alt Hacker NewsIt's interesting to me that other trackers have end-to-end encryption. I wouldn't have expected it but makes sense for the threat model.
> Providerslike Apple and Google achieve location indistinguishability by end-to-end encrypting location information using a public key embedded in BLE advertisements emitted by a tag
Though it makes me wonder... What's the private key? If the public key is attached to the tag, how is the device getting it? I'm guessing it gets shared during pairing.
Replies
AFAIK, there's a pre-shared key exchanged during pairing, and you then calculate keypairs based on (key, timestamp).
Rotating your keypairs in that way prevents attackers from identifying you across time. E.G. if they link a particular keypair to you — let's say at an Airport security gate — that doesn't let them know you've entered a lawyer's office a week later, because that's done under a different, unrelated public key.
In general, yes! We did some follow on work explaining how all of this works, depending on the provider: https://petsymposium.org/popets/2026/popets-2026-0113.pdf