Android’s Find My Device network preps to crowdsource locating lost phones, secure vehicle data

Kyle Bradshaw | Aug 12 2021 - 8:26 am PT

Google is preparing to upgrade its “Find My Device” system to use other Androids to anonymously find your lost phone, as well as gain the ability to protect data on a lost vehicle.

About APK Insight: In this “APK Insight” post, we’ve decompiled the latest version of an application that Google uploaded to the Play Store. When we decompile these files (called APKs, in the case of Android apps), we’re able to see various lines of code within that hint at possible future features. Keep in mind that Google may or may not ever ship these features, and our interpretation of what they are may be imperfect. We’ll try to enable those that are closer to being finished, however, to show you how they’ll look in the case that they do ship. With that in mind, read on.

Dogfood

Before an app — or an update to an app — gets released to the public, Google will often test it internally in a process called “Dogfooding” (short for “eating your own dog food“). This week, a “dogfood” build of Google’s Find My Device app — version 2.4.043_df — began circulating online.

Considering this is a pre-release build not meant for the public, our findings here should be taken with a grain of salt, even more so than usual.

Spot / Find My Device network

Back in June, we discovered that Google was working on something called the “Find My Device network,” which will use Android devices to crowdsource the location of a missing device. In general, it should be a strong alternative to Apple’s Find My network.

At the time, we discovered the additions in Google Play Services, which makes sense given it comes installed on essentially every Android device by default, ensuring the Find My Device network will have as many participants as possible. Now, we’re finding out more about how the Find My Device network will work in the proper Find My Device app. A number of texts have been added to the app, all tagged “spot,” a codename we’ve seen in relation to the Find My Device network.

From the Find My Device app, you’ll be able to mark a particular phone or tablet as lost, at which point any Android devices that happen to pass by will notice the missing device via Bluetooth and report a “sighting” to the network.

<string name=”spot_mark_as_lost_suggestion”>Try marking the device as lost to get crowdsourced assistance in finding it.</string>

You are about to mark this device as lost. This will have the following effects:
You will get notifications when this device is sighted by another member of the Find My Device Network.
When this happens, the sighting user will be notified that they helped a fellow member of the network, without exposing your identity.
We will attempt to ring the device at the time of the sighting.

If you’re within range of your missing phone or tablet, you can also use the Find My Device network to make it ring.

<string name=”spot_ring_failed_device_error”>The device is in range of your Android(s), but is failing to respond properly.</string>

<string name=”spot_ring_failed_not_in_range”>The device is out of range of your Android(s).</string>

Another new feature in the works for Find My Device is the ability to “share” ownership of a device with other people. For example, a small business owner may wish to be able to access the location of a device purchased for an employee by the business in case the phone is ever lost or stolen. Or perhaps multiple members of a family would want to be able to locate a shared tablet.

Share Device

Sharing Settings

Only accept invitations to share a device with people you trust.

In addition to being able to find the shared device through the app, the co-owners’ other Android devices will report to Find My Device when the shared device has been “sighted,” presumably via Bluetooth.

If you accept, you will see this device and share your sightings of its location.

There appear to be two ways to share a device, the first of which is by generating a QR code that contains a cryptographic key for the device’s info.

Tapping Accept will open the camera so you can scan the QR code on %s’s screen. It contains a cryptographic key required to complete the process.

Alternatively, you can send someone a Find My Device link to share a particular phone, though it seems this link will expire if not accepted quickly.

To be able to accept, you must tap on the invitation message sent to you separately. It contains a cryptographic key required to complete the process.

To be able to accept, you must tap on the last invitation message sent to you. The link you followed has expired.

Find My Device makes it very clear that any co-owner of an Android device can locate the device at any time, and therefore, whoever is in possession of that device can be tracked by those co-owners.

Note: when the device is with you, you implicitly share your location with its co-owners (the users listed above).

Only invite people you trust to share a device.
Each co-owner can see the email addresses of all the others.

Vehicle data protection

When using Android Auto in your car, none of your sensitive data is accessible to the car itself, as the whole experience is being projected from your phone onto the display. With the newer Android Automotive system, where Android itself powers your car’s infotainment system, you can sign in to your own Google Account to be ready for a smart drive, with or without your phone.

But what if your car was ever stolen? In theory, the thieves would have access not only to your car, but they could also get some (albeit limited) personal info from your Google Account. To that end, just as the Find My Device app can secure your phone remotely when lost, the app is preparing to offer the same for vehicles, which we presume to mean cars running Android Automotive.

Checking connection to vehicle and profile

Lock profile

To protect your personal data and settings on the vehicle, lock your profile.
After profile lock, your existing password is required to unlock the profile on the vehicle.
If your vehicle is offline, your profile will be locked when it next goes online.

To do so, you’ll need to create a “profile” for your vehicle, which can be secured with a password.

To protect your personal data and settings on the vehicle, create a password. This will allow you to unlock your profile.
If your vehicle is offline, your profile will be locked when it next goes online.

You’ll also be able to remotely delete your profile, ensuring your private information is inaccessible.

If you delete your profile, all your data and custom profile settings will be erased from the vehicle.
If your vehicle is offline, your profile will be erased when it next goes online.
To delete your profile, sign-in with your Google Account.

Considering this information is for now only appearing in a “dogfood” build of Find My Device, meant for internal testing, there’s no telling how long it will be before this vehicle integration arrives.

Thanks to JEB Decompiler, from which some APK Insight teardowns benefit.