One possible improvement to the Airtag security concerns

[Wando64]

I am probably not the first to make this suggestion, but…

Only allow set-up and pairing by users with a verified address.
Attach a unique owner identification to the AirTag.
Change the alert for unknown AirTag to something along the lines of:

An AirTag belonging to user 123456 has been following your movements.
Press this button to deactivate it.
If you find the AirTag you can drop it at any Apple store or freepost it to Apple for recycling, if other belongings are found with the AirTag they should be handed over to the authorities as lost/found property.
By following this LINK and entering the address of the police force where you have dropped the found belongings, Apple will alert user 123456 so that they can make arrangements for collection.

I can see a lot of problems with this approach, but it would also be a deterrent, albeit not a perfect one.

 

[fischersd]

Apple already cooperates with the Police if anyone is using AirTags for nefarious purposes. Also, your AppleID is a pretty unique identifier.

For privacy reasons, it really should only be the Police getting all of the owner's information from Apple.

 

[Wando64]

Also, your AppleID is a pretty unique identifier.

It is possible to create a throwaway Apple ID.
What I am suggesting is to allow AirTag registration only to users with a verified residential address.

 

[Night Spring]

It is possible to create a throwaway Apple ID.
What I am suggesting is to allow AirTag registration only to users with a verified residential address.

How do you get a verified residential address?

Like, if you are a college student living in a dorm, is your verified address your dorm, or your parents' home? If your home burns down and you are crashing with a relative or friend, what is your verified address? Who is responsible for checking if the residential address is in fact verified and correct, Apple? How will they check that?

 

[Wando64]

How do you get a verified residential address?

Like, if you are a college student living in a dorm, is your verified address your dorm, or your parents' home? If your home burns down and you are crashing with a relative or friend, what is your verified address? Who is responsible for checking if the residential address is in fact verified and correct, Apple? How will they check that?

By submitting your credit/debit card details.
Basically in the same way it is done by other companies such as PayPal.

Shipping to a Buyer's Confirmed Address | PayPal US

There's a difference between confirmed and unconfirmed addresses. Find out what it means to ship to a buyer's confirmed address and how to do so here.

www.paypal.com

 

[fischersd]

By submitting your credit/debit card details.
Basically in the same way it is done by other companies such as PayPal.

Shipping to a Buyer's Confirmed Address | PayPal US

There's a difference between confirmed and unconfirmed addresses. Find out what it means to ship to a buyer's confirmed address and how to do so here.

www.paypal.com

Umm. Ok. That's easily skirted. Change your credit card billing/shipping address, create your bogus account, then change it back to your real address.

(obviously, in the case of PayPal, fraudsters need to use a real address for shipping) - but it doesn't provide a means whereby Apple could prevent people from making anonymous Apple ID's for tracking purposes.

What Apple's doing with Digital ID's may help though - eventually having digital identities will make it much more difficult for people to have anonymous accounts for such purposes....but that's years away from being commonplace.

 

[CarbonCycles]

You can argue this point ad nauseam, but I agree that this is becoming a much larger problem (and a major headache).

I know several ppl who have had these AirTags placed on their cars...some of them were placed in very intentional locations that were meant not to be easily found (e.g., inside headliner).

I would argue that if you're using an AirTag to track something then have both parties present on the map (the AirTag and the device that originally activated the AirTag [allow only one time pairing for the device]).

 

[Wando64]

Umm. Ok. That's easily skirted. Change your credit card billing/shipping address, create your bogus account, then change it back to your real address. .

That would leave a paper trail and, if you are up to no good, you wouldn't want to do that.
We are talking about crime prevention. If a crime is committed, the authorities can, and should, follow every available trail.

Right now I can create an Apple ID in the name of Joe Bloggs at any old address I care to enter, leaving no trail to follow.

 

[fischersd]

That would leave a paper trail and, if you are up to no good, you wouldn't want to do that.
We are talking about crime prevention. If a crime is committed, the authorities can, and should, follow every available trail.

Right now I can create an Apple ID in the name of Joe Bloggs at any old address I care to enter, leaving no trail to follow.

Yeah, could also do the prepaid Visa cards you can do at the convenience store. Lots of ways you can skirt that check.

You need to have verification with government ID's.

 

[Wando64]

Yeah, could also do the prepaid Visa cards you can do at the convenience store. Lots of ways you can skirt that check.

You need to have verification with government ID's.

We don’t have “prepaid VISA cards” in the UK, but I doubt that they will have a billing address associated with them, and therefore they would be completely unsuitable for address verification.
But, ultimately we could discuss this forever as I am sure you, or someone else, can think of another reason this will not be 100% watertight.

As I wrote on my very first post: “ I can see a lot of problems with this approach, but it would also be a deterrent, albeit not a perfect one.”
It is just an idea for improving on the current situation.