Tile's security is so bad it's a feature for stalkers

Also, I'm just the professor, the grad students on it are the real heroes: Akshaya Kumar [1] and Anna Raymaker [2].

[1] https://akumar805.github.io/

[2] https://annaraymaker.dad/

Thanks! Have you considered evaluating the “AppClose” platform in a similar fashion? It is used in family / civil cases to my knowledge. Perhaps another worthwhile avenue of study, perhaps not. Thank you for your time.

In general, yes! We did some follow on work explaining how all of this works, depending on the provider: https://petsymposium.org/popets/2026/popets-2026-0113.pdf

AFAIK, there's a pre-shared key exchanged during pairing, and you then calculate keypairs based on (key, timestamp).

Rotating your keypairs in that way prevents attackers from identifying you across time. E.G. if they link a particular keypair to you — let's say at an Airport security gate — that doesn't let them know you've entered a lawyer's office a week later, because that's done under a different, unrelated public key.

Generic GPS transponder (containing GPS receiver + some kind of data connection) will have limited battery life.

Systems like Tile, AirTag can last much longer with smaller battery and overall dimensions by offloading GPS and long data transmission to other devices. Strength(and dangers) of devices like this is in the size of tracking network not necessarily the hardware itself. Even better if you don't have to plant the tracker onto victim, because victim bought it and is intentionally carrying with themselves.

Suppose the person you want to stalk has bought a Tile that they use for themselves, not knowing that these devices are insecure. If you scan for that device, you can follow that person without even having to plant a device on them. You don't have to hack their Tile.

In that case you have to plant the transponder yourself.

In the case of Tile, everyone using Tile has tagged themselves (unknowingly) for you.

The consumer who didn't know they tagged themselves would understandably have a complaint.

Criminals, particularly heavily disordered ones like stalkers, are usually not the smartest people in the world. So increasing the barrier of entry just a little bit might substantially decrease their practical access to this type of technology.

Because it serves a nefarious purpose: to smear the company that makes these devices. I would not be surprised if this is part of some kind of campaign designed to restrict or damage someone.

That was always the revenue stream, the devices were just a way to get you to give it to them. It's been a minute since I was current on who gets what in the HMD world but I think that data ultimately flows to Placer.ai

Whats the connection between an advertiser knowing your location, and ads from Life360?

I never understood this. You can pass turnstile challenges on tor browser in a linux/windows VM, of all things. What unusual browser config are people using to trigger a block?

Passing the security verification succeeded for me (firefox on a mac, with ublock origin).

> Loops forever

And so it should, given:

> while the website verifies you are not a bot.

is impossible to complete.

cross-platform forerunner of the Apple AirTag

If AirTag is a CD, Tile is 8 track.

AirTag alternative

Thats what google is for.

There are plenty of times when you have to trust someone(s) else with your belongings, sometimes for a very long time - say, airline baggage, bus luggage compartment, hotel left luggage, or gym lockers - and it's useful to have a tracker (ideally a more secure one, e.g. AirTag) in case anything goes wrong.

And even if you're the type of person who never lets their bags leave their sight, nobody is immune to their keys slipping out of their pocket in a taxi.