It's interesting to me that other trackers have end-to-end encryption. I wouldn't have expected it but makes sense for the threat model.

> Providerslike Apple and Google achieve location indistinguishability by end-to-end encrypting location information using a public key embedded in BLE advertisements emitted by a tag

Though it makes me wonder... What's the private key? If the public key is attached to the tag, how is the device getting it? I'm guessing it gets shared during pairing.

In general, yes! We did some follow on work explaining how all of this works, depending on the provider: https://petsymposium.org/popets/2026/popets-2026-0113.pdf

I dont get why this is really an issue when there are devices on Temu you can easily buy that are actually designed for stalking. Why would anybody with a genuine nefarious purpose spend their time hacking a tile when they can just buy a generic Chinese gps transponder?

Generic GPS transponder (containing GPS receiver + some kind of data connection) will have limited battery life.

Systems like Tile, AirTag can last much longer with smaller battery and overall dimensions by offloading GPS and long data transmission to other devices. Strength(and dangers) of devices like this is in the size of tracking network not necessarily the hardware itself. Even better if you don't have to plant the tracker onto victim, because victim bought it and is intentionally carrying with themselves.

Criminals, particularly heavily disordered ones like stalkers, are usually not the smartest people in the world. So increasing the barrier of entry just a little bit might substantially decrease their practical access to this type of technology.

Because it serves a nefarious purpose: to smear the company that makes these devices. I would not be surprised if this is part of some kind of campaign designed to restrict or damage someone.

You went straight to conspiracy?

Last author on the paper here (https://arxiv.org/pdf/2510.00350). Happy to answer any questions!

Paper: https://arxiv.org/abs/2510.00350

There are plenty of times when you have to trust someone(s) else with your belongings, sometimes for a very long time - say, airline baggage, bus luggage compartment, hotel left luggage, or gym lockers - and it's useful to have a tracker (ideally a more secure one, e.g. AirTag) in case anything goes wrong.

And even if you're the type of person who never lets their bags leave their sight, nobody is immune to their keys slipping out of their pocket in a taxi.

Does anyone know whether https://mygrid.app/ is trustworthy? Development had been glacial, but looking at their website it seems they finally support degoogled android which is a huge step forwards.

This explains why I'm seeing commercials for Life360 now for the first time ever: They've developed a new revenue stream by selling everybody's location to advertisers.

Now deleted from my family's phones.

That was always the revenue stream, the devices were just a way to get you to give it to them. It's been a minute since I was current on who gets what in the HMD world but I think that data ultimately flows to Placer.ai

Whats the connection between an advertiser knowing your location, and ads from Life360?

What the hell is Tile?

cross-platform forerunner of the Apple AirTag

AirTag alternative

Thats what google is for.

"But, but, the Tile TOS says they'll fine a stalker a million dollars!"

Life360 is such a skeevy bullshit company.

BBP;DR (Broken Bot Protection; Didn't Read)

Loops forever at

blog.adafruit.com Performing security verification This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot.

I never understood this. You can pass turnstile challenges on tor browser in a linux/windows VM, of all things. What unusual browser config are people using to trigger a block?

I use a DPRK VPN

Passing the security verification succeeded for me (firefox on a mac, with ublock origin).