DOES work, one-way: you can see your friends' locations but they can't see yours.
reply
phillco
1 hour ago
[-]
Even within Apple's platforms, there's pretty limited support for automation -- you can say "Siri find my keys" but there's no App Intents / Shortcuts support for automating anything within Find My (AFAIK), which is a bit disappointing.
reply
pixelmonkey
1 hour ago
[-]
Yes, although I recently discovered Hammerspoon which is a clever little bit of open source macOS desktop automation technology:

https://www.hammerspoon.org/

reply
UniverseHacker
50 minutes ago
[-]
What about Apple Auotomator and Applescript?
reply
fluidcruft
57 minutes ago
[-]
One that really annoys me is inability to monitor/control my kid's device useage and time limits.
reply
turtlebits
9 minutes ago
[-]
That's a parenting issue. Your kid should have the self control to understand and set limits. In my house, my kids set kitchen timers.
reply
fluidcruft
3 minutes ago
[-]
Unless you are arguing that the feature should be removed from iOS and macOS devices, it is entirely a technical issue. Me preferring to use an Android device rather than an iPhone is not a parenting issue.
reply
GeekyBear
1 hour ago
[-]
What information is available through this api that would not already be available over the web?
reply
pixelmonkey
1 hour ago
[-]
Hopefully locations shared by users not part of my iCloud Family account, and "Items" (Apple jargon term for AirTags). Currently it only shows macOS or iOS "Devices" directly linked to my iCloud account, or in my iCloud Family, none of the locations shared by friends. And it shows no "Items," not even those in my iCloud account.

(... yep, it looks like one of their example programs is about accessing AirTag info via API: https://github.com/malmeloo/FindMy.py/blob/main/examples/rea... ...)

reply
BeefySwain
2 hours ago
[-]
What does "x-platform" mean in this context?
reply
pixelmonkey
1 hour ago
[-]
Cross-platform. There are 3 major desktop operating systems (Windows, Linux, and Mac) and 2 major mobile operating systems (iPhone and Android). Every single OS has a huge marketshare worldwide (including Linux, if you count servers).

A truly x-platform app is one that works well on all 5 of these platforms, e.g. Signal. A moderately x-platform app is one that works well on the two mobile operating systems and on web as an alternative to desktop, e.g. WhatsApp. A single-platform app, like Apple FindMy, only works properly on e.g. Mac + iPhone. Apple tends to be the only major industry player that produces these sorts of apps, e.g. iMessage, FaceTime, Final Cut Pro, Keynote. Although with Keynote you can often get by with the iCloud web version, which has a useful 80%-or-so of the desktop app's features. Even apps like Meet, Zoom, and Teams -- run by rival companies -- are more x-platform than major Apple apps.

reply
stavros
1 hour ago
[-]
I think the GP knows what cross-platform means, but is confused by using "X" as shorthand for "cross". In my opinion, it's not widespread enough for the four-letter saving to be worth the confusion.
reply
pixelmonkey
57 minutes ago
[-]
That's a good point, well taken. Especially now that "X" is the name of a social media platform :-)
reply
marzell
20 minutes ago
[-]
Long before the richest man on earth bought Twitter to be his personal megaphone to help him prepare to become president in order to boost all his personal endeavors, the letter X has been used as a sort of contraction to replace common morphemes like "cross", "trans" etc, in places where the physical representation "x" likens to a cross or crossing of some sort, or in reference to the Greek letter Chi. Must we change our use of language to support this guy, too?

Xtian Xmas xfer tx/rx xor...

reply
sshh12
1 hour ago
[-]
Cross platform (something that works well outside of Apple apps/devices)
reply
leobg
20 minutes ago
[-]
Can I use this, if I have an iPhone, to trigger actions on a server based on my location?

For example, “When I come home, fetch the latest electricity prices and notify me if I should plug in my Tesla”.

I tried that using Shortcuts, but they won’t run location based without confirmation. (There are some workarounds, but they, too, don’t work reliably in my experience.)

reply
oulipo
3 hours ago
[-]
I'm also interested by the Haystack project to have an ESP32-based object identify as an AirTag and be able to follow it

Does anyone knows if their approach is "sustainable", or if Apple can easily "block out" such hacks from their network?

reply
Its_Padar
2 hours ago
[-]
If it functions exactly as an AirTag does then it would be hard as they would not want to block all previously sold AirTags
reply
crazygringo
2 hours ago
[-]
Is there something it can do to whitelist legitimate AirTag serial numbers?
reply
bhy
2 hours ago
[-]
I don't think AirTag work that way. AirTag protocol is specifically designed so Apple or other parties will not be able to track users by serial numbers.
reply
gjsman-1000
2 hours ago
[-]
Where there's a will, there's a way. Apple is very clear law enforcement can approach them with any AirTag and they will immediately be able to tie it to a user.
reply
kolinko
21 minutes ago
[-]
One doesn’t exclude the other - a physical airtag may have an ID available, but not broadcast it anywhere.

Also, “when there’s a will…” doesn’t really apply to cruptography

reply
stonegray
1 hour ago
[-]
They do, Airtag hardware need to be signed to add to your iCloud account. But the actual location beacon messages are not linked to your iCloud account and can’t be associated with the sending airtag.
reply
Havoc
3 hours ago
[-]
What are the chance that this keeps working long term?

Sounds awesome & makes airtags more appealing, but if apple is just going to shut it down next week then less so

reply
stonegray
2 hours ago
[-]
Changing the underlying find my network to break this would be challenging if not impossible while keeping the privacy protections in place. Apple can’t identify devices sending data to find my, and doesn’t log requests. Short of changes that would break compatibility with older devices it should be relatively stable.

OpenHaystack has been doing this for a few years now and Apple has made no efforts to restrict it.

reply
alphan0n
1 hour ago
[-]
I’ve been using FakeTag[0] and OpenHaystack[1] coupled with a vibration sensor to notify me when various things happen around my house. Inspired by this [2] article. It’s worked flawlessly for ~2 years.

[0] https://github.com/dakhnod/FakeTag

[1] https://github.com/seemoo-lab/openhaystack

[2] https://hackaday.com/2022/05/30/check-your-mailbox-using-the...

reply
gjsman-1000
2 hours ago
[-]
> Apple can’t identify devices sending data to find my, and doesn’t log requests.

So what you're saying is that a decent firewall could still inspect the traffic, or the patterns thereof.

Also, this doesn't make any sense, as if Apple doesn't know which AirTag belongs to who, Find My would be very useless; and law enforcement would be furious.

reply
stonegray
2 hours ago
[-]
Airtags are associated with your apple ID for safety, but when you make a request for the location from Find My it doesn’t include any information about which airtag you’re asking about; just a CSPRNG-incremented public key that changes every 15 minutes. The location data itself is not available to Apple.

Here is Apple’s docs on how they prevent themselves from inspecting traffic on Fmi: https://support.apple.com/guide/security/find-my-security-se...

reply
meindnoch
37 minutes ago
[-]
So how does Find My work on icloud.com then?
reply
wutwutwat
1 hour ago
[-]
So Apple has no way to see anything even when developing the platform itself?

They must have a way to decrypt payloads or otherwise get into the system they built and control. The fact that they let law enforcement know when someone is stalking someone with an AirTag shows that the data is available to them. It’s silly to think otherwise, paper or not.

reply
future10se
55 minutes ago
[-]
> The fact that they let law enforcement know when someone is stalking someone with an AirTag shows that the data is available to them.

Not technically correct. Apple devices (and Android phones with the appropriate app) detect if an unknown AirTag is moving with them and makes it home, possibly signalling a stalking attempt.

The heuristics for this happen locally; Apple isn't "aware" of this happening. That said, when you first set-up an AirTag, the serial is tied to your account. Therefore, when you physically find an unknown AirTag and report it to law enforcement, they can then subpoena (or get a warrant?) Apple for information on the AirTag owner's identity.

The serial itself, and any personal identifiers, are not used in the locating process, however.

This is well documented in the paper above, in articles, as well as in reverse engineering efforts.

reply
ttul
44 minutes ago
[-]
From Apple’s perspective, if someone uses the FindMy APIs to provide a commercial service that diminishes the privacy offered by Apple’s official apps, they would likely send a C&D letter. But for hobby projects, it’s not worth clamping down hard.
reply
zikduruqe
3 hours ago
[-]
You used to be able to query this data locally from your MacBook, but Apple decided to encrypt it. It was fun to put an AirTag on your cat, then use GPS Visualizer to plot your cat's activities overnight.

https://github.com/icepick3000/AirtagAlex

https://www.gpsvisualizer.com

reply
qup
3 hours ago
[-]
While we're here, I have an ask (of anyone). I want the same exact thing you said, except for an outdoor dog on a large property.

I would like a tag that just records its own GPS coordinates locally on-device, every so often, and then when my dog comes home, I can check where she's been.

Does this exist?

reply
janten
2 hours ago
[-]
They are called GPS trackers or GPS loggers. You can find some that save coordinates to a microSD card and optionally send the location via cellular connection for about 10 dollars on AliExpress.
reply
Raed667
3 hours ago
[-]
Any cheap Garmin watch should do the trick
reply
1986
3 hours ago
[-]
And if you want to spend more, Garmin even makes a range of dog tracking equipment: https://www.garmin.com/en-US/p/965617
reply
zikduruqe
3 hours ago
[-]
You know honestly? I have thought of using a XOSS cycling computer (https://www.amazon.com/XOSS-Speedometer-Accessories-Waterpro...).

I have used them before on various bikes and they work just fine. Battery life is about 25 hours, it is weather resistant, and then you can sync them after you record an activity. And at less than $30, if it gets lost, it isn't the worst thing in the world.

reply
cdurth
3 hours ago
[-]
You could definitely use meshtastic devices to do this
reply
mikeweiss
3 hours ago
[-]
As someone who lives in an Android family but would still like to use air tags since it's the biggest network in the U.S. I'd love a way to add and use air tags without needing to have an iPhone!
reply
Galanwe
4 hours ago
[-]
Fore those not familiar with the Apple ecosystem, what does "Find My" do? locate apple devices ?
reply
latexr
4 hours ago
[-]
https://en.wikipedia.org/wiki/Find_My

> Find My is an asset tracking service made by Apple Inc. that enables users to track the location of iOS, iPadOS, macOS, watchOS, visionOS, tvOS devices, AirPods, AirTags, and a number of supported third-party accessories through a connected iCloud account. Users can also show their primary device's geographic location to others, and can view the location of others who choose to share their location. Find My was released alongside iOS 13 on September 19, 2019, merging the functions of the former Find My iPhone (known on Mac computers as Find My Mac) and Find My Friends into a single app. On watchOS, Find My is separated into three different applications: Find Devices, Find People and Find Items.

reply
kabirgoel
4 hours ago
[-]
Correct. You can also share your location with friends. A lot of friend groups (at least my age) use Find My as a kind of social network.
reply
Nextgrid
2 hours ago
[-]
Does it have any battery impact? I've never tried these always-on location tracking things partly due to (unfounded?) concerns about battery use.
reply
msh
1 hour ago
[-]
its not always on in that way. It will report your location when requested, and optionally just before shutting down.
reply
gomoboo
3 hours ago
[-]
How does that work woth your friends? Always on access or just occasionally?
reply
GeekyBear
1 hour ago
[-]
> Always on access or just occasionally?

You have quite a few granular choices.

> You can share your current location once, temporarily share your location while you're on the way to an expected destination, or share your ongoing Live Location... for an hour, until the end of the day, or indefinitely.

In Messages, you can use Check In to share your location... Your location is shared only if there's an unexpected delay during your trip or activity and you're unresponsive.

https://support.apple.com/en-us/105104

reply
toomuchtodo
3 hours ago
[-]
Always on. You can see where your friends are at both in Find My and under their contact photo in your iMessages chat.
reply
johnisgood
3 hours ago
[-]
Personally I do not find the idea comforting that someone (anyone) may know where I am at all times. I would not even trust Apple either.
reply
proteal
2 hours ago
[-]
This is actually one of the big differences between generations. It’s not just the norm for young people to share locations, but rather almost expected, with real social consequences for not. Yes it’s probably a little weird to have someone’s precise location 100% of the time, but since you’re sharing it with me there’s a good deal of trust implied (though this is not always the case as it has become more normalized). However, if we stop sharing locations, that usually implies a divorce of the relationship. People will shut you out of their life if you stop sharing your location with them, no matter the reason. From that lens, the choice is simple. You’ve gotta share your location, even if it’s a bit icky from a privacy perspective or you risk losing an entire cohort of friends. I will admit, there is a strange level of intimacy for having done it. In a world increasingly dominated by the pixels on this 4x8 screen, it is a nice reminder that the text bubbles on my phone actually come from real people that I can show you on a map.

(Obviously you can find friends who don’t care for it and you can live a normal life and be just fine. I’m privacy conscious but I still share my location with a handful of friends for the above reasons.)

reply
rvnx
3 hours ago
[-]
It's a virtual leash for couples.
reply
toomuchtodo
2 hours ago
[-]
Blame the emotionally dysfunctional, not the tool. It’s only a problem if it changes how you would live your life or pressured or coerced (in which case, say no).
reply
sleepybrett
1 hour ago
[-]
you can control who you share your location with and for how long. I think the options are, just once, for an hour, for the day and forever.
reply
haliskerbas
3 hours ago
[-]
Always on, works as a great way to check in on close friends or have them check in on you (like someone going on a first date)
reply
incanus77
1 hour ago
[-]
I don’t use the person tracking very often except on group vacations, but I track a vehicle with an AirTag after a car theft for a little peace of mind (along with other preventative measures). Every now and then it’s handy for my own devices, too, including alerting me when I’ve accidentally left one behind at a non-routine location.
reply
cube2222
4 hours ago
[-]
Importantly, it works in a peer-to-peer kind of way. Apple devices act as kind of beacons and nearby iPhones can notify Apple servers of any nearby devices they detect (in a way not decryptable by Apple, only by the owner of the devices).

So AirTags, MacBooks, and turned-off iPhones are findable via passing-by turned-on iPhones.

reply
lopkeny12ko
4 hours ago
[-]
Is it not a glaring privacy and security hole that turned-off devices can still be located?

Maybe it's just me, but if I own an internet-connected device and I turn it off, I expect it to be off. That an iPhone's definition of "off" means "you can't use it but other random people's iPhones in the vicinity can still connect to and ping it" rubs me the wrong way.

reply
anderiv
4 hours ago
[-]
The off-but-still-on functionality can be turned off, and the OS does disclose that by default the device is still findable on the power off screen.
reply
jen20
3 hours ago
[-]
It is not. If you don’t want your device to participate, you ca elect not to enable Find My during setup. The vast majority of people would rather a their couldn’t just turn off a stolen phone and render it unlocatable.
reply
rainsford
2 hours ago
[-]
Also the location is only accessible to you, the owner of the device. Not Apple or "random other people's iPhones".

The engineering and thought that went into the whole thing to be useful but also privacy protecting is actually pretty impressive, and exactly the kind of thing we should be encouraging companies to do if we care about privacy. Especially since as you point out, you can still easily turn it off at any point if you want.

reply
vasco
3 hours ago
[-]
With the Apple and the Google ecosystems!
reply
simonw
4 hours ago
[-]
A bunch of stuff:

- Find your Apple Watch, AirPods, laptop etc

- Find family member devices if they've granted you access to do that

- Find AirTags

- Show you the location of friends who have granted you access

reply
roger_
3 hours ago
[-]
Hope someone integrates this with Home Assistant soon!
reply
owenthejumper
1 hour ago
[-]
Using this as soon as Play sound is integrated!
reply
delijati
4 hours ago
[-]
Can i add xiaomi "airtag" with it?
reply
pravosleva
38 minutes ago
[-]
test comment
reply
pravosleva
36 minutes ago
[-]
test reply // Why i cant submit story?

> Sorry, your account isn't able to submit this site.

https://pravosleva.pro/dist.hacker-news-2024

reply