Query Apple's FindMy network with Python

Find My is an asset tracking service made by Apple Inc. that enables users to track the location of iOS, iPadOS, macOS, watchOS, visionOS, tvOS devices, AirPods, AirTags, and a number of supported third-party accessories through a connected iCloud account. Users can also show their primary device's geographic location to others, and can view the location of others who choose to share their location. Find My was released alongside iOS 13 on September 19, 2019, merging the functions of the former Find My iPhone (known on Mac computers as Find My Mac) and Find My Friends into a single app. On watchOS, Find My is separated into three different applications: Find Devices, Find People and Find Items.

cube2222• 2 years ago

Importantly, it works in a peer-to-peer kind of way. Apple devices act as kind of beacons and nearby iPhones can notify Apple servers of any nearby devices they detect (in a way not decryptable by Apple, only by the owner of the devices).

So AirTags, MacBooks, and turned-off iPhones are findable via passing-by turned-on iPhones.

lopkeny12ko• 2 years ago

Is it not a glaring privacy and security hole that turned-off devices can still be located?

Maybe it's just me, but if I own an internet-connected device and I turn it off, I expect it to be off. That an iPhone's definition of "off" means "you can't use it but other random people's iPhones in the vicinity can still connect to and ping it" rubs me the wrong way.

vasco• 2 years ago

With the Apple and the Google ecosystems!

incanus77• 2 years ago

I don’t use the person tracking very often except on group vacations, but I track a vehicle with an AirTag after a car theft for a little peace of mind (along with other preventative measures). Every now and then it’s handy for my own devices, too, including alerting me when I’ve accidentally left one behind at a non-routine location.

delijati• 2 years ago

Can i add xiaomi "airtag" with it?

malmeloo18• 2 years ago

I'm not familiar with these tags, do they implement the FindMy protocol? If it's a proper 3rd party AirTag ("Works with FindMy") then it should be supported, see the AirTag example in the repository for more info.

oulipo• 2 years ago

I'm also interested by the Haystack project to have an ESP32-based object identify as an AirTag and be able to follow it

Does anyone knows if their approach is "sustainable", or if Apple can easily "block out" such hacks from their network?

numberless• 2 years ago

If it functions exactly as an AirTag does then it would be hard as they would not want to block all previously sold AirTags

crazygringo• 2 years ago

Is there something it can do to whitelist legitimate AirTag serial numbers?

mikeweiss2• 2 years ago

As someone who lives in an Android family but would still like to use air tags since it's the biggest network in the U.S. I'd love a way to add and use air tags without needing to have an iPhone!

Schiendelman• 2 years ago

The whole point of services like this is to get you into the ecosystem. This is a value add for iPhone users.

mikeweiss2• 2 years ago

Yes.. obviously.. I meant 3rd party like the original link posted for querying the network.

zikduruqe3• 2 years ago

You used to be able to query this data locally from your MacBook, but Apple decided to encrypt it. It was fun to put an AirTag on your cat, then use GPS Visualizer to plot your cat's activities overnight.

https://github.com/icepick3000/AirtagAlex

https://www.gpsvisualizer.com

qup• 2 years ago

While we're here, I have an ask (of anyone). I want the same exact thing you said, except for an outdoor dog on a large property.

I would like a tag that just records its own GPS coordinates locally on-device, every so often, and then when my dog comes home, I can check where she's been.

Does this exist?

Raed667• 2 years ago

Any cheap Garmin watch should do the trick

cdurth• 2 years ago

You could definitely use meshtastic devices to do this

zikduruqe3• 2 years ago

You know honestly? I have thought of using a XOSS cycling computer (https://www.amazon.com/XOSS-Speedometer-Accessories-Waterpro...).

I have used them before on various bikes and they work just fine. Battery life is about 25 hours, it is weather resistant, and then you can sync them after you record an activity. And at less than $30, if it gets lost, it isn't the worst thing in the world.

janten• 2 years ago

They are called GPS trackers or GPS loggers. You can find some that save coordinates to a microSD card and optionally send the location via cellular connection for about 10 dollars on AliExpress.

spike021• 2 years ago

My dog has a Fi GPS/cellular collar. You could just get that and leave it on at night and it would show you where your dog wanders around.

jdiez17• 2 years ago

I have a TK913 GPS tracker for my ebike, which is configured to send location reports to my server running Traccar[1]. I'm very happy with the setup, it Just Works. I can check where my bike is at any point from the web UI from my phone. It supports A LOT[2] of these cellular-enabled GPS trackers.

[1] https://www.traccar.org/

[2] https://www.traccar.org/devices/

andoando• 2 years ago

i tried that except damn cat figured out how to take its collar off every time

bolognafairy5• 2 years ago

but Apple decided to encrypt it.

Yes. As part of a major effort to reduce the abuse potential of AirTags, something that people have been very justifiably demanding.

zikduruqe3• 2 years ago

Ah yes.

The data that is already displayed in my GUI, is now encrypted on my disk that I have full access to. Got it. /s

Havoc2• 2 years ago

What are the chance that this keeps working long term?

Sounds awesome & makes airtags more appealing, but if apple is just going to shut it down next week then less so

stonegray3• 2 years ago

Changing the underlying find my network to break this would be challenging if not impossible while keeping the privacy protections in place. Apple can’t identify devices sending data to find my, and doesn’t log requests. Short of changes that would break compatibility with older devices it should be relatively stable.

OpenHaystack has been doing this for a few years now and Apple has made no efforts to restrict it.

gjsman-10002• 2 years ago

Apple can’t identify devices sending data to find my, and doesn’t log requests.

So what you're saying is that a decent firewall could still inspect the traffic, or the patterns thereof.

Also, this doesn't make any sense, as if Apple doesn't know which AirTag belongs to who, Find My would be very useless; and law enforcement would be furious.

alphan0n5• 2 years ago

I’ve been using FakeTag[0] and OpenHaystack[1] coupled with a vibration sensor to notify me when various things happen around my house. Inspired by this [2] article. It’s worked flawlessly for ~2 years.

[0] https://github.com/dakhnod/FakeTag

[1] https://github.com/seemoo-lab/openhaystack

[2] https://hackaday.com/2022/05/30/check-your-mailbox-using-the...

malmeloo18• 2 years ago

You're correct in saying that it would be challenging for them to overhaul the entire network, but this library directly makes API calls to Apple's servers to request location reports. So while the tags would likely keep working, they could totally block the library or your account if they really wanted to.

ttul• 2 years ago

From Apple’s perspective, if someone uses the FindMy APIs to provide a commercial service that diminishes the privacy offered by Apple’s official apps, they would likely send a C&D letter. But for hobby projects, it’s not worth clamping down hard.

malmeloo18• 2 years ago

So far they don't really seem to care, however we've seen the lengths Apple is willing to go to when it comes to protecting their sweet revenue stream during their fight with Beeper. OpenHaystack has been functional for a long time, but they obtain locations from a running Mac, while this project directly accesses their API. This is also the most attention this project has received in a long time, so we'll see how that goes.

Over the past year only of my accounts has been banned by Apple, and I was using that one to request locations every 5-10 minutes 24/7 in Home Assistant, with no other usage of the account other than one registered hackintosh. I'm currently using another account that is querying data every 15-30 minutes, which has been working fine so far. You just need an account to anonymously download location reports, so if your throwaway gets banned just create a new one and things should work again. Just make sure to attach it to a real device or hackintosh at least once to "activate" the account's iCloud API.

I do just want to make it clear that I have no intentions on keeping this working "at all costs" - at least not without other people willing to help me out. The library is currently not even trying to be stealthy, and it can be easily detected using heuristics if they really wanted to.

Havoc2• 2 years ago

Cool. Thanks for the detailed response.

Afraid only devices I've got are iphones and icloud accounts where I can't risk a ban.

roger_• 2 years ago

Hope someone integrates this with Home Assistant soon!

malmeloo18• 2 years ago

https://github.com/malmeloo/hass-FindMy

It still has some rough edges, but I've been running it for a few months now for myself and some family members without any major issues :-)

pixelmonkey7• 2 years ago

This looks great. If this Python implementation of the FindMy API actually works, it would be a major technology quality-of-life improvement for me. I hope Apple lets it stay alive.

Everyone who shares location with me does so over Find My, and my family insists on using AirTags. As a 100% desktop Linux and mobile Android user, it is one of the few things that I always need to remote in to my Mac Mini to access because there are no x-platform FindMy apps and the FindMy iCloud web app does not have feature parity to the macOS and iOS apps. One of a long list of offenses where Apple refuses to make things easy for x-platform friend groups and families. Very annoying.

BeefySwain• 2 years ago

What does "x-platform" mean in this context?

sshh12• 2 years ago

Cross platform (something that works well outside of Apple apps/devices)

pixelmonkey7• 2 years ago

Cross-platform. There are 3 major desktop operating systems (Windows, Linux, and Mac) and 2 major mobile operating systems (iPhone and Android). Every single OS has a huge marketshare worldwide (including Linux, if you count servers).

A truly x-platform app is one that works well on all 5 of these platforms, e.g. Signal. A moderately x-platform app is one that works well on the two mobile operating systems and on web as an alternative to desktop, e.g. WhatsApp. A single-platform app, like Apple FindMy, only works properly on e.g. Mac + iPhone. Apple tends to be the only major industry player that produces these sorts of apps, e.g. iMessage, FaceTime, Final Cut Pro, Keynote. Although with Keynote you can often get by with the iCloud web version, which has a useful 80%-or-so of the desktop app's features. Even apps like Meet, Zoom, and Teams -- run by rival companies -- are more x-platform than major Apple apps.

phillco• 2 years ago

Even within Apple's platforms, there's pretty limited support for automation -- you can say "Siri find my keys" but there's no App Intents / Shortcuts support for automating anything within Find My (AFAIK), which is a bit disappointing.

pixelmonkey7• 2 years ago

Yes, although I recently discovered Hammerspoon which is a clever little bit of open source macOS desktop automation technology:

https://www.hammerspoon.org/

UniverseHacker• 2 years ago

What about Apple Automator and Applescript?

Angostura• 2 years ago

I suspect they might be a bit wary of the privacy implications of giving other apps/Shortcuts access to Findmy data

GeekyBear2• 2 years ago

What information is available through this api that would not already be available over the web?

pixelmonkey7• 2 years ago

Hopefully locations shared by users not part of my iCloud Family account, and "Items" (Apple jargon term for AirTags). Currently it only shows macOS or iOS "Devices" directly linked to my iCloud account, or in my iCloud Family, none of the locations shared by friends. And it shows no "Items," not even those in my iCloud account.

(... yep, it looks like one of their example programs is about accessing AirTag info via API: https://github.com/malmeloo/FindMy.py/blob/main/examples/rea... ...)

malmeloo18• 2 years ago

To the best of my knowledge, AirTag locations still cannot be obtained through the iCloud website. The locations it shows are simply generated by the devices themselves and uploaded directly to Apple. This library specifically only queries the FindMy network, which is the system that allows other iPhones (and iPads etc.) to "find" your devices.

The library also explicitly does not integrate with your Apple account, but only uses it to query encrypted location reports from Apple. This can be done with any account, even if it does not "own" the device, as long as you can generate the correct keys.

nulltxt• 2 years ago

Does Blue Bubbles work for this? They have find my built into their app

bronson• 2 years ago

Kind of? Right now it feels like it's glued on the side and a good proof of concept. It takes a lot more panning and zooming than it should. But it DOES work, one-way: you can see your friends' locations but they can't see yours.

fluidcruft2• 2 years ago

One that really annoys me is inability to monitor/control my kid's device useage and time limits.

amit9gupta• 2 years ago

Possible in the apple ecosystem. If the kids are part of a "familly", you can monitor / control using Parental Controls accessed from your iPhone > Settings > Screen Time.

Also checkout firewalla https://help.firewalla.com/hc/en-us/articles/360008214094-Ac...

vitovito• 2 years ago

I ended up using Shortcuts to publish a set of screenshots from an always-on Mac every 10 minutes or so for a set of shared, family AirTags: http://vitor.io/android-airtags

I couldn't reliably get iOS to do the same, and my tests of an Android-compatible tag found it was detected much less often than an AirTag riding along with it.

pixelmonkey7• 2 years ago

Wow, that's some dedication to solve this problem! Very nice write-up. It was also good to see your thinking behind why doing this on an always-on Mac was better than possible alternatives. Thankfully M-series Macs don't draw much power at all at idle.

owenthejumper• 2 years ago

Using this as soon as Play sound is integrated!

coolius• 2 years ago

same, i would use it to build a thing that makes my phone ring at the push of a button.

leobg• 2 years ago

Can I use this, if I have an iPhone, to trigger actions on a server based on my location?

For example, “When I come home, fetch the latest electricity prices and notify me if I should plug in my Tesla”.

I tried that using Shortcuts, but they won’t run location based without confirmation. (There are some workarounds, but they, too, don’t work reliably in my experience.)

cruffle_duffle2• 2 years ago

Stupid question but couldn’t you just always plug it in and then automate the bit where it actually energizes the outlet?

malmeloo18• 2 years ago

Technically, yes! I have an experimental Home Assistant integration here, if you're into that stuff: https://github.com/malmeloo/hass-FindMy

However, do note that AirTags put themselves into "nearby" mode when they're near an owner device, at which point they become untraceable to the FindMy network (the system where other iPhones are finding your AirTag and uploading its location). That also makes it invisible to this library. It is however still possible to detect it using the BLE signal it is broadcasting in nearby state, which is supported by the library but not yet by the HA integration.

enlightens• 2 years ago

If you literally mean when you return home, I’ve been running Shortcut automations triggered by leaving home and arriving home, using the built in “My Home” triggers. They don’t require confirmation and as best as I can tell have been completely reliable.

daft_pink• 2 years ago

It’s interesting, because it could allow you to log location over time. Generally, I can only see peoples location when I open the app, but this would allow me to ping every 30 minutes and create a very long log that I could technically create manually, but would be quite a bit of work.

stavros3• 2 years ago

You don't need to do that, the API will happily return the last N days of location pings.

malmeloo18• 2 years ago

This, indeed. Quick addition: Apple only stores locations for up to 7 days, so I would recommend running it once per day or so if you don't need live data. If you do, be careful not to request too often (sub-30 mins) if you value your account dearly.

cruffle_duffle2• 2 years ago

I remember there was a time when “web services” were the new hotness and everybody was gonna offer some API to whatever they had online.

What happened to this? We’ve even got the authentication part nailed down now thanks to OAuth! There is even API gateways that you can park in front of your stack that manage all the hard parts like granting client secrets to API consumers and showing registration screens to developers.

There is really nothing stopping you from opening up parts of your stack to developers and tinkerers so they can do cool shit. It even gets people to lock into your product that much more because now they’ve integrated some part of their workflow into your system in a way that might not be possible without your service!

So yeah. You already have these API’s exposed for your front end apps to use. Why not just slam a developer portal on top and let people access some of it? Who knows what cool things they’ll cook up!

trees101• 2 years ago

Does this require you to run a virtualized apple OS in order to keep track of your tags?

malmeloo18• 2 years ago

Hey everyone! I'm the author of FindMy.py. I'd like to use this moment to give a shout-out to some other people that deserve way more credit than me, as the project definitely would not have existed without them. If this stuff interests you then please do check them out, there is a dedicated section in the project's README (https://github.com/malmeloo/FindMy.py?tab=readme-ov-file#cre...).

If you have any questions, feel free to ask :-)

sneak• 2 years ago

Could you please include some usage examples in the README?

malmeloo18• 2 years ago

There is an examples directory that covers basic usage: https://github.com/malmeloo/FindMy.py/tree/main/examples

Official docs: https://docs.mikealmel.ooo/FindMy.py/

I realize that the docs are rather empty right now; it takes a lot of time to turn my thoughts into text, which I do not really have at the moment. Contributions are welcome, of course ;-)

josephernest2• 2 years ago

Congrats ! I don't have an iPhone or Mac. Can I buy an AirTag, initialize it with the help of a friend who has an iPhone, and then locate the AirTag or ring it from my PC with this Python lib?

acer4666• 2 years ago

I don't see how you would get the private key for the airtag off the iPhone without jailbreaking it. The readme of the project implies you can do this but the docs are completely lacking

malmeloo18• 2 years ago

I responded to your other comment, but for other people who have the same question:

https://news.ycombinator.com/item?id=42482974

notthetup2• 2 years ago

Any idea why the latest version on pypa is 0.2.x. That seems like it was released a while ago.

malmeloo18• 2 years ago

The latest version is 0.7.5: https://pypi.org/project/FindMy/

trashcan2• 2 years ago

It's not clear to me how to actually get the required plist file to make this library work. Neither of the scripts in this issue seem to work: https://github.com/malmeloo/FindMy.py/issues/31

Is the syntax to run them just `swift <filename.swift>`?

Swift/ErrorType.swift:253: Fatal error: Error raised at top level: main.MyError.noPassword

malmeloo18• 2 years ago

Which version of MacOS are you using? I believe Apple has made changes to the keychain in the latest version which prevents the scripts from working properly.

The only Apple "device" I have regular access to is a hackintosh, so this stuff is frustratingly hard to debug. So far I've been relying on efforts from the community, but the scripts appear to be somewhat flaky and don't always work for everyone unfortunately.

trashcan2• 2 years ago

I am on Sequoia 15.3. If I can do anything to help, let me know.

josephernest2• 2 years ago

I don't have an iPhone or Mac. Can I buy an AirTag, initialize it with the help of a friend who has an iPhone, and then locate the AirTag or ring it from my PC with this Python lib?

It would be awesome.

malmeloo18• 2 years ago

Theoretically yes, once the AirTag is deployed the keys should be static and you should be ready to go. Apple should also not be able to "ban" the tag at some later point in time.

I would suggest signing into a separate Apple account that's under your control to pair the AirTag, however. Not due to the risk of being banned, but because I have the suspicion that removing an AirTag from your (friend's) account may prompt the device to instruct the AirTag to reset. But if you sign into another account, pair it using an iDevice and then log out, that shouldn't be an issue.

tamjai• 2 years ago

Tile Tracker already has that. I wouldn't relying on Apple being merciful.

philsnow• 2 years ago

Note that, locating airtags and making them play sound requires them to be near some other iDevice (the battery is a standard CR2032), so if you live in a remote ranch or something and nobody around you has an iphone, they might not be very useful.

lolinder4• 2 years ago

It wouldn't even need to be a remote ranch—everything I'm seeing suggests they have a range of between 30-100 feet depending on walls and whatnot, which means even in a typical suburb you've got pretty high odds that none of your neighbors have a device within range at the moment you need it.

stavros3• 2 years ago

I bought some $8 third-party AirTags from AliExpress, flashed them with some firmware, and used Macless Haystack to track them without owning any Apple devices.

https://notes.stavros.io/programming/third-party-airtags-res...

Google have also launched their own network, Find, which is turned off by default and useless for now.

upbeat_general3• 2 years ago

For the longest time I’ve wanted a way to record my location history in a durable way, without resorting to google maps history (which is great but has…obvious downsides), or some hacky short-term custom solution.

I wonder if someone could integrate this into a more coherent long-term platform.

joshmarinacci• 2 years ago

There are , or at least were, commercial services that did this. What do you want to do with this data? What form do you need it in?

upbeat_general3• 2 years ago

I think it’s just super handy to know where you’ve been. Great to be able to find places (“Oh I loved this Thai place I went to 4 years ago in X city”)

Also to be able to find photos in specific locations (if you integrate it with geotagged photos like google does).

It’s one of those things I don’t actively care a ton about in the short term but is useful data to have in the long term if it can persist without a lot of effort.

Edit: I think form is “irrelevant” as long as it’s well supported and can be useable in different services later on. Same thing with notes imo (and why I use markdown). Has enough features but importantly is and will be well supported.

dotty-• 2 years ago

I starred this on GitHub a few weeks ago! https://github.com/Freika/dawarich Have not played with it, but maybe could fit your needs!

upbeat_general3• 2 years ago

Oh this looks cool, will give it a try!

emilburzo• 2 years ago

without resorting to google maps history (which is great but has…obvious downsides)

Maybe relevant: they moved it to on-device now: https://9to5google.com/2023/12/12/google-location-history-ti...

re• 2 years ago

From a quick skim of the repository, it looks like this is only for accessories/devices that you own. I hope that this is the case, and that it doesn't work for the "Find My Friends" functionality.

I'm okay sharing my location with trusted people so that they can occasionally manually check where I currently am. I don't like the idea of them theoretically being able to automatically record my location and build a complete history of my movements over time.

lolinder4• 2 years ago

You should probably just assume that the recording is possible and not share your location with people you don't trust to not do that. Find my Friends isn't Snapchat—there's nothing in the pitch about ephemerality, so you shouldn't assume they engineered it in as a design constraint.

malmeloo18• 2 years ago

You're right, locating friends is not currently supported. I would assume that this feature is implemented by simply sharing your device's (already recorded) latest location ping with your friends, in which case this is also currently out of scope for the project - the library only intends to interact with the "other-devices-find-my-device" network in order to be account-agnostic.

On a separate thought, if Apple has not taken concerns such as the one you portrayed into account when designing Find My Friends then I would suggest not using the system altogether. At that point it's only a matter of time before someone figures out how to extract the data. But that's an entirely different story and a personal consideration you'll have to make.

jjtech• 2 years ago

Yeah, uh... you might do well to assume that they can. The Find My Friends API is really really simple, I have a script somewhere that can pull the locations of everyone who has shared their locations with me and record it.

(I'm also the one who wrote the original code that was refactored a couple times until it became this project... https://github.com/JJTech0130/pypush/blob/async/examples/ope...)

wkjagt• 2 years ago

This is awesome. Now I's starting to hope a similar thing is possible to manage Screen Time.

Query Apple's FindMy network with Python

Related Stories