fileshare-poc

Privacy research into what a phone's nearby file sharing gives away over Bluetooth LE while the phone is discoverable. It reproduces published academic work from 2019 and 2021: the advertisements carry short fragments of hashes derived from the owner's phone number and email addresses, readable by anyone in Bluetooth range. Built to illustrate an article, it runs only against a phone you own. A Python tool on a stock Mac and a small Android app capture the advertisements, and the demonstration is a captured fragment matching a number you typed in yourself.

Scope

• Narrow on purpose. It collects nothing at scale and looks at no one else's phone. It confirms a fragment against an identifier the user already knows, and an offline self-test with a fictional number checks the whole pipeline with no phone present.
• What it showed. No special hardware is needed to see the broadcasts: an ordinary Mac sees them, and so does an Android phone through the platform's own Bluetooth scanner. A fragment on its own is too short to name a stranger; what it does is confirm a guess.
• Cross-checked. The Kotlin app's hashing was checked on the JVM against the Python side's test vector, so the two tools agree.

One day's work in October 2026, not under version control.