That's what they say about iMessage, too, but then the devices back up the endpoint keys to Apple in the iCloud Backup (non-e2ee and readable by Apple/FBI).
The AirTag keys are supposedly stored in iCloud Keychain (which unlike nudes sent via iMessage, is actually excluded from the non-e2ee iCloud Backup) but it's been a long time since I have read the security architecture document for how the offline Find My system works.
The issue with "the data is encrypted" is that a) the receiving device isn't yours (it's some random person's iPhone) and if it's totally opaque to Apple, how do they know to provide that encrypted data provided by some random airport iPhone to your specific account so that you can decrypt it?
It seems sort of handwavey to me. I remain unconvinced that Apple is that diligent about maintaining lack of location tracking for iCloud to AirTag mappings given that 99.99%-ish of iCloud users are already providing location to Apple a hundred other times a day (maps, ads, app store, music, books, TV+, etc).
sneak|2 years ago
The AirTag keys are supposedly stored in iCloud Keychain (which unlike nudes sent via iMessage, is actually excluded from the non-e2ee iCloud Backup) but it's been a long time since I have read the security architecture document for how the offline Find My system works.
The issue with "the data is encrypted" is that a) the receiving device isn't yours (it's some random person's iPhone) and if it's totally opaque to Apple, how do they know to provide that encrypted data provided by some random airport iPhone to your specific account so that you can decrypt it?
It seems sort of handwavey to me. I remain unconvinced that Apple is that diligent about maintaining lack of location tracking for iCloud to AirTag mappings given that 99.99%-ish of iCloud users are already providing location to Apple a hundred other times a day (maps, ads, app store, music, books, TV+, etc).