4 ms·

I've thought about this as well. Although I've never understood why it had to be a special card. But it would be nice to bridge physical store loyalty cards wit

by vyrotek 17y ago

I've thought about this as well. Although I've never understood why it had to be a special card. But it would be nice to bridge physical store loyalty cards with online store loyalty cards. You really only need some sort of global ID for the customer right? We'll why not try to make it a standard to use a QR code which stores an MD5 Hash of your email address? This way it can be printed on almost anything by anyone. The first time you visit a store and use it they ask you for your email address and confirm that code is yours and matches. Its also a way to control who gets your email. Then like you mentioned, you host an information lookup/recording service. The specific thing about the idea that has always intrigued me is the idea of multiple companies knowing about my spending habits at each place. Make you can charge McDonalds more money for access to my BurgerKing buying habits. That would help McDonalds market things much better than just knowing why I buy at their stores. The best part about the QRCode/Hash concept is that I can make my first one or a new one at anytime. I don't have to fill out some huge form while at the grocery store. I would also love access to my own usage history as a consumer. It could work well with services like Mint perhaps.

jodrellblank 17y ago
And then I can make one which is an MD5 hash of your email address and make it look like you buy ... well, all sorts of interesting things. Also, an MD5 hash of an email address is sometimes reversible. Search the web for the MD5 hash of my email address using duckduckgo.com and it finds a Disqus profile for me, identified by the md5 hash, but if you click 'claim profile' it tells the full email address. And that exists accidentally because I commentented on some blogs using that email address not knowing Disqus aggregates cross-blog comments. Also, the space of input is vastly constrained, most people will have an @popular-domain address (by definition of popular domain) so @gmail.com, yahoo, hotmail, aol will cover a lot. And the initial bit is probably not random - either names or initials and names or names with numbers will get a lot. On forums the guess forum-username@gmail.com is likely to be right for a few people. In other words an MD5 hash of an email is only pretend secret, so make it clear that it's not intended to be secret and use a QR code of the email address itself, or use some unrelated ID which really keeps the email address secret.

by vyrotek 17y ago

jodrellblank 17y ago

And then I can make one which is an MD5 hash of your email address and make it look like you buy ... well, all sorts of interesting things. Also, an MD5 hash of an email address is sometimes reversible. Search the web for the MD5 hash of my email address using duckduckgo.com and it finds a Disqus profile for me, identified by the md5 hash, but if you click 'claim profile' it tells the full email address. And that exists accidentally because I commentented on some blogs using that email address not knowing Disqus aggregates cross-blog comments. Also, the space of input is vastly constrained, most people will have an @popular-domain address (by definition of popular domain) so @gmail.com, yahoo, hotmail, aol will cover a lot. And the initial bit is probably not random - either names or initials and names or names with numbers will get a lot. On forums the guess forum-username@gmail.com is likely to be right for a few people. In other words an MD5 hash of an email is only pretend secret, so make it clear that it's not intended to be secret and use a QR code of the email address itself, or use some unrelated ID which really keeps the email address secret.