9 ms·

Retailers are turning to facial recognition software (2018)

173 points by elorant 7y ago

huffmsa 7y ago
Casinos have been doing this for a long time. You've also got a GPS becon in your pocket, and are probably paying with a card attached to your name and government ID number. So unless you're paying in cash and not carrying a phone, you're already a big red dot.
- Jedi72 7y ago
  I live in Texas, and I've seen awkward moments at dinner parties where pro-gun people say the government must not ever have a registry of owners or civilization will collapse. I bet that the next day, to let off a little steam, they bought bullets on their iPhone and had Google maps take them to the range...
  - Gracana 7y ago
    Are you saying they're hypocrites because you imagined it so?
    - mamon 7y ago
      I understood GP post more like "They are afraid of government registry, yet willingly give their sensitive data to corporations."
      - deogeo 7y ago
        "Willingly" might be overstating things - Google is expert at misleading privacy notifications, and just like they wouldn't expect the local baker to keep logs of what they buy and when, and sell them to data collectors, maybe they have a naive idea that buying something on their phone is similar. They're just not aware how deeply hostile and backstabbing the entities they're dealing with are - like most humans, they're adapted to dealing with neighbors and people they know, not amoral international conglomerates.
        lonelappde 7y ago
        Almost everyone works for a company that does marketing, so it's weird to please ignorance.
      - smnrchrds 7y ago
        Which we now know, courtesy of Edward Snowden, that it is not much different from giving sensitive data directly to the government.
        lonelappde 7y ago
        That was known long before Snowden did anything.
        dredmorbius 7y ago
        "The cascade of reports following the June 2013 government surveillance revelations by NSA contractor Edward Snowden have brought new attention to debates about how best to preserve Americans’ privacy in the digital age." Pew, 2015 https://www.pewresearch.org/internet/2015/05/20/americans-attitudes-about-privacy-security-and-surveillance/ https://www.pewresearch.org/internet/2015/05/20/americans-at... Unfortunately time-series data on perceptions and sentiments is difficult to find. But the very fact we're discussing this on the grounds of it being or not being an Edward Snowden-related awareness speaks to Snowden's impact. As does the the fact that the matter hasn't been considered notable enough to warrant tracking over time as part of a sentiment study. Writing as someone who has been long aware of the issue, well before Snowden. But who has also noted that the nature and tenor of discussions with others since has changed markedly.
  - DSingularity 7y ago
    Why is it awkward? Because only you recognize the extent of their privacy loss? Enlighten them.
    - bilbo0s 7y ago
      This. Why are we allowing people to go around society being this ignorant of what's going on? Take the opportunity to gently inform the guy of all the information the government has on him.
    - Jedi72 7y ago
      This is not a case of consistent logic through ignorance. The same friends who will literally go out guns blazing before letting law enforcement take their AR15, believe Snowden was a traitor and the intelligence agencies would never abuse their power ¯\_(ツ)_/¯
  - Y-Bopinator 7y ago
    It’s only awkward for people like you who don’t get it.
  - beamatronic 7y ago
    Indeed.... Who needs a registry when you have real-time data!
  - deleted 7y ago
    [deleted]
- WarOnPrivacy 7y ago
  > You've also got a GPS beacon in your pocket I don't. My phones are rooted. GPS access is limited to a few apps and only on demand. So is app-access to IMEI and other identifying markers. Not by design but I also get a new SIM each month ($18 unlmtd talk/text+10GB). These measures are all technologically & economically cheap, btw. But they're locked away from consumers because the compulsion to control end users is a sickness that corporations can't regulate on their own.
  - RL_Quine 7y ago
    There's still commercial products that will track your wifi/bluetooth MAC, and probably ISMI as well. You're not preventing this sort of thing with that sort of behavior and just making things awkward for yourself. If I can find the home addresses of people walking past my house using reverse lookups of ESSID probes, you can be damn sure that everybody else is doing it too.
    - Teever 7y ago
      > If I can find the home addresses of people walking past my house using reverse lookups of ESSID probes Can you tell me more about this?
      - RL_Quine 7y ago
        When your device is trying to find networks its seen previously, it for some reason broadcasts the ESSID, the human readable name of the networks it knows about. A lot of these are globally unique, as many routers come with a default name which is based on their MAC address. You walk past my house, I see you have connected to direct-roku-845-7e16d8. Great! I can go do a reverse lookup of that (say, based on information collected by SkyHooks or WiGLE), and I now know that you've at least authenticated to a network in downtown SF one time. With a good sampling of these (many pieces of software send the last 4+ networks), I can get an idea of where you live, where you work, and where you've traveled. From your device details I can tell what brand of device you have, from the times of day I see you I can work out what your patterns and behaviors are, from your bluetooth connections I can get an idea of what sort of devices you own. I can even match this with real time video and directional antennas to match this with a picture of your face. This is all things that an individual can do right now with off the shelf software, not something you need to be a company or a government agency to pull off. This is absolutely receive only, and does not interact with anybodies devices in any way. It is not illegal and you can not detect that someone is doing this sort of attack. Your only defense against this is to have as bland and as generic of a wifi point name as possible.
- tsukurimashou 7y ago
  It is certainly not with "give up" and "it is already too late" attitudes that things will change
bsenftner 7y ago
Loss/theft prevention is a priority for retail adoption of FR, but the cherry on top is the creation of real world consumer tracking that every website gets "for free" due to their web platform, which until FR had no equivalent in the real world. With an FR enhanced retail location, the store knows your face visited just as a web site knows your IP address visited. This will overlay a tracking capability on the real world with as much capacity as the out of control tracking of people online. For this key reason, we need regulation to prevent the sharing of any and all personal data between organizations. Wrong identification and junk/incorrect/false data in retail/non-authoritative databases must never be combined to create an uber-database of dirty data we get impressed as "official".
mistrial9 7y ago
This has been going on for more than five years in California; Target and Chipotle are rumored early adopters. Individual vendors are supplying and installing the setup into corporate chain retail locations, creating "jobs".
- deleted 7y ago
  [deleted]
- strictnein 7y ago
  Target stopped this, per the article.
falcolas 7y ago
> ”It’s making Illinois a technology desert.” It makes me want to move to Illinois. How tone deaf is this company? I also noticed that they couch their losses in “lost sales”, as if the shoplifters would have purchased the items had they only been caught.
- BurningFrog 7y ago
  Someone else would have purchased the items, had they not been stolen.
  - lonelappde 7y ago
    Extraordinary assertion without evidence. How often is a desired product unavailable because some of the inventory was shoplifted?
    - deleted 7y ago
      [deleted]
    - asdfasgasdgasdg 7y ago
      Even if it is not lost sales, there's obviously an increased cost associated with breakage in that you have to buy new goods at the wholesale price to replace the ones that were stolen. Grocery stores, for example, have gross margins of about 10-15%, so even if "lost sales" is not entirely accurate, it's close enough that it's not going to severely misrepresent the size of the problem. Perhaps in the case of a luxury goods shop where the gross margins are 50%+ this is not the case.
    - jaxn 7y ago
      It may not be sold at full price, but pretty much everything sells.
  - falcolas 7y ago
    Someone else may have purchased the items. Eventually. Or it may have spoiled and been thrown out for perishables. Or it may have been sold on sale. Or it may have not sold at all before being destroyed or liquidated. Lots of maybes there. A sale at sticker price can't be assumed just because the product exists in a store. Had the story used the cost of the item, not imagined sales, I wouldn't have brought it up.
Proven 7y ago
It's not without implicit consent. When you walk on to another person's property (the store) you consent to their rules. Maybe those rules aren't reasonable and may be declared illegal, but consent is present.
goalieca 7y ago
Six years ago I interviewed at a company that was working on this technology. My background was in image processing and segmentation. I knew someone else would work on it if I didn’t but I still couldn’t sleep with myself at night working for a company whose monetization depends on data mining people. It deeply saddens me that even this shopping mall where I’m currently posting from, tracked customers secretly and got busted with a bit of luck. Eventually they will win. :(
- Balgair 7y ago
  It's a funny thing. You hear on HN constantly that everyone's backend is a mess, that the SQL tables are incomprehensible, the AWS server has crashed again. Surely these scummy companies must be in the same state? I know that security through obfuscation is not a valid method for storing bitcoin keys. But privacy via idiocy is more common than not (exceptions do apply: https://en.wikipedia.org/wiki/History_of_the_Jews_in_the_Netherlands#The_Holocaust https://en.wikipedia.org/wiki/History_of_the_Jews_in_the_Net...)
  - ikeyany 7y ago
    Talented people write unmaintainable spaghetti code all the time.
gregjw 7y ago
Not okay.
deleted 7y ago
[deleted]
dropoutcoder 7y ago
Ten years ago I thought there would be a cultural shift towards wearable spy technology. Now I wonder if there will be a shift towards developing anonymous masks worn as part of a cultural norm.
- dadarepublic 7y ago
  You mean like this? https://twitter.com/Gaohmee/status/1219662707839795200?s=20 https://twitter.com/Gaohmee/status/1219662707839795200?s=20
- BelleOfTheBall 7y ago
  It's already starting to happen, this article and thread have cool info on it: https://news.ycombinator.com/item?id=22028422 https://news.ycombinator.com/item?id=22028422
- BurningFrog 7y ago
  Honestly, wearing a mask in public is really creepy. I'm sure I'm far from alone in assuming you're out to commit violent crime.
  - servercobra 7y ago
    For us, sure. But look at Hong Kong right now. When everyone is aware of and agrees there is a risk, it becomes more socially acceptable.
  - dropoutcoder 7y ago
    The workaround is to wear a realistic facemask
  - dredmorbius 7y ago
    Wearing of masks in public has actually been a social norm at times, notably in Venice: https://www.veneto-explorer.com/history-of-the-venetian-masks.html https://www.veneto-explorer.com/history-of-the-venetian-mask...
- philippoi 7y ago
dadarepublic 7y ago
I like how the gif showing the shoppers they should "observe" as being a risk is of two burn out looking dudes. A total stereotype. It begs the question are these type of stereotypes baked into the FaceFirst software? The other image of a violent offender is more along the Ted Bundy type. Less a victim of traditional bias but a total serial killer stereotype - white, inconspicuous male. It's usually a slippery slope with these kinds of biases being perpetuated at the software design level - "stoner" types, minorities, and other marginalized groups often getting the short end of the stick. I understand retail wanting to reduce shrinkage (the term for stock loss via theft). I guess that's one concern as a whole, how is it ethically being handled?
tempsy 7y ago
Isn’t this what B8ta does, which I haven’t heard much criticism of or about?
allovernow 7y ago
What do you do? Start growing all of your vegetables in your backyard, and order what you must with a fake identity from behind a proxy online? I was going to question if we'd reached the point where it is not only impossible to avoid handing over intimate identifiable data, but necessary to participate in society - and I realized that we probably passed that threshold a few years ago, although this does make things seemingly worse. I wonder how long before they'll ban adversarial masks or hats in the name of safety or some other such nonsense...
- root_axis 7y ago
  Boycott and protest, name and shame.
- GordonS 7y ago
  When ordering the fake ID, you'd need some kind of method that allowed the buyer to remain anonymous - I guess there are a few crypo currencies that fit the bill. You'd also need to get the fake ID delivered somewhere other than your home, so it couldn't be trivially tied back to you.
  - jlgaddis 7y ago
    > ... so it couldn't be trivially tied back to you. Except that a fake ID will have your picture on it.
- nocturnial 7y ago
  > What do you do? First ask them why they need this system. If it's reasonable then implement rules and laws so it can only be used for this specific purpose. If the reason for installing it is to prevent theft then they shouldn't have any problems with rules limiting them to this one specific usage and a fine if they used it for anything else (eg. marketing). We can also make up rules where it is acceptable to use it for marketing (informed consent being the bare minimum). These things, like face recognition of customers, have a tendency of spinning out of control. They say they originally used it for purpose X but because they have the data... Why not use it for purpose Y and Z?
- 7y ago
siruncledrew 7y ago
There's already many services that exist for accessing databases of personal data, it's just a matter of combining them into some sort of mesh to really tip the scales to the extreme. With facial recognition being able to query a face against a number of databases, and payment information able to be queried as well, it just takes a matter of some SaaS subscriptions to be able to know someone's: name, address, email/phone/social media, wealth, education, employment history, what they look like, where they go, who they associate with, when they go places, what they buy/own, etc, etc. It's like having a stalker behind your back all the time letting subscribers know someone's life history in exchange for trying to extract as much money and value out of person as possible until they are completely used up. We might as well just back to feudal society and slavery because the game may be different but the motivations are the same.
- petra 7y ago
  Maybe it's time to run an e-commerce marketplace with no tracking, no "personalization" of anything, no ads, no marketing emails, non of that bullshit. With a focus on quality, peace of mind, and best value for money products, focus on minimizing SEO plays and fake reviews. The infrastructure exist and is rentable from many(although a bit pricy). Maybe all of those, together, would offer enough value to enough people to make prices reasonable.
  - hn_throwaway_99 7y ago
    Good luck. We may constantly decry the erosion of privacy on HN, but I guarantee you that the populace at large (like 95%+), even if they may sometimes complain about a lack of privacy, also generally really like the stuff that personalization provides. People (again, the vast populace at large) make their purchasing decisions based on things like price and perceived quality; privacy considerations are a distant follow up. Why do you think the ad-supported web is the dominant model in the first place? Because to most users it feels like "free", because the stuff they're giving up (like privacy and the cost of advertising baked into things they buy) isn't readily apparent. Privacy is a concern that really doesn't matter much, until it does. For other concerns like this it seems like regulation is the only thing that works. For example, insurance companies are highly regulated because the default risk of an insurer is something so amorphous for the average consumer to determine that it's basically impossible for them to judge on their own. So that's when government steps in and says there are basic standards an insurance company must adhere to to operate at an acceptable level of risk. I feel like that's the same for privacy. The average user isn't really able to comprehend, or value, the gradual long term effects of privacy erosion, so that's where the government steps in to demand all players must have basic standards.
Trias11 7y ago
I don’t mind stores protecting themselves with this. I do mind when the line is crossed and my information is shared with unrelated external entities to monetize me
NewsAware 7y ago
Shouldn't this have a 2018 tag?
ckastner 7y ago
This has got to be a US thing, as this would almost certainly be illegal under the GDPR. Facial recognition is processing of biometric data, which belong to the "special categories of personal data", which are protected under Article 9 GDPR [1]. Customers would need to give explicit consent to this. Contrast this with normal security cameras, which don't use biometric data: these do not necessarily require consent. For example, security cameras filming a cashier's desk are usually lawful because of legitimate interests (see Article (6)(1)(f) [2]). But legitimate interests don't work with Article 9 data. [1] https://gdpr-info.eu/art-9-gdpr/ https://gdpr-info.eu/art-9-gdpr/ [2] https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/
dwighttk 7y ago
going to need to start wearing bandanas to go to the store to get bananas
kstenerud 7y ago
So if someone starts getting misidentified, or is erroneously put into a database somewhere and passed down the data brokerage systems, who does one petition to be removed? With the government, you (usually) know where the data is. With private databases, who knows where it starts and ends? And once all major stores link up and you get banned from everything, how do you survive once you can't buy anything anymore?
neiman 7y ago
"privacy advocates and industry stakeholders are debating ... how shoppers should be informed about when their faces are scanned" I don't want to be informed when my face are being scanned, in the same way that I don't want to be informed when a website is about to sell my data. What I want is for the law not to allow such things.
- mekaj 7y ago
  The former may be a means of getting to the latter. I don’t anticipate it will be made illegal without widespread public awareness and disapproval.
  - soulofmischief 7y ago
    No, it will just facilitate normalization over two generations. This is how it's always been!
- shadowgovt 7y ago
  I want the law to allow such things, because it is extremely useful to me as a consumer and a customer if the system can automatically identify me and attach me to my past history with the company. This dimension of privacy is still open for debate.
  - neiman 7y ago
    Fair point, thought what you described can be achieved in many means beside facial recognition.
    - shadowgovt 7y ago
      True, but facial recognition is incredibly convenient. It requires the customer to do no additional work. As a sibling comment notes, this is how general store customer interactions used to be done. The "facial recognition" system in question was the store owner themselves.
rdiddly 7y ago
I think I did hear brick-and-mortar stores complaining recently about having too many customers, and wondering whether there was something else they could do, something they hadn't thought of yet, to annoy and anger customers, maybe add a little friction to keep them from walking in the door. /irony No but, ever since "the Schneier piece" [0] I've been thinking differently about this whole issue. It's about identifying you, and well, the store already knows exactly who you are as soon as you use your credit card. So does Amazon.com of course, though ironically they might not have an image of your face. If you were going to that physical store and planning to use cash (or shoplift), THEN this affects you. Although even without "AI," you would still get captured on security cameras. So if your presence there became a matter of interest - let's say for example, to corroborate or debunk your alibi for a more serious crime elsewhere - someone would invest the time to identify your face the old-fashioned way. Like probably a subordinate of the senior detective on the case, watching hours of camera footage looking for you. You can see how it was a series of small, slow, incremental steps, each one not necessarily big enough to create an uproar, that got us here. [0] https://www.nytimes.com/2020/01/20/opinion/facial-recognition-ban-privacy.html https://www.nytimes.com/2020/01/20/opinion/facial-recognitio...
- dmarble 7y ago
  I work on identity resolution problems among other data challenges at a big retailer. We get very few details when a credit card is used in-store -- pretty much just the basic card info. We don't own the payment networks and a variety of legal and business reasons prevent us from doing what may seem to be possible to get an individual's data based on a card number (from the networks themselves or other data brokers). What's possible is mostly limited to what you can do with the name on the card and store location. We've invested significantly in the problem and the answers are a patchwork of guesses. There's an interesting related issue here for brick & mortar businesses with CCPA and GDPR in effect: you can do some useful analytics, personalization, and fraud prevention work with probabilistic identity info, but if someone verifies they actually are Person X and wants to download or delete whatever data you have on them, what can you confidently say is actually their data? Will companies be held to different standards based on how much money they've invested and success they've had in identity resolution, in which case this might be a factor dissuading them from doing more identification and personalization? Or if they haven't invested millions in trying to figure out who people are, but it's possible to do so, are they liable for some kind of misconduct if they don't produce all the data they have that could have been tied together for that person? Is the choice binary, i.e. either invest big in identity resolution and take it as far as possible (with parallel governance investment) or de-identify everything you can? A privacy advocate might think on first pass that it's as simple as choosing the latter, but that's mostly not possible due to requirements we face related to other regulation and business realities: fraud, anti-money laundering, age-related laws, shoplifting, intense competition in a razor thin margin industry, etc. Data privacy is complicated.
mortenjorck 7y ago
I was going to complain about "consent" being removed from the headline, but the consent model for this is all wrong anyway. Even if you had to sign a EULA when you entered the store, there's no way to meaningfully consent to submitting your biometric data into a legally unlimited universe of analysis, cross-referencing, marketing, credit reporting, law enforcement, and whatever else ingenious minds can invent. This just isn't a consent problem. It's a regulatory problem. Under a proper regulatory regime, you shouldn't need to consent to a computer recognizing your face any more than you should for an employee to recognize your face, because the laws constrain what the computer can do with that recognition, and you can reasonably expect those limits to be in line with what the employee could do.
jedberg 7y ago
Anyone remember the movie Minority Report? Specifically the part where he walks into a store and the sign recognizes him and shows him a targeted ad for an item in the store? I feel like that use of facial recognition would have a far greater ROI than loss prevention.
- m463 7y ago
  gotta get a clean set of eyeballs.
m463 7y ago
Las Vegas has been doing this for DECADES. The casinos all have facial recognition, and share the data. The card sharks and other troublemakers are greeted at the door and shown the exit. source: have a friend who works in las vegas.
- ChuckNorris89 7y ago
  TBH, casinos are not brick and mortar shops. When you go into an establishment that attracts troublemakers(casinos, night clubs, etc.) you expect the security-privacy balance to tip towards the former as that's the easiest way to keep out scammers and troublemakers.
jiofih 7y ago
Instantly reminds me of the “Forbidding face-recognition is the wrong step” article posted yesterday.
peter303 7y ago
Minority Report movie predicted eye iris identification. 25 years ago irises were thought to result in fewer false positive matches than facial parameters, but the latter has improved since then. A problem with iris identification is building a large database. Face images are collected by the government. DNA is collected by police and ancestry companies. Not so much for irises.
- the8472 7y ago
  > Not so much for irises. High quality selfies might be sufficient to build a database. But since faces are larger features that don't need close-ups they're commercially more useful.
peter303 7y ago
At 2019 SIGGRAPH a Chinese software company was creating free unique 3D avatar characters for whomever voluntarily stopped at their booth. They probably archived your face photo and badge ID for future research and other database uses(!!!). Other booths could probably collect face and badge from walkerbys, but not of the quality of someone who voluntarily submitted to their pictures taken. I realized this shortly after getting my avatar (-:
Animats 7y ago
Will this be crosschecked to identify known illegal aliens and notify ICE to come and grab them for deportation?
davidhyde 7y ago
We can name and shame companies who use facial recognition tech. If the bad pr outweighs the benefits then they will abandon them. The challenge is to educate the general public about the dangers of it.

173 points by elorant 7y ago

Casinos have been doing this for a long time. You've also got a GPS becon in your pocket, and are probably paying with a card attached to your name and government ID number. So unless you're paying in cash and not carrying a phone, you're already a big red dot.

Jedi72 7y ago
I live in Texas, and I've seen awkward moments at dinner parties where pro-gun people say the government must not ever have a registry of owners or civilization will collapse. I bet that the next day, to let off a little steam, they bought bullets on their iPhone and had Google maps take them to the range...
- Gracana 7y ago
  Are you saying they're hypocrites because you imagined it so?
  - mamon 7y ago
    I understood GP post more like "They are afraid of government registry, yet willingly give their sensitive data to corporations."
    - deogeo 7y ago
      "Willingly" might be overstating things - Google is expert at misleading privacy notifications, and just like they wouldn't expect the local baker to keep logs of what they buy and when, and sell them to data collectors, maybe they have a naive idea that buying something on their phone is similar. They're just not aware how deeply hostile and backstabbing the entities they're dealing with are - like most humans, they're adapted to dealing with neighbors and people they know, not amoral international conglomerates.
      - lonelappde 7y ago
        Almost everyone works for a company that does marketing, so it's weird to please ignorance.
    - smnrchrds 7y ago
      Which we now know, courtesy of Edward Snowden, that it is not much different from giving sensitive data directly to the government.
      - lonelappde 7y ago
        That was known long before Snowden did anything.
        dredmorbius 7y ago
        "The cascade of reports following the June 2013 government surveillance revelations by NSA contractor Edward Snowden have brought new attention to debates about how best to preserve Americans’ privacy in the digital age." Pew, 2015 https://www.pewresearch.org/internet/2015/05/20/americans-attitudes-about-privacy-security-and-surveillance/ https://www.pewresearch.org/internet/2015/05/20/americans-at... Unfortunately time-series data on perceptions and sentiments is difficult to find. But the very fact we're discussing this on the grounds of it being or not being an Edward Snowden-related awareness speaks to Snowden's impact. As does the the fact that the matter hasn't been considered notable enough to warrant tracking over time as part of a sentiment study. Writing as someone who has been long aware of the issue, well before Snowden. But who has also noted that the nature and tenor of discussions with others since has changed markedly.
- DSingularity 7y ago
  Why is it awkward? Because only you recognize the extent of their privacy loss? Enlighten them.
  - bilbo0s 7y ago
    This. Why are we allowing people to go around society being this ignorant of what's going on? Take the opportunity to gently inform the guy of all the information the government has on him.
  - Jedi72 7y ago
    This is not a case of consistent logic through ignorance. The same friends who will literally go out guns blazing before letting law enforcement take their AR15, believe Snowden was a traitor and the intelligence agencies would never abuse their power ¯\_(ツ)_/¯
- Y-Bopinator 7y ago
  It’s only awkward for people like you who don’t get it.
- beamatronic 7y ago
  Indeed.... Who needs a registry when you have real-time data!
- deleted 7y ago
  [deleted]
WarOnPrivacy 7y ago
> You've also got a GPS beacon in your pocket I don't. My phones are rooted. GPS access is limited to a few apps and only on demand. So is app-access to IMEI and other identifying markers. Not by design but I also get a new SIM each month ($18 unlmtd talk/text+10GB). These measures are all technologically & economically cheap, btw. But they're locked away from consumers because the compulsion to control end users is a sickness that corporations can't regulate on their own.
- RL_Quine 7y ago
  There's still commercial products that will track your wifi/bluetooth MAC, and probably ISMI as well. You're not preventing this sort of thing with that sort of behavior and just making things awkward for yourself. If I can find the home addresses of people walking past my house using reverse lookups of ESSID probes, you can be damn sure that everybody else is doing it too.
  - Teever 7y ago
    > If I can find the home addresses of people walking past my house using reverse lookups of ESSID probes Can you tell me more about this?
    - RL_Quine 7y ago
      When your device is trying to find networks its seen previously, it for some reason broadcasts the ESSID, the human readable name of the networks it knows about. A lot of these are globally unique, as many routers come with a default name which is based on their MAC address. You walk past my house, I see you have connected to direct-roku-845-7e16d8. Great! I can go do a reverse lookup of that (say, based on information collected by SkyHooks or WiGLE), and I now know that you've at least authenticated to a network in downtown SF one time. With a good sampling of these (many pieces of software send the last 4+ networks), I can get an idea of where you live, where you work, and where you've traveled. From your device details I can tell what brand of device you have, from the times of day I see you I can work out what your patterns and behaviors are, from your bluetooth connections I can get an idea of what sort of devices you own. I can even match this with real time video and directional antennas to match this with a picture of your face. This is all things that an individual can do right now with off the shelf software, not something you need to be a company or a government agency to pull off. This is absolutely receive only, and does not interact with anybodies devices in any way. It is not illegal and you can not detect that someone is doing this sort of attack. Your only defense against this is to have as bland and as generic of a wifi point name as possible.
tsukurimashou 7y ago
It is certainly not with "give up" and "it is already too late" attitudes that things will change

bsenftner 7y ago

Loss/theft prevention is a priority for retail adoption of FR, but the cherry on top is the creation of real world consumer tracking that every website gets "for free" due to their web platform, which until FR had no equivalent in the real world. With an FR enhanced retail location, the store knows your face visited just as a web site knows your IP address visited. This will overlay a tracking capability on the real world with as much capacity as the out of control tracking of people online. For this key reason, we need regulation to prevent the sharing of any and all personal data between organizations. Wrong identification and junk/incorrect/false data in retail/non-authoritative databases must never be combined to create an uber-database of dirty data we get impressed as "official".

mistrial9 7y ago

This has been going on for more than five years in California; Target and Chipotle are rumored early adopters. Individual vendors are supplying and installing the setup into corporate chain retail locations, creating "jobs".

deleted 7y ago
[deleted]
strictnein 7y ago
Target stopped this, per the article.

falcolas 7y ago

> ”It’s making Illinois a technology desert.” It makes me want to move to Illinois. How tone deaf is this company? I also noticed that they couch their losses in “lost sales”, as if the shoplifters would have purchased the items had they only been caught.

BurningFrog 7y ago
Someone else would have purchased the items, had they not been stolen.
- lonelappde 7y ago
  Extraordinary assertion without evidence. How often is a desired product unavailable because some of the inventory was shoplifted?
  - deleted 7y ago
    [deleted]
  - asdfasgasdgasdg 7y ago
    Even if it is not lost sales, there's obviously an increased cost associated with breakage in that you have to buy new goods at the wholesale price to replace the ones that were stolen. Grocery stores, for example, have gross margins of about 10-15%, so even if "lost sales" is not entirely accurate, it's close enough that it's not going to severely misrepresent the size of the problem. Perhaps in the case of a luxury goods shop where the gross margins are 50%+ this is not the case.
  - jaxn 7y ago
    It may not be sold at full price, but pretty much everything sells.
- falcolas 7y ago
  Someone else may have purchased the items. Eventually. Or it may have spoiled and been thrown out for perishables. Or it may have been sold on sale. Or it may have not sold at all before being destroyed or liquidated. Lots of maybes there. A sale at sticker price can't be assumed just because the product exists in a store. Had the story used the cost of the item, not imagined sales, I wouldn't have brought it up.

Proven 7y ago

It's not without implicit consent. When you walk on to another person's property (the store) you consent to their rules. Maybe those rules aren't reasonable and may be declared illegal, but consent is present.

goalieca 7y ago

Six years ago I interviewed at a company that was working on this technology. My background was in image processing and segmentation. I knew someone else would work on it if I didn’t but I still couldn’t sleep with myself at night working for a company whose monetization depends on data mining people. It deeply saddens me that even this shopping mall where I’m currently posting from, tracked customers secretly and got busted with a bit of luck. Eventually they will win. :(

Balgair 7y ago
It's a funny thing. You hear on HN constantly that everyone's backend is a mess, that the SQL tables are incomprehensible, the AWS server has crashed again. Surely these scummy companies must be in the same state? I know that security through obfuscation is not a valid method for storing bitcoin keys. But privacy via idiocy is more common than not (exceptions do apply: https://en.wikipedia.org/wiki/History_of_the_Jews_in_the_Netherlands#The_Holocaust https://en.wikipedia.org/wiki/History_of_the_Jews_in_the_Net...)
- ikeyany 7y ago
  Talented people write unmaintainable spaghetti code all the time.

gregjw 7y ago

Not okay.

deleted 7y ago

[deleted]

dropoutcoder 7y ago

Ten years ago I thought there would be a cultural shift towards wearable spy technology. Now I wonder if there will be a shift towards developing anonymous masks worn as part of a cultural norm.

dadarepublic 7y ago
You mean like this? https://twitter.com/Gaohmee/status/1219662707839795200?s=20 https://twitter.com/Gaohmee/status/1219662707839795200?s=20
BelleOfTheBall 7y ago
It's already starting to happen, this article and thread have cool info on it: https://news.ycombinator.com/item?id=22028422 https://news.ycombinator.com/item?id=22028422
BurningFrog 7y ago
Honestly, wearing a mask in public is really creepy. I'm sure I'm far from alone in assuming you're out to commit violent crime.
- servercobra 7y ago
  For us, sure. But look at Hong Kong right now. When everyone is aware of and agrees there is a risk, it becomes more socially acceptable.
- dropoutcoder 7y ago
  The workaround is to wear a realistic facemask
- dredmorbius 7y ago
  Wearing of masks in public has actually been a social norm at times, notably in Venice: https://www.veneto-explorer.com/history-of-the-venetian-masks.html https://www.veneto-explorer.com/history-of-the-venetian-mask...
philippoi 7y ago

dadarepublic 7y ago

I like how the gif showing the shoppers they should "observe" as being a risk is of two burn out looking dudes. A total stereotype. It begs the question are these type of stereotypes baked into the FaceFirst software? The other image of a violent offender is more along the Ted Bundy type. Less a victim of traditional bias but a total serial killer stereotype - white, inconspicuous male. It's usually a slippery slope with these kinds of biases being perpetuated at the software design level - "stoner" types, minorities, and other marginalized groups often getting the short end of the stick. I understand retail wanting to reduce shrinkage (the term for stock loss via theft). I guess that's one concern as a whole, how is it ethically being handled?

tempsy 7y ago

Isn’t this what B8ta does, which I haven’t heard much criticism of or about?

allovernow 7y ago

What do you do? Start growing all of your vegetables in your backyard, and order what you must with a fake identity from behind a proxy online? I was going to question if we'd reached the point where it is not only impossible to avoid handing over intimate identifiable data, but necessary to participate in society - and I realized that we probably passed that threshold a few years ago, although this does make things seemingly worse. I wonder how long before they'll ban adversarial masks or hats in the name of safety or some other such nonsense...

root_axis 7y ago
Boycott and protest, name and shame.
GordonS 7y ago
When ordering the fake ID, you'd need some kind of method that allowed the buyer to remain anonymous - I guess there are a few crypo currencies that fit the bill. You'd also need to get the fake ID delivered somewhere other than your home, so it couldn't be trivially tied back to you.
- jlgaddis 7y ago
  > ... so it couldn't be trivially tied back to you. Except that a fake ID will have your picture on it.
nocturnial 7y ago
> What do you do? First ask them why they need this system. If it's reasonable then implement rules and laws so it can only be used for this specific purpose. If the reason for installing it is to prevent theft then they shouldn't have any problems with rules limiting them to this one specific usage and a fine if they used it for anything else (eg. marketing). We can also make up rules where it is acceptable to use it for marketing (informed consent being the bare minimum). These things, like face recognition of customers, have a tendency of spinning out of control. They say they originally used it for purpose X but because they have the data... Why not use it for purpose Y and Z?
7y ago

siruncledrew 7y ago

There's already many services that exist for accessing databases of personal data, it's just a matter of combining them into some sort of mesh to really tip the scales to the extreme. With facial recognition being able to query a face against a number of databases, and payment information able to be queried as well, it just takes a matter of some SaaS subscriptions to be able to know someone's: name, address, email/phone/social media, wealth, education, employment history, what they look like, where they go, who they associate with, when they go places, what they buy/own, etc, etc. It's like having a stalker behind your back all the time letting subscribers know someone's life history in exchange for trying to extract as much money and value out of person as possible until they are completely used up. We might as well just back to feudal society and slavery because the game may be different but the motivations are the same.

petra 7y ago
Maybe it's time to run an e-commerce marketplace with no tracking, no "personalization" of anything, no ads, no marketing emails, non of that bullshit. With a focus on quality, peace of mind, and best value for money products, focus on minimizing SEO plays and fake reviews. The infrastructure exist and is rentable from many(although a bit pricy). Maybe all of those, together, would offer enough value to enough people to make prices reasonable.
- hn_throwaway_99 7y ago
  Good luck. We may constantly decry the erosion of privacy on HN, but I guarantee you that the populace at large (like 95%+), even if they may sometimes complain about a lack of privacy, also generally really like the stuff that personalization provides. People (again, the vast populace at large) make their purchasing decisions based on things like price and perceived quality; privacy considerations are a distant follow up. Why do you think the ad-supported web is the dominant model in the first place? Because to most users it feels like "free", because the stuff they're giving up (like privacy and the cost of advertising baked into things they buy) isn't readily apparent. Privacy is a concern that really doesn't matter much, until it does. For other concerns like this it seems like regulation is the only thing that works. For example, insurance companies are highly regulated because the default risk of an insurer is something so amorphous for the average consumer to determine that it's basically impossible for them to judge on their own. So that's when government steps in and says there are basic standards an insurance company must adhere to to operate at an acceptable level of risk. I feel like that's the same for privacy. The average user isn't really able to comprehend, or value, the gradual long term effects of privacy erosion, so that's where the government steps in to demand all players must have basic standards.

Trias11 7y ago

I don’t mind stores protecting themselves with this. I do mind when the line is crossed and my information is shared with unrelated external entities to monetize me

NewsAware 7y ago

Shouldn't this have a 2018 tag?

ckastner 7y ago

This has got to be a US thing, as this would almost certainly be illegal under the GDPR. Facial recognition is processing of biometric data, which belong to the "special categories of personal data", which are protected under Article 9 GDPR [1]. Customers would need to give explicit consent to this. Contrast this with normal security cameras, which don't use biometric data: these do not necessarily require consent. For example, security cameras filming a cashier's desk are usually lawful because of legitimate interests (see Article (6)(1)(f) [2]). But legitimate interests don't work with Article 9 data. [1] https://gdpr-info.eu/art-9-gdpr/ https://gdpr-info.eu/art-9-gdpr/ [2] https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/

dwighttk 7y ago

going to need to start wearing bandanas to go to the store to get bananas

kstenerud 7y ago

So if someone starts getting misidentified, or is erroneously put into a database somewhere and passed down the data brokerage systems, who does one petition to be removed? With the government, you (usually) know where the data is. With private databases, who knows where it starts and ends? And once all major stores link up and you get banned from everything, how do you survive once you can't buy anything anymore?

neiman 7y ago

"privacy advocates and industry stakeholders are debating ... how shoppers should be informed about when their faces are scanned" I don't want to be informed when my face are being scanned, in the same way that I don't want to be informed when a website is about to sell my data. What I want is for the law not to allow such things.

mekaj 7y ago
The former may be a means of getting to the latter. I don’t anticipate it will be made illegal without widespread public awareness and disapproval.
- soulofmischief 7y ago
  No, it will just facilitate normalization over two generations. This is how it's always been!
shadowgovt 7y ago
I want the law to allow such things, because it is extremely useful to me as a consumer and a customer if the system can automatically identify me and attach me to my past history with the company. This dimension of privacy is still open for debate.
- neiman 7y ago
  Fair point, thought what you described can be achieved in many means beside facial recognition.
  - shadowgovt 7y ago
    True, but facial recognition is incredibly convenient. It requires the customer to do no additional work. As a sibling comment notes, this is how general store customer interactions used to be done. The "facial recognition" system in question was the store owner themselves.

rdiddly 7y ago

I think I did hear brick-and-mortar stores complaining recently about having too many customers, and wondering whether there was something else they could do, something they hadn't thought of yet, to annoy and anger customers, maybe add a little friction to keep them from walking in the door. /irony No but, ever since "the Schneier piece" [0] I've been thinking differently about this whole issue. It's about identifying you, and well, the store already knows exactly who you are as soon as you use your credit card. So does Amazon.com of course, though ironically they might not have an image of your face. If you were going to that physical store and planning to use cash (or shoplift), THEN this affects you. Although even without "AI," you would still get captured on security cameras. So if your presence there became a matter of interest - let's say for example, to corroborate or debunk your alibi for a more serious crime elsewhere - someone would invest the time to identify your face the old-fashioned way. Like probably a subordinate of the senior detective on the case, watching hours of camera footage looking for you. You can see how it was a series of small, slow, incremental steps, each one not necessarily big enough to create an uproar, that got us here. [0] https://www.nytimes.com/2020/01/20/opinion/facial-recognition-ban-privacy.html https://www.nytimes.com/2020/01/20/opinion/facial-recognitio...

dmarble 7y ago
I work on identity resolution problems among other data challenges at a big retailer. We get very few details when a credit card is used in-store -- pretty much just the basic card info. We don't own the payment networks and a variety of legal and business reasons prevent us from doing what may seem to be possible to get an individual's data based on a card number (from the networks themselves or other data brokers). What's possible is mostly limited to what you can do with the name on the card and store location. We've invested significantly in the problem and the answers are a patchwork of guesses. There's an interesting related issue here for brick & mortar businesses with CCPA and GDPR in effect: you can do some useful analytics, personalization, and fraud prevention work with probabilistic identity info, but if someone verifies they actually are Person X and wants to download or delete whatever data you have on them, what can you confidently say is actually their data? Will companies be held to different standards based on how much money they've invested and success they've had in identity resolution, in which case this might be a factor dissuading them from doing more identification and personalization? Or if they haven't invested millions in trying to figure out who people are, but it's possible to do so, are they liable for some kind of misconduct if they don't produce all the data they have that could have been tied together for that person? Is the choice binary, i.e. either invest big in identity resolution and take it as far as possible (with parallel governance investment) or de-identify everything you can? A privacy advocate might think on first pass that it's as simple as choosing the latter, but that's mostly not possible due to requirements we face related to other regulation and business realities: fraud, anti-money laundering, age-related laws, shoplifting, intense competition in a razor thin margin industry, etc. Data privacy is complicated.

mortenjorck 7y ago

I was going to complain about "consent" being removed from the headline, but the consent model for this is all wrong anyway. Even if you had to sign a EULA when you entered the store, there's no way to meaningfully consent to submitting your biometric data into a legally unlimited universe of analysis, cross-referencing, marketing, credit reporting, law enforcement, and whatever else ingenious minds can invent. This just isn't a consent problem. It's a regulatory problem. Under a proper regulatory regime, you shouldn't need to consent to a computer recognizing your face any more than you should for an employee to recognize your face, because the laws constrain what the computer can do with that recognition, and you can reasonably expect those limits to be in line with what the employee could do.

jedberg 7y ago

Anyone remember the movie Minority Report? Specifically the part where he walks into a store and the sign recognizes him and shows him a targeted ad for an item in the store? I feel like that use of facial recognition would have a far greater ROI than loss prevention.

m463 7y ago
gotta get a clean set of eyeballs.

m463 7y ago

Las Vegas has been doing this for DECADES. The casinos all have facial recognition, and share the data. The card sharks and other troublemakers are greeted at the door and shown the exit. source: have a friend who works in las vegas.

ChuckNorris89 7y ago
TBH, casinos are not brick and mortar shops. When you go into an establishment that attracts troublemakers(casinos, night clubs, etc.) you expect the security-privacy balance to tip towards the former as that's the easiest way to keep out scammers and troublemakers.

jiofih 7y ago

Instantly reminds me of the “Forbidding face-recognition is the wrong step” article posted yesterday.

peter303 7y ago

Minority Report movie predicted eye iris identification. 25 years ago irises were thought to result in fewer false positive matches than facial parameters, but the latter has improved since then. A problem with iris identification is building a large database. Face images are collected by the government. DNA is collected by police and ancestry companies. Not so much for irises.

the8472 7y ago
> Not so much for irises. High quality selfies might be sufficient to build a database. But since faces are larger features that don't need close-ups they're commercially more useful.

peter303 7y ago

At 2019 SIGGRAPH a Chinese software company was creating free unique 3D avatar characters for whomever voluntarily stopped at their booth. They probably archived your face photo and badge ID for future research and other database uses(!!!). Other booths could probably collect face and badge from walkerbys, but not of the quality of someone who voluntarily submitted to their pictures taken. I realized this shortly after getting my avatar (-:

Animats 7y ago

Will this be crosschecked to identify known illegal aliens and notify ICE to come and grab them for deportation?

davidhyde 7y ago

We can name and shame companies who use facial recognition tech. If the bad pr outweighs the benefits then they will abandon them. The challenge is to educate the general public about the dangers of it.