Special Report: Can you trust Amazon Sidewalk and Apple's Find My?

Special Report: Tin can you lot trust Amazon Sidewalk and Apple tree'south Notice My?

An Amazon Echo device juxtaposed with an Apple iPhone showing the Find My app in action.

(Image credit: Left: R. Classen/Shutterstock. Right: Apple)

Last month, Amazon finally turned on its long-planned Sidewalk home-network augmentation service. The backlash was firsthand.

"Sidewalk ... raises more cherry-red flags than a marching band parade," wrote The Washington Post, a newspaper that happens to be owned by Amazon founder Jeff Bezos.

"Amazon is again confirming that its true allegiances practise not lie with its customers," said the American Civil Liberties Union. "Instead, the visitor is moving to aggrandize its already capacious surveillance infrastructure."

"Unless yous opt out, your Amazon devices will automatically outset participating in this connectivity bacchanal," said Wired.

"It's but a matter of time before someone'south network gets hacked and data gets breached," a digital-rights expert told the Los Angeles Times. (Sidewalk does not grant users admission to other people's Wi-Fi networks.)

Upon closer examination, however, it's not entirely articulate whether that alarm is justified, especially when Apple tree's Find My network seems to work in much the same manner. So is Amazon Sidewalk safety to use, or do you really need to turn it off to protect your privacy and your home network?

What is Amazon Sidewalk, and how to opt out
How to set up the Amazon Echo

How Sidewalk works

Sidewalk turns nearly Amazon Echo devices and some recent Ring cameras (also fabricated by Amazon) into "bridges" that relay signals from low-ability wireless devices, such equally Tile tracking fobs and Level smart locks, to home Wi-Fi routers and the cyberspace beyond.

Here'south a list of the Repeat and Ring devices that work as Sidewalk bridges, including some models that are no longer sold:

Amazon Echo (3rd Gen)
Amazon Echo (fourth Gen)
Amazon Echo Dot (3rd Gen)
Amazon Echo Dot (4th Gen)
Amazon Echo Dot (3rd Gen) for Kids
Amazon Echo Dot (4th Gen) for Kids
Amazon Echo Dot with Clock (3rd Gen)
Amazon Echo Dot with Clock (4th Gen)
Amazon Echo Plus (1st Gen)
Amazon Echo Plus (2d Gen)
Amazon Repeat Show (1st Gen)
Amazon Echo Show (2nd Gen)
Amazon Echo Show v
Amazon Echo Prove eight
Amazon Echo Bear witness 10
Amazon Echo Spot
Amazon Echo Studio
Amazon Echo Input
Amazon Echo Flex
Ring Floodlight Cam
Ring Spotlight Cam Wired
Ring Spotlight Cam Mount

The Sidewalk function was remotely activated by Amazon on June 8 on Repeat and Ring devices that were already in people's homes, although users tin opt out. (More than on that at the cease of this story.)

Considering of Sidewalk, you'll now be able to locate a Tile tracking device (and whatever information technology'due south attached to) that's out of your telephone'southward Bluetooth range if in that location's an Amazon Echo or Ring device within range of the Tile. (Amazon says Sidewalk-compatible tracking devices for pets and adults with dementia are on the way.)

tile mate — (Image credit: Tom'due south Guide)

There'south a catch, though. Your Tile tracker doesn't communicate with merely your Amazon Echo or Band devices. Sidewalk lets it communicate with Whatever Amazon Repeat or newer Ring device within range, whether that device belongs to your neighbor, your cousin or someone halfway effectually the world.

This extends the useful range of Tile tracking devices and other Sidewalk-connected devices to the unabridged planet, theoretically. Too, other people'due south Tile trackers volition exist able to communicate with your Echo or Ring and use up a lilliputian of your internet bandwidth to attain the rest of the globe.

Sidewalk also serves equally a backup network: If yous lose internet connectivity at abode, your smart lock will all the same piece of work remotely equally long as it tin "hear" your neighbor'due south Echo. All communications between Sidewalk-enabled devices will be encrypted, Amazon says.

Stealing your data?

This network-sharing aspect, and the fact that Amazon switched on Sidewalk without asking device owners first, has got people upset.

"Amazon has helped itself to your Wi-Fi bandwidth and is allowing anyone nearby to use information technology while they're in the neighborhood," said AskCyberSecurity.com. "This may be plenty for some to opt out [of] Amazon Sidewalk immediately."

"This is uncharted territory for the privacy and security of devices like Alexa, Echo and Ring," Connecticut's state attorney general said. "Wireless networks are already notoriously vulnerable to hacks and breaches, and families need meliorate information and more time earlier giving away a portion of their bandwidth to this new system."

"Sharing your bandwidth with your neighbors is a great idea, said no ane ever," quipped one Twitter user in response to another who said he had no trouble with Sidewalk.

Sharing your bandwidth with your neighbors is a great idea, said no one ever 🤭🤭🤭July 4, 2021

None of this is quite authentic. Sidewalk does allow depression-energy devices piggyback on your home cyberspace connection via Echo and Ring devices, merely that'due south not the same thing every bit giving your neighbors total admission to your home Wi-Fi network. Those neighbors won't be able to access your Tile device from their home network, or vice versa.

Furthermore, the corporeality of data that is being used by these depression-power, low-information devices is minuscule.

"Nosotros're talking about 100-200 bytes per bulletin," said Jon Callas, a renowned security, privacy and encryption good who now works with the Electronic Frontier Foundation and recently wrote a detailed exam of Sidewalk. "That's literally rounding errors for bandwidth."

The transmission rate between a Sidewalk endpoint device and a Sidewalk span is capped at 80 kilobits per 2nd, non much faster than a dial-upwards modem, and the overall data usage is capped at 500 megabytes per calendar month, which Amazon says is "equivalent to streaming nearly 10 minutes of high-definition video."

Almost U.S. broadband subscribers have unlimited data caps, and then an extra 500MB of usage over a month won't exist noticed. However, for people whose home broadband usage is capped, half a gigabyte might be meaning.

That doesn't mean that major American internet service providers (ISPs) are absurd with Amazon Sidewalk, however.

"Amazon does not have the right to do this, full stop," an unnamed representative for an ISP told The Wirecutter for a recent article. "Information technology is not Amazon'south network to be sharing — they are putting their customers in violation of their agreements with their providers, and it is direct-up theft."

Apple tree does the same thing with Find My

Notwithstanding Amazon Sidewalk isn't the only such service that borrows your bandwidth in order to let low-power smart devices get online. A very like service has been effectually since 2010, and few people complain about information technology.

Information technology'southward Apple's Find My network, which started out as a way to locate lost phones and has since grown into a mode to find almost anything, including AirPods, Apple Watches and fifty-fifty high-end bicycles.

Apple'southward new AirTags apply Notice My to work in much the aforementioned way as Tile trackers exercise on Amazon Sidewalk. A lost AirTag will communicate via Bluetooth with any iPhone, iPad or Mac that happens to be inside range.

Find My then will use a small chunk of that Apple tree device's cellular or Wi-Fi data to attain out to Apple's servers, which then tell the AirTag's owner where it is.

The Find My network appears to exist turned on by default on Apple devices, just as Sidewalk is on by default on Ring and Echo devices, and the estimated two billion Apple devices worldwide make Find My a truly global network.

Turning on data-sharing services by default can be a trouble, as Luta Security founder Katie Moussouris pointed out.

"Vendors like Apple and Amazon should never enable new features that share whatever data or device admission like Wi-Fi without getting user informed consent first," Moussouris told Tom's Guide. "Personally, I disable features that are designed to share data, even if information technology means less convenience."

Nonetheless, there'southward been much less of a privacy outcry about Find My. No one is recommending that you turn off Discover My to protect your privacy, or that Apple should be paying you to use your cellular data.

Soon after AirTags were released this past April, it was establish that despite Apple's efforts to the contrary, you could indeed utilize AirTags to stalk or track people without their knowledge. Simply Apple quelled the bad publicity by fixing that trouble with an over-the-air update. (Tile is doing the aforementioned.)

A matter of perception

So is there a double standard? Why does Apple go a pass for Discover My when Amazon is raked over the coals of public stance for doing the same thing with Sidewalk?

"Apple seems to have done more to earn the trust of journalists and data protection experts," said Melanie Ensign, founder and CEO of Discernible, Inc. and an advisory lath member at The Ascension of Privacy Tech, a digital-privacy advancement grouping. "The archway of Amazon into this infinite is seen as more of a privacy concern considering of the company'south long history of privacy violations."

Ensign cited several recent examples of Amazon falling brusque on user privacy and having tight connections to government authorities.

An Echo device sent a recording of a married couple's private conversation to a friend; Ring used agile-duty constabulary officers to promote the company's devices; Amazon Web Services was used by Clearing and Customs Enforcement to collect data on illegal immigrants; and Amazon may take to pay the European Marriage $425 meg in fines for as-yet-unspecified violations of the General Data Protection Regulation.

A smart speaker listening to a couple's private conversation. — (Prototype credit: metamorworks/Shutterstock)

"It's unsurprising that customers and privacy advocates questioned Amazon's privacy and security commitments when it rolled out Sidewalk," said Lourdes Turrecha, founder of The Rise of Privacy Tech. "Can customers trust that Amazon will non overcollect, misuse, or overshare customer data?"

Meanwhile, Apple has made privacy one of its master selling points. That's non just marketing: Apple has acted on those principles, engaging in a very public court battle with the U.Southward. government over decrypting an iPhone belonging to a terror suspect.

"Apple tree has built trust with its customers when it comes to their information," said Turrecha. "This delivery to privacy comes from the peak: Apple CEO Tim Melt."

Technically, both Sidewalk and Find My are pretty prophylactic

In terms of security and encryption, both Apple tree Find My and Amazon Sidewalk seem to exist safety to use. Amazon has released a white paper detailing how Sidewalk works, and Apple tree has also released details about how the Find My network functions. Experts say there's not much to worry nigh from a technical bespeak of view.

"They certain do look remarkably similar to me," Chet Wisniewski, principal research scientist at Sophos, told Tom's Guide.

"They are both well designed and both companies have a good track tape securing their mobile/IoT devices," he added. "Clearly there is a chasm betwixt the privacy positions of Apple tree and Amazon, and that seems far more likely to result in this departure of public opinion."

Wisniewski pointed out, notwithstanding, that the expansion potential of the two networks is quite different. Apple tree's Detect My network is "practically a location beacon relay" that can send information only very slowly, limiting its prospects for time to come uses across locating devices.

Meanwhile, Sidewalk, which uses stationary rather than mobile devices as relays, is "designed to be a pseudo-permanent connection and to be used for a larger array of low-bandwidth communications," Wisniewski said.

That's partly because some Sidewalk-enabled relays, such every bit newer Repeat devices, have congenital-in 900MHz radios that tin behave a decent amount of data — betwixt 1 and ii megabits per second, a bit faster than a DSL connection — for longer distances and through more walls and trees than Bluetooth can. Until Sidewalk was activated, those 900MHz radios lay fallow.

"You won't be streaming your doorbell footage over Sidewalk," said Wisniewski, "but it isn't limited to things similar location beacons and alerts the aforementioned equally [Observe My]."

Of course, that brings us back to the issue of your neighbors "stealing" your bandwidth. For the moment, that's not much of a business organisation considering Sidewalk'southward usage of Wi-Fi networks is capped to low speeds and modest amounts of data, as detailed earlier.

That might change as the 900MHz network builds out, just for now, information technology's Apple users who should be more upset about broadband borrowing, Wisniewski said.

"Apple's bandwidth usage, while tiny, is more than probable to use mobile bandwidth, which is ofttimes costly and metered," he said. "Amazon Sidewalk is more than likely to use broadband connections where in that location is no data cap, or one large enough that a few kilobytes a twenty-four hour period is an uninteresting data indicate."

A public-relations problem

The Electronic Borderland Foundation's Jon Callas thinks that the bad publicity surrounding Sidewalk is a self-inflicted wound past Amazon.

"Amazon botched the announcement — that's the center that everything else revolves around," Callas said.

Amazon declared in May that all Echo devices, including those that had been sitting in customers' homes for years, would have Sidewalk switched on past default in a thing of weeks. Then Amazon allow the media convey that message to the public, along with a lot of misleading information, instead of doing information technology itself.

"Amazon never said, 'Nosotros accept a 900 MHz radio in these devices that nosotros program to use, and hither'southward how nosotros're gonna use it'," Callas said. "Amazon'southward 900MHz is actually a bright matter for home automation, [but] the fashion that we got told nigh it was, 'You accept 10 days before Amazon starts sharing your home cyberspace.'"

Ring floodlight camera — (Image credit: Time to come)

By contrast, Callas observed, Apple has slowly built upwards Find My so that customers acquire to trust information technology in stages every bit Apple tree incrementally adds more features.

"Get-go there was Find My iPhone, then Find My iPad, then Find My Friends," Callas said. "We take had over a decade to get used to it and empathize what was going on."

Even the backlash against Apple's AirTags was an opportunity that Amazon missed, Callas pointed out. Amazon's partner Tile certainly took notice.

"When [Apple tree] came out with AirTags, they congenital in some anti-stalking measures and fixed the problems," he observed. "Amazon has been by and large silent. Tile came out and said there were problems, and said they would piece of work on it."

If Amazon had introduced Sidewalk to the public the style Apple unveils its ain new features and services, Callas said, we might non be debating Sidewalk's privacy and security.

"Everyone has a corner of their business firm where Wi-Fi doesn't work," he pointed out. "If Amazon had come out and said, 'Here'southward the solution,' we all would have gone, 'Wow, that's brilliant,' and there would be articles about how Amazon had taken abroad the lead in home automation from Google and Apple tree."

A long-continuing consequence of mistrust

Still, Amazon'southward trust bug seem to go deeper than just bad product rollouts. The close partnerships between Ring and local constabulary departments has made ceremonious libertarians suspicious of Amazon, and a wave of "hacks" of Ring devices (many of which were due to reused or weak passwords) got enough of publicity a couple of years ago.

"Every bit Apple has demonstrated, trust is built through consistent behavior over a long period of time," Ensign said. "The backlash we're seeing against Amazon indicates that in the optics of the public, the company has not washed enough to earn the trust they're asking for."

"Amazon cannot hope to win public trust with the blueprint of a single product," she added. "They will take to echo this kind of development over and over and over."

How to turn off Sidewalk or Find My

If you lot're still worried about Sidewalk, it's non that hard to opt out of using information technology. Check out our more in-depth explanation of how to plough off Sidewalk, just the basic steps are these. Unfortunately, yous'll have to do this separately for Alexa and for Ring.

For Alexa:

Open the Alexa app on your mobile device.
Tap the More push button.
Tap Settings.
Tap Account Settings.
Tap Amazon Sidewalk.
Tap the toggle switch to plough Sidewalk on or off.

For Ring:

Open the Ring app on your mobile device.
Tap the three-line "hamburger" icon in the top corner.
Tap Control Centre.
Tap Sidewalk.
Tap the toggle switch to plough Sidewalk on or off.
Ostend that you lot practise indeed desire to turn off Sidewalk.

There'due south less concern about Apple tree's Find My network, simply turning information technology off on an iPhone is simple.

For Find My network:

Open Settings.
Click on your proper noun.
Click on Find My.
Toggle off Notice My network.

Notice that yous can leave Observe My turned on for your iPhone while switching off the Find My network. (Here'due south how to plow off Find My altogether.)

You'll still exist able to locate your iPhone as long as information technology's powered on, but switching off the Notice My network will no longer make it possible for your iPhone to be establish if it'due south turned off or out of battery power.

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting effectually in the information-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown upwardly in random Tv news spots and even chastened a console discussion at the CEDIA domicile-engineering conference. You can follow his rants on Twitter at @snd_wagenseil.