Google Online Security Blog: How we built the new Find Hub network with user security and privacy in mind

How we built the new Find Hub network with user security and privacy in mind

8 апреля 2024 г.

Posted by Dave Kleidermacher, VP Engineering, Android Security and Privacy

Keeping people safe and their data secure and private is a top priority for Android. That is why we took our time when designing the new Find Hub, which uses a crowdsourced device-locating network to help you find your lost or misplaced devices and belongings quickly – even when they’re offline. We gave careful consideration to the potential user security and privacy challenges that come with device finding services.

During development, it was important for us to ensure the new Find Hub was secure by default and private by design. To build a private, crowdsourced device-locating network, we first conducted user research and gathered feedback from privacy and advocacy groups. Next, we developed multi-layered protections across three main areas: data safeguards, safety-first protections, and user controls. This approach provides defense-in-depth for Find Hub users. How location crowdsourcing works on the Find Hub network The Find Hub network locates devices by harnessing the Bluetooth proximity of surrounding Android devices. Imagine you drop your keys at a cafe. The keys themselves have no location capabilities, but they may have a Bluetooth tag attached. Nearby Android devices participating in the Find Hub network report the location of the Bluetooth tag. When the owner realizes they have lost their keys and logs into the Find Hub mobile app, they will be able to see the aggregated location contributed by nearby Android devices and locate their keys.

Find Hub network protections
Let’s dive into key details of the multi-layered protections for the Find Hub network:

Data Safeguards: We’ve implemented protections that help ensure the privacy of everyone participating in the network and the crowdsourced location data that powers it.

Location data is end-to-end encrypted. When Android devices participating in the network report the location of a Bluetooth tag, the location is end-to-end encrypted using a key that is only accessible to the Bluetooth tag owner and anyone the owner has shared the tag with in the Find Hub app. Only the Bluetooth tag owner (and those they’ve chosen to share access with) can decrypt and view the tag’s location. With end-to-end encrypted location data, Google cannot decrypt, see, or otherwise use the location data.
Private, crowdsourced location reports. These end-to-end encrypted locations are contributed to the Find Hub network in a manner that does not allow Google to identify the owners of the nearby Android devices that provided the location data. And when the Find Hub network shows the location and timestamp to the Bluetooth tag’s owner to help them find their belongings, no other information about the nearby Android devices that contributed the data is included.
Minimizing network data. End-to-end encrypted location data is minimally buffered and frequently overwritten. In addition, if the network can help find a Bluetooth tag using the owner’s nearby devices (e.g., if their own phone detects the tag), the network will discard crowdsourced reports for the tag.

Safety-first Protections: The Find Hub network protects against risks such as use of an unknown Bluetooth tag to stalk or identify another user, including:

Aggregation by default. This is a first-of-its-kind safety protection that makes unwanted tracking to a private location, like your home, more difficult. By default, the Find Hub network requires multiple nearby Android devices to detect a tag before reporting its location to the tag's owner. Our research found that the Find Hub network is most valuable in public settings like cafes and airports, where there are likely many devices nearby. By implementing aggregation before showing a tag’s location to its owner, the network can take advantage of its biggest strength – over a billion Android devices that can participate. This helps tag owners find their lost devices in these busier locations while prioritizing safety from unwanted tracking near private locations. In less busy areas, last known location and Nest finding are reliable ways to locate items.
At home protection. If a user has chosen to save their home address in their Google Account, their Android device will also ensure that it does not contribute crowdsourced location reports to the Find Hub network when it is near the user’s home. This provides additional protection on top of aggregation by default against unwanted tracking near private locations. Don't worry, when your phone is near your own tag, even at home, you can locate it.
Rate limiting and throttling. The Find Hub network limits the number of times that a nearby Android device can contribute a location report for a particular Bluetooth tag. The network also throttles how frequently the owner of a Bluetooth tag can request an updated location for the tag. We've found that lost items are typically left behind in stationary spots. For example, you lose your keys at the cafe, and they stay at the table where you had your morning coffee. Meanwhile, a malicious user is often trying to engage in real-time tracking of a person. By applying rate limiting and throttling to reduce how often the location of a device is updated, the network continues to be helpful for finding items, like your lost checked baggage on a trip, while helping mitigate the risk of real-time tracking.
Unknown tracker alerts. The Find Hub network is also compliant with the integration version of the joint industry standard for unwanted tracking. Being compliant with the integration version of the standard means that both Android and iOS users will receive unknown tracker alerts if the on-device algorithm detects that someone may be using a Find Hub network-compatible tag to track them without their knowledge, proactively alerting the user through a notification on their phone.

User Controls: Android users always have full control over which of their devices participate in the Find Hub network and how those devices participate. Users can either stick with the default and contribute to aggregated location reporting, opt into contributing non-aggregated locations, or turn the network off altogether. Find Hub also provides the ability to secure or erase data from a lost device.

In addition to careful security architectural design, the new Find Hub network has undergone internal Android red team testing. The Find Hub network has also been added to the Android security vulnerability rewards program to take advantage of Android’s global ecosystem of security researchers. We’re also engaging with select researchers through our private grant program to encourage more targeted research. Prioritizing user safety on Find Hub Together, these multi-layered user protections help mitigate potential risks to user privacy and safety while allowing users to effectively locate and recover lost devices. As bad actors continue to look for new ways to exploit users, our work to help keep users safe on Android is never over. We have an unwavering commitment to continue to improve user protections on Find Hub and prioritize user safety.
For more information about Find Hub on Android, please visit our help center. You can read the Find Hub Network Accessory specification here.