Anyone hosting a public API?

[mrx23dot]

even with rate limit,
so non MAC users can also try this out.

[Chapoly1305]

Technically speaking, it's possible. Such service would require a funding, does not need to be much. To host a service with Kickstarter. The funding can be used to pay for the macOS machine (both rental or purchse are possible). I checked yesterday that a mac VPS is about 30 USD per month, which is fairly possiable to share on 10 users. The only thing currently remain unknown is the API limit of Apple, and will Apple ban Apple ID by inquery too freqently.

[paolostefanucci]

Hi, did you discover if there is a API limit of Apple, and if Apple ban Apple ID by inquery too frequently?
I want know if is it possible to create an openhaystack server and use many tags that frequent query to the Apple FindMy Network

[Chapoly1305]

Hello,
You can send a query with many many many tags (i tried hundreds in a single request) hashed adv. pubkey for getting the reports at once , I did not notice any limit at all. I am not sure what's gonna happen if you query too frequently (like every 20ms).

[Chapoly1305]

@mrx23dot

Appreciate to the following projects,

• https://github.com/seemoo-lab/openhaystack
• https://github.com/biemster/FindMy
• https://github.com/Dadoum/anisette-v3-server

For whom wish to give this concept a try, but lacking an appropriate mac device, may refer to a fork https://github.com/chapoly1305/FindMy to setup a server without the need of mac. Ideally, The server can be any Linux PC, or a cloud VPS.

Or, Calculate the Hashed Advertisement Key then get the encrypted report from my PoC website. As it's a PoC, so the API has set a global rate limiter. This is only for reference purpose so please do not attack and setup your own server for your own use. Usability of this server is not promised.
https://hello-world-proud-fire-51f6.hallo-world.workers.dev/docs

import base64 
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import ec
import hashlib

# Example:
# Private key: JvMSTj3fwLf/d7XFZUHMvqFpJjEQDzZvVPMdBA==
# Public/Advertisement key: l0kIhxMwK0el8W5y5abJQ9oCv4tYa2UWlLjRQA==
# Hashed adv key: MCNvYOZe1XrMo03Y1bimRa1iK9uzA7gaFZYtwEhRGOM=

private_key_b64 = "YOUR PRIVATE BASE64 KEY"
private_key = ec.derive_private_key(int.from_bytes(base64.b64decode(private_key_b64),byteorder="big"), ec.SECP224R1(), default_backend())

public_key = private_key.public_key()
public_key_bytes = public_key.public_numbers().x.to_bytes(28, byteorder='big')

digest = hashlib.new("sha256")
sha_value = digest.update(public_key_bytes)
sha_value = digest.digest()
s256_b64 = base64.b64encode(sha_value).decode("ascii")
print (s256_b64)

If the Hashed ADV key format is correct, the API will respon a JSON. The content of JSON might be "{\"results\":[],\"statusCode\":\"200\"}" if there is no data has sent to Apple, or few encrypted reports. For privacy consideration, I will not collect your report neither able to decrypt the report to see your location. So you will need to decrypt the reports on your own. All the codes and implementations can be found on the project mentioned above.

[Kronos2308]

Automating Location Requests, Using GitHub Actions and Anisette Server

This guide explains how to automate location requests for "Find My Flipper, Open haystack" without requiring a MAC PC. By leveraging GitHub Actions and a scheduled workflow, we can periodically request location data, process it, and upload the results to a secure location such as a web server, cloud storage, or a database.

---

Overview of the Workflow

The entire process consists of the following steps:

1. Download the necessary files

   • Retrieve the required scripts from the "Find My Flipper" repository. These scripts are responsible for making API requests and handling authentication.

2. Create a GitHub repository

   • This repository will store the workflow, scripts, and any necessary configurations.

3. Set up a GitHub Actions workflow

   • The workflow is scheduled to run at regular intervals (e.g., every 10 or 30 minutes).
   • The workflow automatically pulls and deploys an Anisette Server container using Docker.

4. Make the location request using Python scripts

   • The Python scripts from "Find My Flipper" are slightly modified to export the results into a file (e.g., locat.json).
   • Authentication details (tokens, keys) are needed for the request.
   • These sensitive credentials can securely stored using GitHub Secrets to prevent unauthorized access.

5. Export and store the location data

   • The retrieved location data is processed and saved in locat.json.
   • The file is then uploaded to a destination of choice, such as:
     • An HTTPS server (via POST request)
     • A cloud storage service (Google Drive, Dropbox, etc.)
     • A database (SQL-based storage)
     • A GitHub repository (as an artifact or release file)

---

Detailed Breakdown of the Workflow

• Trigger Mechanism:

  • The workflow is executed automatically via a cron job that runs every 10 minutes (*/10 * * * *).
  • This ensures that location data is refreshed frequently without manual intervention.

• Secrets Management:

  • Sensitive data (authentication keys, API tokens) is stored in GitHub Secrets instead of being hardcoded in the repository.
  • This prevents unauthorized access and improves security.

• Dockerized Anisette Server:

  • The workflow pulls and runs the latest Anisette v3 Server Docker image.
  • This server is required to handle authentication requests for Apple services.
  • A custom Docker network (mh-network) is created to allow communication between services.

• Python Execution:

  • The required dependencies are installed.
  • The modified Find My Flipper scripts are executed to request location data.
  • The results are stored in locat.json for further processing.

• Data Upload & Storage:

  • The locat.json file is uploaded to a specified destination.
  • The user can choose to:
    • Send the file to an HTTPS server via a POST request.
    • Upload the file to cloud storage or a database.
    • Store the file in a GitHub repository as an artifact or release asset.
  • The stored data can then be decoded and displayed on a website or used for further processing.

---

Execution Time & Performance

• The entire workflow takes approximately 30 seconds to complete.
• Since it runs every 10 minutes, the data remains relatively fresh and updated.

---

Customization & Additional Enhancements

• Alternative Storage Methods:

  • Instead of an HTTPS server, you can store data in a SQL database or upload it as a GitHub artifact.

• Enhanced Security Measures:

  • You may implement additional encryption when storing or transmitting sensitive data.

• Error Handling & Logging:

  • Implement error handling mechanisms to detect failed requests or authentication issues.
  • Logs from the Anisette container are checked to ensure proper deployment.

---

This is an example of the workflow
airFind.yml

[qv4emm]

I've setup a cloudflare worker with my custom implementation: https://haystack-proxy.iokzxt.workers.dev/fetch
The request schema is identical to the official backend:
{"search":[{"ids":["base64(sha256(public key))"]}]}

So far I've implemented a rather strict rate limit of 10 requests in 10 seconds. I'll probably publish the code sometime later. I'd encourage anyone with a spare Apple ID to host their own server and make it available.

[Kronos2308]

10 request by second thats a bit overkill

[qv4emm]

Do you mean it's too strict? I've read that there is virtually no rate limit upstream, I'm just a bit cautious :)

[Kronos2308]

I mean the Apple API gets update between 2m and 5m.

[qv4emm]

That's true. But the limit applies to all connections, not just on a per IP basis. I do believe 1 request per second is plenty, as long as there aren't too many users using the proxy

[fz6]

I'm using this for some weeks now, thank you!