<story><title>Attack of the Week: Airdrop Tracing</title><url>https://blog.cryptographyengineering.com/2024/01/11/attack-of-the-week-airdrop-tracing/</url></story><parent_chain><item><author>fma</author><text>As far as I know, dissidents would hang around major population area (i.e, subway station) and allow for anonymous users to connect to them to transfer files. This security issue would allow the Chinese government to track them.&lt;p&gt;However, also as far as I know...although VPNs are banned in China, there are ways to get them. I&amp;#x27;d wonder how much do dissidents use Airdrop in this manner if they can access the global Internet anonymously. Given mass surveillance in China, I&amp;#x27;m sure the Chinese government can track &amp;quot;oh this airdrop sender appears every time this person is in this station&amp;quot;.&lt;p&gt;I also hope that Apple adopts an open source protocol for AirDrop not just for cross platform compatibility, but auditable security. Android has its own &amp;quot;Nearby Share&amp;quot;. If Apple doesn&amp;#x27;t want to get in trouble for &amp;quot;fixing&amp;quot; this, they can easily adopt a cross platform compatible protocol that just happens to also fix this.</text></item></parent_chain><comment><author>vyrotek</author><text>Is this sort of sharing big enough to warrant dedicated and open-source devices just to do this? A sort-of glorified USB Drive with a sharing protocol and nothing else. You walk around and it just syncs up with things around you. Something that looks like an original iPod with a screen and folders of files.&lt;p&gt;I don&amp;#x27;t know anything about the AirDrop or NearbyShare protocols, but I wonder if they can be implemented in such a device?&lt;p&gt;All the recently announced dedicated AI devices make me think people might be into it.</text></comment>
<story><title>Attack of the Week: Airdrop Tracing</title><url>https://blog.cryptographyengineering.com/2024/01/11/attack-of-the-week-airdrop-tracing/</url></story><parent_chain><item><author>fma</author><text>As far as I know, dissidents would hang around major population area (i.e, subway station) and allow for anonymous users to connect to them to transfer files. This security issue would allow the Chinese government to track them.&lt;p&gt;However, also as far as I know...although VPNs are banned in China, there are ways to get them. I&amp;#x27;d wonder how much do dissidents use Airdrop in this manner if they can access the global Internet anonymously. Given mass surveillance in China, I&amp;#x27;m sure the Chinese government can track &amp;quot;oh this airdrop sender appears every time this person is in this station&amp;quot;.&lt;p&gt;I also hope that Apple adopts an open source protocol for AirDrop not just for cross platform compatibility, but auditable security. Android has its own &amp;quot;Nearby Share&amp;quot;. If Apple doesn&amp;#x27;t want to get in trouble for &amp;quot;fixing&amp;quot; this, they can easily adopt a cross platform compatible protocol that just happens to also fix this.</text></item></parent_chain><comment><author>lxgr</author><text>This would be great, and I&amp;#x27;d be really happy to see it.&lt;p&gt;One (definitely not insurmountable) problem that would exist in such a federated and open system is credential authentication:&lt;p&gt;Currently, Apple signs your email address and phone number (hash) so that you can&amp;#x27;t impersonate somebody&amp;#x27;s trusted contacts and send unwanted material to them without their consent, which has been a problem for Apple in the past. That&amp;#x27;s supposedly also why they have removed the &amp;quot;allow all AirDrop senders&amp;quot; option in favor of one that times out after 10 minutes.&lt;p&gt;There would either have to be a federated alternative to that, or the open source system would have to drop sender authentication; then you could only receive AirDrops while your device is in &amp;quot;allow all senders&amp;quot; mode.</text></comment>