Find My is Apple-only by design. A researcher just proved it isn't.

A security researcher has shown that Apple's Find My offline-finding network can be pushed onto a Linux machine by walking Apple's own authentication protocol. The encryption is intact. The assumption that "Apple-only" is a brand boundary rather than a protocol boundary is no longer defensible.

Zerotistic published a proof-of-concept on August 19 that runs entirely on Linux. It logs into Apple with the company's GrandSlam login (an SRP-based password-authenticated key exchange plus a one-time 2FA code), receives an Apple DSID and a short-lived password-equivalent token, and then exchanges those credentials at Apple's signin/v2 endpoint for the com.apple.private.ids delegate, Apple's internal identity service. That last step is the wall: it turns the Linux process from a logged-in browser session into a registered IDS device in Apple's eyes.

Once the Linux box is a registered device, the existing Find My key for an already-accepted location share gets delivered to it over APNs. The encrypted location report can then be decrypted locally with the shared symmetric key, the same pair-EC key the iPhone would have used. No Mac, no iPhone, and no instrumented version of findmy.app is involved.

The proof-of-concept, hosted on the zerotistic blog, does not break the encryption or bypass Apple's consent model. The author was testing the tool against a share that his own Apple Account had already accepted from a friend, with the friend's written consent. The post says the tool can only read an already-accepted share; it cannot send invitations, add family members, change shares, or perform device actions such as playing a sound or locking a device. The published DM exchange in the blog post is explicitly credited to a UI mock by the developer es3n1n and should be read as illustrative consent context rather than verified iMessage logs.

The reason the PoC works comes down to a quirk of how Apple has split its identity services over the years. Modern Apple login uses GrandSlam, an SRP-based protocol that proves knowledge of the password without sending it. The older pypush path, which simply sent the password plist to profile.ess.apple.com, is now dead and returns "Apple status 5000" on the password and "5068" on 2FA. The author credits three open-source projects that did the heavy lifting: malmeloo's FindMy.py for the GrandSlam login, anisette headers, and MobileMe delegate exchange, an early JJTech0130/pypush commit for the IDS signing routine and APNs connection, and stek29's rustpush for the Find My device-registration code and pair-EC decryption.

The client context is what tips Apple into cooperating. The PoC mimics Apple's findmylocated service, the binary that runs on a Mac to participate in offline finding, with the product type set to MacBookPro18,3 and the OS version to 14.6. With that, Apple treats the Linux process as a Mac that has just signed in and pushes the encrypted key for the already-accepted share. The server response confirms it: the share comes back with secureLocationsCapable=true and fallbackToLegacyAllowed=false, the same flags an iPhone would see, meaning the location reports travel over the modern encrypted path rather than the older unauthenticated Find My Friends path.

The Register re-reported the post on August 20, but the original signal is the blog itself; the Register adds no facts beyond it. Apple has not published a statement, and no CVE has been assigned, because the author frames the work as reverse-engineering and protocol documentation, not as a coordinated disclosure of a new vulnerability.

The constructive read is sharper than the panic. Find My's privacy story has always rested on two layers: end-to-end encryption of the location reports, and an assumption that only Apple hardware would be at the other end of the key exchange. The first layer held in this experiment. The second one was a protocol claim from the start, and a Linux process that authenticates through GrandSlam, fetches an IDS delegate, and registers as a findmylocated client meets it. Apple's walled-garden guarantee on consumer features is now legible as a device-registration surface, and any future work that wants to widen the gap has a clear place to start.