Anyone hosting a public API?

[mrx23dot]

even with rate limit,
so non MAC users can also try this out.

[Chapoly1305]

Technically speaking, it's possible. Such service would require a funding, does not need to be much. To host a service with Kickstarter. The funding can be used to pay for the macOS machine (both rental or purchse are possible). I checked yesterday that a mac VPS is about 30 USD per month, which is fairly possiable to share on 10 users. The only thing currently remain unknown is the API limit of Apple, and will Apple ban Apple ID by inquery too freqently.

[paolostefanucci]

Hi, did you discover if there is a API limit of Apple, and if Apple ban Apple ID by inquery too frequently?
I want know if is it possible to create an openhaystack server and use many tags that frequent query to the Apple FindMy Network

[Chapoly1305]

Hello,
You can send a query with many many many tags (i tried hundreds in a single request) hashed adv. pubkey for getting the reports at once , I did not notice any limit at all. I am not sure what's gonna happen if you query too frequently (like every 20ms).

[Chapoly1305]

@mrx23dot

Appreciate to the following projects,

• https://github.com/seemoo-lab/openhaystack
• https://github.com/biemster/FindMy
• https://github.com/Dadoum/anisette-v3-server

For whom wish to give this concept a try, but lacking an appropriate mac device, may refer to a fork https://github.com/chapoly1305/FindMy to setup a server without the need of mac. Ideally, The server can be any Linux PC, or a cloud VPS.

Or, Calculate the Hashed Advertisement Key then get the encrypted report from my PoC website. As it's a PoC, so the API has set a global rate limiter. This is only for reference purpose so please do not attack and setup your own server for your own use. Usability of this server is not promised.
https://hello-world-proud-fire-51f6.hallo-world.workers.dev/docs

import base64 
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import ec
import hashlib

# Example:
# Private key: JvMSTj3fwLf/d7XFZUHMvqFpJjEQDzZvVPMdBA==
# Public/Advertisement key: l0kIhxMwK0el8W5y5abJQ9oCv4tYa2UWlLjRQA==
# Hashed adv key: MCNvYOZe1XrMo03Y1bimRa1iK9uzA7gaFZYtwEhRGOM=

private_key_b64 = "YOUR PRIVATE BASE64 KEY"
private_key = ec.derive_private_key(int.from_bytes(base64.b64decode(private_key_b64),byteorder="big"), ec.SECP224R1(), default_backend())

public_key = private_key.public_key()
public_key_bytes = public_key.public_numbers().x.to_bytes(28, byteorder='big')

digest = hashlib.new("sha256")
sha_value = digest.update(public_key_bytes)
sha_value = digest.digest()
s256_b64 = base64.b64encode(sha_value).decode("ascii")
print (s256_b64)

If the Hashed ADV key format is correct, the API will respon a JSON. The content of JSON might be "{\"results\":[],\"statusCode\":\"200\"}" if there is no data has sent to Apple, or few encrypted reports. For privacy consideration, I will not collect your report neither able to decrypt the report to see your location. So you will need to decrypt the reports on your own. All the codes and implementations can be found on the project mentioned above.