Comments (1)
iPhone deviceName is always "iPhone" these days. An Apple device advert also exposes the exact model (iPhone9,3) via another characteristic that doesn't require authentication either, without notifying the iPhone's owner to someone requesting it. Apple has a special way of sharing the name (E.g. "Adam's iPhone") that isn't in these characteristics. Also worth reading the two research papers from INRIA in France around Apple and Google Bluetooth device Bluetooth security and tracking. (Especially popets-2020-003). Older iPhones, like the iPhone 6, don't advertise anything unless an app uses Bluetooth. In modern iPhones, if Bluetooth is enabled, they always advertise these services and characteristics.
It's worth bearing in mind that these OS' API allow an app to specify what to advertise, but not to restrict what the OS advertises. So the TxPower and Flags elements in the advert are always there on modern phones, for example, as well as a set of OS specific services and characteristics that an app cannot disable itself.
Also worth noting that the Bluetooth spec deals with an app acting as a peripheral and a central as a single Bluetooth device, with a single Bluetooth MAC address, no matter how the OS' API expose this to an app user. (We use this in our 'connect back' mechanism, for example).
In summary, it's something we do take in to account, but which the OS vendors themselves will have to provide a mitigation for or an API call we can use to restrict such capability.
I'll leave this on the backlog rather than change to a 'wontfix', as we'd love to have an OS API to call to prevent this, but it's just not available today.
from theheraldproject.github.io.
Related Issues (20)
- Add code rendering widget/include for Jekyll to website
- Upload getting started tutorials for iOS and Android
- Update Archi diagrams for Exposure API
- Add blog post about phone self calibration
- Add opentrace svg logo to project
- Add use case documentation
- Update PGP key for release signing for 2022-2023 HOT 1
- Add release announcement for v2.2.0
- Multiple instances of SensorArray?
- Update API docs for v2.0
- Add contributors and code style guide to website
- Create Security and Privacy guides on Website
- v2.0 release announcement
- LFPH project governance - Project Herald call for committers - July 2021 HOT 7
- Add compare URLs and links for each release
- Add references to LFPH on the website
- Add mailing list URL to the community page
- OpenTrace announcement
- Need fix for jekyll deploy script
- Fix first two links on the OpenTrace page
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from theheraldproject.github.io.