4 ms·

I can't help but wonder...how many real-world businesses could benefit from the same type of invasive tracking that online businesses seem to think they have a

by cubano 11y ago

I can't help but wonder...how many real-world businesses could benefit from the same type of invasive tracking that online businesses seem to think they have a right to subject us with? For some reason, though, we don't allow that sort of privacy violation in our actual lives. However, most real-world businesses manage to do quite well even with our rude dismissals of their desire to track us. [edit]

rhizome 11y ago
https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act
chimeracoder 11y ago
> For some reason, though, we don't allow that sort of privacy violations in our actual lives. Nomi is a startup that does exactly this. They use open WiFi networks to harvest MAC addresses of cell phones and track people's locations that way. The only way to "opt out" is to register your MAC address with them. (Aside from just disabling WiFi on your phone, of course).
- cubano 11y ago
  Well, I won't be using "Nomi" or recommending them to my friends anytime soon, so good luck to them and their business model.
  - danjayh 11y ago
    Um ... it doesn't work exactly like that. If you leave your phone's WiFi turned on, you and your friends will be using Nomi sometime soon (so exciting, amiright?)! You see, the store/eatery/prison/airline/casino/whatever just puts the Nomi WiFi access point on their premises, and when you come in your phone tries to connect to it, and BLAMO, it harvests your MAC address. Now they have a unique identifier for 'you' (your phone's MAC), and they can keep track of how many times you go into the place, where else you like to go, what sections you like to browse (just a few more of the gadgets scattered in the store), if you've been to their marketing events, etc. etc. etc. Oh hey, since it harvests your MAC address, they can also tell who manufactured your phone. 'you' have an apple phone? Sweet! We've got ourselves a (probably) high-end customer. Welcome to the future :(
    - voltagex_ 11y ago
      Also, because no one gives a damn, your phone will also shout out the names and MACs of access points it's connected to before. I have no idea why Android/iOS hasn't disabled / geofenced that yet.
      - kogepathic 11y ago
        Phones do this to authenticate faster to known access points. Instead of waiting for an SSID beacon, they just broadcast their known networks and if one of them is in range, the AP will reply. It's all driven by user demand to connect to their WiFi network faster. Also, AFIAK, this is required behaviour to join networks that don't broadcast their SSID (e.g. "hidden" networks). I see two solutions to this problem, but neither are really tenable from a user perspective: 1) run the GPS all the time and geotag known APs[1] 2) leave the WiFi radio on all the time and passively listen for SSID broadcasts[2] [1] doesn't work indoors, or if the location of an AP is changed (e.g. 4G hotspot). Will also have significant impact on battery runtime, and likely to be abused by ad companies [2] will have significant impact on battery runtime
        schoen 11y ago
        It's hard to solve this part of the problem using current wifi protocols. I think this is closely related to other problems that people have studied and I'm sure protocol improvements could be made using public-key crypto or HMAC. As an off-the-cuff example, when you join an encrypted network, it could tell you (over the encrypted channel) a shared secret to use when reconnecting. Then you could broadcast HMAC(secret, current time) or (nonce, HMAC(secret time, nonce)) and if the wifi network recognizes one of those broadcasts as directed to it, it could reply. An eavesdropper who doesn't know the secret wouldn't be able to determine which base station the mobile device was trying to contact.
  - schoen 11y ago
    From the description above, they probably don't interact with users in a way that the users can see or control.
- dantiberian 11y ago
  This is why iOS came out with a MAC address randomiser when it is passively scanning for networks.
sdrothrock 11y ago
> I can't help but wonder...how many real-world businesses could benefit from the same type of invasive tracking that online businesses seem to think they have a right to subject us with? > For some reason, though, we don't allow that sort of privacy violation in our actual lives. > However, most real-world businesses manage to do quite well even with our rude dismissals of their desire to track us. Are you sure you're not being tracked? There are technologies like Prism[1] that allow stores to track people, where they go, how long they stay there, etc. On the lower-tech side, point cards[2] are also used to track purchasing habits. [1] https://prism.com/ https://prism.com/ [2] http://consumerist.com/2012/02/17/target-figures-out-teen-girl-is-pregnant-before-her-father-does-sends-helpful-coupons/ http://consumerist.com/2012/02/17/target-figures-out-teen-gi...
hackuser 11y ago
> how many real-world businesses could benefit from the same type of invasive tracking ... we don't allow that sort of privacy violation in our actual lives. We do, but apparently many even on HN don't realize it. Brick and mortar stores track customers through their phone signals (providing unique identifiers and location), cameras that can track where people go in the store and even what they look at, and more. Here are a couple of good resources where I've learned about it (though they cover much more than those issues): * http://www.mediapost.com/ http://www.mediapost.com/ * http://www.iab.com/ http://www.iab.com/
guiambros 11y ago
> For some reason, though, we don't allow that sort of privacy violation in our actual lives. Not so much. Your phone carrier tracks all your movements. Your credit car company knows every swipe. Your bank sells your information to retailers. The leasing you did on that car got you into a database of new car owners. Right after you married you started getting offers from Home Depot. And with your mortgage you started getting calls from brokers, asking if you want to put it back in the rental market... The "real world" may not track your anonymous movements yet (NYPD cameras, anyone?), but other than that I don't see much difference. In fact it's the opposite; the non-online world is more opaque, harder to opt-out, and much more invasive, as it usually involves PII. Another difference to consider: the motivations. In the 'real world', we used to pay for goods. In the past you'd walk to your newsstand and buy the NYT edition for $2.50 (with ads). Nowadays, people feel outraged[1] if the exact same goods aren't given away for free (as in beer), and with no trackers, no registration, no ads, no anti-ad-blockers. Something has to give. [1] http://the-digital-reader.com/2015/12/16/95221/ http://the-digital-reader.com/2015/12/16/95221/
- LoSboccacc 11y ago
  Even on paper magazines people were fed up and pushing back some time ago, I remember seeing 'this magazine is less than 50%'ads' or the like as a pride point, so at some point salesmen thought that was a good enough differentiator
  - greggman 11y ago
    Back before the Internet (browsers) a big reason I bought/subscribed to magazines was for the ads. That was how I found out about most new products. Today I rarely find out about anything from ads. Instead I find out from sites like HN, slashdot, etc or from social network connections and groups
Angostura 11y ago
> For some reason, though, we don't allow that sort of privacy violation in our actual lives. Because shops never monitor footfall in certain aisles. Of course real-world businesses do this. Plus all those people who carry loyalty cards.
dspillett 11y ago
> For some reason, though, we don't allow that sort of privacy violation in our actual lives. Actually, people do. Take for example supermarket loyalty cards: every purchase is logged. It compounds with online tracking too: when you then login to the online site to check your points or view offers, the information about your purchases can then be linked to web analytics and other profiled data.
blakeyrat 11y ago
> I can't help but wonder...how many real-world businesses could benefit from the same type of invasive tracking that online businesses seem to think they have a right to subject us with? Most companies that collect data use it to make money. That's not true ONLY on the web. > For some reason, though, we don't allow that sort of privacy violation in our actual lives. Really? Do you have any grocery store loyalty cards? Do you use a credit card? That data is shared and sold. Do you do any activities that show up on your credit report, like pay bills to a utility? That data is shared and sold. That's how the credit rating agency got it. Do you have a set-top box? It's probably selling data on what shows you watch. Do you have a cell phone? Location data. If you actually restricted yourself to purchases which don't involve anybody who shares your data, you'd be living in a cave.

by cubano 11y ago

rhizome 11y ago

https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act https://en.wikipedia.org/wiki/Video_Privacy_Protection_Act

chimeracoder 11y ago

> For some reason, though, we don't allow that sort of privacy violations in our actual lives. Nomi is a startup that does exactly this. They use open WiFi networks to harvest MAC addresses of cell phones and track people's locations that way. The only way to "opt out" is to register your MAC address with them. (Aside from just disabling WiFi on your phone, of course).

cubano 11y ago
Well, I won't be using "Nomi" or recommending them to my friends anytime soon, so good luck to them and their business model.
- danjayh 11y ago
  Um ... it doesn't work exactly like that. If you leave your phone's WiFi turned on, you and your friends will be using Nomi sometime soon (so exciting, amiright?)! You see, the store/eatery/prison/airline/casino/whatever just puts the Nomi WiFi access point on their premises, and when you come in your phone tries to connect to it, and BLAMO, it harvests your MAC address. Now they have a unique identifier for 'you' (your phone's MAC), and they can keep track of how many times you go into the place, where else you like to go, what sections you like to browse (just a few more of the gadgets scattered in the store), if you've been to their marketing events, etc. etc. etc. Oh hey, since it harvests your MAC address, they can also tell who manufactured your phone. 'you' have an apple phone? Sweet! We've got ourselves a (probably) high-end customer. Welcome to the future :(
  - voltagex_ 11y ago
    Also, because no one gives a damn, your phone will also shout out the names and MACs of access points it's connected to before. I have no idea why Android/iOS hasn't disabled / geofenced that yet.
    - kogepathic 11y ago
      Phones do this to authenticate faster to known access points. Instead of waiting for an SSID beacon, they just broadcast their known networks and if one of them is in range, the AP will reply. It's all driven by user demand to connect to their WiFi network faster. Also, AFIAK, this is required behaviour to join networks that don't broadcast their SSID (e.g. "hidden" networks). I see two solutions to this problem, but neither are really tenable from a user perspective: 1) run the GPS all the time and geotag known APs[1] 2) leave the WiFi radio on all the time and passively listen for SSID broadcasts[2] [1] doesn't work indoors, or if the location of an AP is changed (e.g. 4G hotspot). Will also have significant impact on battery runtime, and likely to be abused by ad companies [2] will have significant impact on battery runtime
      - schoen 11y ago
        It's hard to solve this part of the problem using current wifi protocols. I think this is closely related to other problems that people have studied and I'm sure protocol improvements could be made using public-key crypto or HMAC. As an off-the-cuff example, when you join an encrypted network, it could tell you (over the encrypted channel) a shared secret to use when reconnecting. Then you could broadcast HMAC(secret, current time) or (nonce, HMAC(secret time, nonce)) and if the wifi network recognizes one of those broadcasts as directed to it, it could reply. An eavesdropper who doesn't know the secret wouldn't be able to determine which base station the mobile device was trying to contact.
- schoen 11y ago
  From the description above, they probably don't interact with users in a way that the users can see or control.
dantiberian 11y ago
This is why iOS came out with a MAC address randomiser when it is passively scanning for networks.

sdrothrock 11y ago

> I can't help but wonder...how many real-world businesses could benefit from the same type of invasive tracking that online businesses seem to think they have a right to subject us with? > For some reason, though, we don't allow that sort of privacy violation in our actual lives. > However, most real-world businesses manage to do quite well even with our rude dismissals of their desire to track us. Are you sure you're not being tracked? There are technologies like Prism[1] that allow stores to track people, where they go, how long they stay there, etc. On the lower-tech side, point cards[2] are also used to track purchasing habits. [1] https://prism.com/ https://prism.com/ [2] http://consumerist.com/2012/02/17/target-figures-out-teen-girl-is-pregnant-before-her-father-does-sends-helpful-coupons/ http://consumerist.com/2012/02/17/target-figures-out-teen-gi...

hackuser 11y ago

> how many real-world businesses could benefit from the same type of invasive tracking ... we don't allow that sort of privacy violation in our actual lives. We do, but apparently many even on HN don't realize it. Brick and mortar stores track customers through their phone signals (providing unique identifiers and location), cameras that can track where people go in the store and even what they look at, and more. Here are a couple of good resources where I've learned about it (though they cover much more than those issues): * http://www.mediapost.com/ http://www.mediapost.com/ * http://www.iab.com/ http://www.iab.com/

guiambros 11y ago

> For some reason, though, we don't allow that sort of privacy violation in our actual lives. Not so much. Your phone carrier tracks all your movements. Your credit car company knows every swipe. Your bank sells your information to retailers. The leasing you did on that car got you into a database of new car owners. Right after you married you started getting offers from Home Depot. And with your mortgage you started getting calls from brokers, asking if you want to put it back in the rental market... The "real world" may not track your anonymous movements yet (NYPD cameras, anyone?), but other than that I don't see much difference. In fact it's the opposite; the non-online world is more opaque, harder to opt-out, and much more invasive, as it usually involves PII. Another difference to consider: the motivations. In the 'real world', we used to pay for goods. In the past you'd walk to your newsstand and buy the NYT edition for $2.50 (with ads). Nowadays, people feel outraged[1] if the exact same goods aren't given away for free (as in beer), and with no trackers, no registration, no ads, no anti-ad-blockers. Something has to give. [1] http://the-digital-reader.com/2015/12/16/95221/ http://the-digital-reader.com/2015/12/16/95221/

LoSboccacc 11y ago
Even on paper magazines people were fed up and pushing back some time ago, I remember seeing 'this magazine is less than 50%'ads' or the like as a pride point, so at some point salesmen thought that was a good enough differentiator
- greggman 11y ago
  Back before the Internet (browsers) a big reason I bought/subscribed to magazines was for the ads. That was how I found out about most new products. Today I rarely find out about anything from ads. Instead I find out from sites like HN, slashdot, etc or from social network connections and groups

Angostura 11y ago

> For some reason, though, we don't allow that sort of privacy violation in our actual lives. Because shops never monitor footfall in certain aisles. Of course real-world businesses do this. Plus all those people who carry loyalty cards.

dspillett 11y ago

> For some reason, though, we don't allow that sort of privacy violation in our actual lives. Actually, people do. Take for example supermarket loyalty cards: every purchase is logged. It compounds with online tracking too: when you then login to the online site to check your points or view offers, the information about your purchases can then be linked to web analytics and other profiled data.

blakeyrat 11y ago

> I can't help but wonder...how many real-world businesses could benefit from the same type of invasive tracking that online businesses seem to think they have a right to subject us with? Most companies that collect data use it to make money. That's not true ONLY on the web. > For some reason, though, we don't allow that sort of privacy violation in our actual lives. Really? Do you have any grocery store loyalty cards? Do you use a credit card? That data is shared and sold. Do you do any activities that show up on your credit report, like pay bills to a utility? That data is shared and sold. That's how the credit rating agency got it. Do you have a set-top box? It's probably selling data on what shows you watch. Do you have a cell phone? Location data. If you actually restricted yourself to purchases which don't involve anybody who shares your data, you'd be living in a cave.