9 ms·

Sometimes it feels ridiculous how much OPSEC I need to employ to buy anything at the grocery store. I walk or bike to the store to not reveal a license plate. A

Sometimes it feels ridiculous how much OPSEC I need to employ to buy anything at the grocery store. I walk or bike to the store to not reveal a license plate. All radios and sensors on my handset are turned off. I wear a mask to thwart facial recognition cameras. I pay cash.

Infernal 4y ago
Recently I’ve noticed multiple grocery store chains posting notices about how they no longer accept cash. A couple as of the new year.
- giardini 4y ago
  The recent proliferation of "digideals" which require that you scan item barcodes with your handheld also is also popular. These deals are usually very good, often half-price. But w/o a cellphone you're locked out of the deal.
- TurkishPoptart 4y ago
  Isn't that illegal?
  - dantetheinferno 4y ago
    Only illegal to not accept cash for debts. A merchant can refuse to do business with you in cash since you're not in debt at the checkout counter (as no transaction has occured)
    - TurkishPoptart 4y ago
      Ah, I thought it was the claim about "legal tender". As in, my folded-up $10 bill is legal tender, and you (the vendor) must accept it, even if you don't like dealing with cash registers, coins, petty theft, and counting change.
  - boucher 4y ago
    It's illegal in San Francisco
- jxramos 4y ago
  hmmm, wonder if it's a preventing cash theft sort of thing with cashiers or something in that space.
  - maccard 4y ago
    It's a few things, most likely. It removes human error (did you give the cashier a $1 or $100 bill?), reduces risk of loss/theft of physical assets, reduces staffing costs (One person can operate one manual till, one person can operate 15? automated tills where they're basically just overriding weights and checking ID for alcohol), is probably _cheaper_ than handling cash (because you already have a visa/mastercard/payment provider contract who will give you discounts for increased volume, and they likely charge less because of the topic of this article).
    - Infernal 4y ago
      The interesting thing is, both of these store chains already had fully automated checkouts, they simply removed the ability for these to accept cash and make change.
- JohnFen 4y ago
  There will have to be at least one store that takes cash, though, or the people who don't have cards or phones will starve.
ipaddr 4y ago
Biggest thing is leave the phone at home
- danuker 4y ago
  or in a Faraday cage/bag if you think you might want to call someone later, but it might be performing dead reckoning
kspacewalk2 4y ago
But... why?
- blue039 4y ago
  Much like you will never understand why someone would go to these lengths I struggle to understand how someone _wouldn't_. I can't understand people whose threat model begins with "these places I'm okay with someone knowing things about me". If I read your email and then selected "metadata" I found important, walked into a very busy public square, and started shouting your secrets you'd be right to be uncomfortable. If I, for example, made a reasonably accurate prediction that you are pregnant/on drugs/have ED/etc and then told 10,000 people about this you'd be right to be angry. Yet...you're okay with a company doing any of this? Is it because you can't see it or feel it directly? The head in the sand approach doesn't work. With enough datapoints in one bin anyone can use "metadata" to make extremely accurate predictions about your private life. You need to defend yourself from the constant gathering of this metadata. Snowden warned us and apparently very few of us decided to listen. All it takes is one leak, one hack, one disgruntled employee, or one bad government to take all those secrets you're not thinking about and turn them into weapons to use against you. In a modern battlefield you are a target and the war has been going on for decades now.
  - Zetice 4y ago
    Consequences; when you have meaningful consequences around someone knowing what you purchased at the grocery store, you'll be justified in this behavior. Until then, it's paranoia. For my part, my "public" life has not once caused me negative consequences, and I've lived it this way for 34 years. Why would I live in fear of something that hasn't happened to me, anyone I know personally, is not recommended by any industry experts, is not presented as a risk factor by group responsible for my well being, etc.? You need to prove that all of that extra effort is worth the degraded quality of life.
    - pixl97 4y ago
      "I've seen this weapon used against other people, but I have nothing to worry about, they'll never turn the gun on me" Also can be stated as "First they came for the socialists, and I did not speak out—because I was not a socialist."
theironhammer 4y ago
Edward Snowden revealed that u need to remove the battery on ur phone to make it "safe", turning it off doesn't do the trick. [Which u can't do anymore]. As another commenter says: leave the phone at home.
- jimbob45 4y ago
  What about a Faraday bag?
  - JohnFen 4y ago
    A faraday bag works (but be sure to test it). Be aware, though, that phones will increase their radio power and retry constantly when they aren't reaching a cell tower. If the increased battery drain is an issue, put your phone in airplane mode first.
  - foxyv 4y ago
    That is a great option.
  - Eumenes 4y ago
    anyone have any suggestions for a Faraday bag?
    - bobsoap 4y ago
      Two bags of chips. With or without the chips. https://usa.kaspersky.com/blog/terminator-dark-fate-chips/18843/ https://usa.kaspersky.com/blog/terminator-dark-fate-chips/18...
      - JohnFen 4y ago
        Wrapping it in aluminum foil works, too. Anything that completely surrounds the phone with conductive material will do the job.
  - devmunchies 4y ago
    theoretically the phone could still record all audio and then sync with the cloud when back online, but I'm grasping at straws here.
gnicholas 4y ago
IME at Safeway if you don't use a "club card" you end up paying nearly double for many items. Are there ways around this?
- LargoLasskhyfv 4y ago
  Yes. Using real safe ways to shop elsewhere.
- pigscantfly 4y ago
  Local area code + 867-5309
  - jrockway 4y ago
    In my formative years I rode the CTA a lot, and they always had an announcement, "call 836-7000 for transit information". The number was burned in my head and it's worked in every store I've tried. (You can add any Chicago-area area code; 847, 312, etc.) Yes, it worked at a Safeway in San Jose too. I love that someone also had this stuck in their head and used it to sign up for grocery discounts.
  - giardini 4y ago
    One of the best rock tunes ever written, "8675309 Jenny Jenny" was a blazing meteoric hit by a band that produced few others: Rendition of the song (bet you can't play it just once): https://www.youtube.com/watch?v=boaJCrHNRMA https://www.youtube.com/watch?v=boaJCrHNRMA Story of the song (along with a history of problems/facts about the phone number itself before and after the song hit): https://en.wikipedia.org/wiki/867-5309/Jenny https://en.wikipedia.org/wiki/867-5309/Jenny The band: https://en.wikipedia.org/wiki/Tommy_Tutone https://en.wikipedia.org/wiki/Tommy_Tutone
- staringback 4y ago
  Shop at Walmart or just use a burner sim/phone. I don't care how much they are going to "profile" me if there is no connection to myself in any way
- JohnFen 4y ago
LargoLasskhyfv 4y ago
They have your fingerprints!1!! Or are you wearing gloves? They have your genes. Or are you wearing clothing which limits the spread of particles from your skin and hair? Well. At least they could have. If they really wanted to. Or anybody else.
- JohnFen 4y ago
  I'll start worrying about that stuff when they start using that stuff. But they aren't right now, and the odds are they never will. The cost/benefit of doing so doesn't work out.
- pessimizer 4y ago
  > Well. At least they could have. If they really wanted to. Or anybody else. You're lying here. I guarantee that you, LargoLasskhyfv, do not even have the ability to keep a nationwide database of fingerprints and DNA, and of course you couldn't bear the expense of physically collecting a DNA profile or the fingerprints of everyone in the country no matter how much you "wanted to." Yet, you are a member of "anybody." Are you just an outlier?
  - LargoLasskhyfv 4y ago
    Well. Lemme try to explain. Starting with fingerprints, collecting them on an individual basis is not that difficult. From the handles of the shopping cart, for instance. Maybe better if they had been wiped clean beforehand by somebody, but since Covid many shops actually had their clerks, security doing that generally. So you'd just have to wait, and grab that one interesting cart, and take the prints off of it. By several means, there should be apps possible, for certain phones, with certain (flash)lights, doing that. Otherwise more conventional means are available. Still fast, with commonly available single use supplies. Some fun thing from 2008 comes to mind, where people associated with the german Chaos Computer Club took the fingerprints of the Minister of the Interior from a glass, and published them :-> So this is really not that special. More special, but not impossible would be the large scale gathering of fingerprints in shops, but again, that should be possible during scanning of the stuff you've put on the belt, and during scanning of the bills, for counterfeit checks. Analyzing your genes from generally collecting particular matter raining out of your personal cloud may seem like science fiction now, but it's not that far around the corner. OTOH, wiping them of some surface someone has seen you sneeze at is possible now. Just not that cheap. Edit: Also https://www.spymuseum.org/exhibition-experiences/about-the-collection/collection-highlights/stasi-scent-jars/ https://www.spymuseum.org/exhibition-experiences/about-the-c... comes to mind.
jnxx 4y ago
> I pay cash. Can we, today, be sure that ATMs do not record serial numbers of the bank notes they dispense?
- moremetadata 4y ago
  ;)
- jrockway 4y ago
  If they don't, that's the best startup idea I've heard on HN in a long time. I mean, it's evil and everything, but you could make a lot of money probably. Government contracts would probably pay out too.
  - kneebonian 4y ago
    10 bucks says Palantir saw the idea and are working on the pitch deck right now.
  - Coffee_Overflow 4y ago
    https://www.wheresgeorge.com/ https://www.wheresgeorge.com/
  - mrguyorama 4y ago
    The problem is convincing big store chains to put a new dollar barcode scanner machine in their checkout lines at every location, to do something that they have no trouble doing right now with credit card details, rewards cards, and bluetooth tracking.
grishka 4y ago
But if you block ads and third-party cookies, which I'm 146% you do with this mindset, that data collection is of no use either way.
- tombert 4y ago
  Is that actually true? They still might be using you for demographic details, and indirectly targeting ads at you for things you can't easily block.
- JohnFen 4y ago
  I don't understand... What does blocking ads and third-party cookies have to do with it? How does doing that affect the usefulness of real-world data collection?
  - grishka 4y ago
    I may have said it wrong. I meant that, because of ad blocking, it's impossible to show you targeted ads, that data collection doesn't do anything bad to you personally. They can't use it to try to sell something to you in particular because that requires non-consensually shoving information into you, via your own devices. They can still use it for analytics, of course, but that's not nearly as worrying as creepily targeted ads that follow you around everywhere.
    - JohnFen 4y ago
      Ah, I see. That doesn't address the issue for me. It's not the ads I care about, it's the data collection.
nanidin 4y ago
What is your threat model? Are you buying incriminating goods at the grocery store? What do you gain by putting yourself through all that? Or what are you preventing / protecting yourself from?
- pixl97 4y ago
  > Are you buying incriminating goods at the grocery store You mean hummus, right? Or do you mean the store selling of your eating habits pretty much every entity out there. Pretty sure eating isn't HIPAA related, but correlated to potential health.
  - nanidin 4y ago
    So the threat model is to prevent insurers from gaining knowledge that you buy 5L of sugary soda per week? I agree there is some privacy concern, but I am having a hard time articulating how or why that data might actually impact a person in a net negative way.
    - fsflover 4y ago
      What if I buy everything gluten-free?
    - pixl97 4y ago
      http://web.archive.org/web/20071221122513/http:/cqpolitics.com/wmspage.cfm?parm1=5&docID=hsnews-000002620892 http://web.archive.org/web/20071221122513/http:/cqpolitics.c...
    - mrguyorama 4y ago
      I literally don't care if places don't do anything with this info, I'm saying they have no right to it. If they want it they can negotiate with me and I'll give them an insane price. Right now they just do it whether I consent or not.
- breakpointalpha 4y ago
  A free person shouldn't have to articulate why they need privacy. Privacy should be the default in free societies. I can play this game though: you are pregnant, but have not shared that information yet with your family because it's early term and there might be complications. The grocery store accurately predicts you are pregnant from your shopping habits (change in diet, per-natal vitamins, "New Mommy Magazine"). The grocery store snail mails you a New Mommy coupon book as a "thank you." Your family sees this and confronts you, forcing you to reveal your medical status against your wishes. This is a scary outcome WHICH HAS ALREADY HAPPENED. https://bit.ly/3S3hlrA https://bit.ly/3S3hlrA
tombert 4y ago
Honestly I think that this a problem that needs to be solved via legislation. I think it's completely unreasonable to tell people to leave their phones at home all the time, or put them in some kind of Faraday cage whenever they go out, and it's become abundantly clear that we cannot trust companies to respect our privacy without ramifications.

Infernal 4y ago

Recently I’ve noticed multiple grocery store chains posting notices about how they no longer accept cash. A couple as of the new year.

giardini 4y ago
The recent proliferation of "digideals" which require that you scan item barcodes with your handheld also is also popular. These deals are usually very good, often half-price. But w/o a cellphone you're locked out of the deal.
TurkishPoptart 4y ago
Isn't that illegal?
- dantetheinferno 4y ago
  Only illegal to not accept cash for debts. A merchant can refuse to do business with you in cash since you're not in debt at the checkout counter (as no transaction has occured)
  - TurkishPoptart 4y ago
    Ah, I thought it was the claim about "legal tender". As in, my folded-up $10 bill is legal tender, and you (the vendor) must accept it, even if you don't like dealing with cash registers, coins, petty theft, and counting change.
- boucher 4y ago
  It's illegal in San Francisco
jxramos 4y ago
hmmm, wonder if it's a preventing cash theft sort of thing with cashiers or something in that space.
- maccard 4y ago
  It's a few things, most likely. It removes human error (did you give the cashier a $1 or $100 bill?), reduces risk of loss/theft of physical assets, reduces staffing costs (One person can operate one manual till, one person can operate 15? automated tills where they're basically just overriding weights and checking ID for alcohol), is probably _cheaper_ than handling cash (because you already have a visa/mastercard/payment provider contract who will give you discounts for increased volume, and they likely charge less because of the topic of this article).
  - Infernal 4y ago
    The interesting thing is, both of these store chains already had fully automated checkouts, they simply removed the ability for these to accept cash and make change.
JohnFen 4y ago
There will have to be at least one store that takes cash, though, or the people who don't have cards or phones will starve.

ipaddr 4y ago

Biggest thing is leave the phone at home

danuker 4y ago
or in a Faraday cage/bag if you think you might want to call someone later, but it might be performing dead reckoning

kspacewalk2 4y ago

But... why?

blue039 4y ago
Much like you will never understand why someone would go to these lengths I struggle to understand how someone _wouldn't_. I can't understand people whose threat model begins with "these places I'm okay with someone knowing things about me". If I read your email and then selected "metadata" I found important, walked into a very busy public square, and started shouting your secrets you'd be right to be uncomfortable. If I, for example, made a reasonably accurate prediction that you are pregnant/on drugs/have ED/etc and then told 10,000 people about this you'd be right to be angry. Yet...you're okay with a company doing any of this? Is it because you can't see it or feel it directly? The head in the sand approach doesn't work. With enough datapoints in one bin anyone can use "metadata" to make extremely accurate predictions about your private life. You need to defend yourself from the constant gathering of this metadata. Snowden warned us and apparently very few of us decided to listen. All it takes is one leak, one hack, one disgruntled employee, or one bad government to take all those secrets you're not thinking about and turn them into weapons to use against you. In a modern battlefield you are a target and the war has been going on for decades now.
- Zetice 4y ago
  Consequences; when you have meaningful consequences around someone knowing what you purchased at the grocery store, you'll be justified in this behavior. Until then, it's paranoia. For my part, my "public" life has not once caused me negative consequences, and I've lived it this way for 34 years. Why would I live in fear of something that hasn't happened to me, anyone I know personally, is not recommended by any industry experts, is not presented as a risk factor by group responsible for my well being, etc.? You need to prove that all of that extra effort is worth the degraded quality of life.
  - pixl97 4y ago
    "I've seen this weapon used against other people, but I have nothing to worry about, they'll never turn the gun on me" Also can be stated as "First they came for the socialists, and I did not speak out—because I was not a socialist."

theironhammer 4y ago

Edward Snowden revealed that u need to remove the battery on ur phone to make it "safe", turning it off doesn't do the trick. [Which u can't do anymore]. As another commenter says: leave the phone at home.

jimbob45 4y ago
What about a Faraday bag?
- JohnFen 4y ago
  A faraday bag works (but be sure to test it). Be aware, though, that phones will increase their radio power and retry constantly when they aren't reaching a cell tower. If the increased battery drain is an issue, put your phone in airplane mode first.
- foxyv 4y ago
  That is a great option.
- Eumenes 4y ago
  anyone have any suggestions for a Faraday bag?
  - bobsoap 4y ago
    Two bags of chips. With or without the chips. https://usa.kaspersky.com/blog/terminator-dark-fate-chips/18843/ https://usa.kaspersky.com/blog/terminator-dark-fate-chips/18...
    - JohnFen 4y ago
      Wrapping it in aluminum foil works, too. Anything that completely surrounds the phone with conductive material will do the job.
- devmunchies 4y ago
  theoretically the phone could still record all audio and then sync with the cloud when back online, but I'm grasping at straws here.

gnicholas 4y ago

IME at Safeway if you don't use a "club card" you end up paying nearly double for many items. Are there ways around this?

LargoLasskhyfv 4y ago
Yes. Using real safe ways to shop elsewhere.
pigscantfly 4y ago
Local area code + 867-5309
- jrockway 4y ago
  In my formative years I rode the CTA a lot, and they always had an announcement, "call 836-7000 for transit information". The number was burned in my head and it's worked in every store I've tried. (You can add any Chicago-area area code; 847, 312, etc.) Yes, it worked at a Safeway in San Jose too. I love that someone also had this stuck in their head and used it to sign up for grocery discounts.
- giardini 4y ago
  One of the best rock tunes ever written, "8675309 Jenny Jenny" was a blazing meteoric hit by a band that produced few others: Rendition of the song (bet you can't play it just once): https://www.youtube.com/watch?v=boaJCrHNRMA https://www.youtube.com/watch?v=boaJCrHNRMA Story of the song (along with a history of problems/facts about the phone number itself before and after the song hit): https://en.wikipedia.org/wiki/867-5309/Jenny https://en.wikipedia.org/wiki/867-5309/Jenny The band: https://en.wikipedia.org/wiki/Tommy_Tutone https://en.wikipedia.org/wiki/Tommy_Tutone
staringback 4y ago
Shop at Walmart or just use a burner sim/phone. I don't care how much they are going to "profile" me if there is no connection to myself in any way
JohnFen 4y ago

LargoLasskhyfv 4y ago

They have your fingerprints!1!! Or are you wearing gloves? They have your genes. Or are you wearing clothing which limits the spread of particles from your skin and hair? Well. At least they could have. If they really wanted to. Or anybody else.

JohnFen 4y ago
I'll start worrying about that stuff when they start using that stuff. But they aren't right now, and the odds are they never will. The cost/benefit of doing so doesn't work out.
pessimizer 4y ago
> Well. At least they could have. If they really wanted to. Or anybody else. You're lying here. I guarantee that you, LargoLasskhyfv, do not even have the ability to keep a nationwide database of fingerprints and DNA, and of course you couldn't bear the expense of physically collecting a DNA profile or the fingerprints of everyone in the country no matter how much you "wanted to." Yet, you are a member of "anybody." Are you just an outlier?
- LargoLasskhyfv 4y ago
  Well. Lemme try to explain. Starting with fingerprints, collecting them on an individual basis is not that difficult. From the handles of the shopping cart, for instance. Maybe better if they had been wiped clean beforehand by somebody, but since Covid many shops actually had their clerks, security doing that generally. So you'd just have to wait, and grab that one interesting cart, and take the prints off of it. By several means, there should be apps possible, for certain phones, with certain (flash)lights, doing that. Otherwise more conventional means are available. Still fast, with commonly available single use supplies. Some fun thing from 2008 comes to mind, where people associated with the german Chaos Computer Club took the fingerprints of the Minister of the Interior from a glass, and published them :-> So this is really not that special. More special, but not impossible would be the large scale gathering of fingerprints in shops, but again, that should be possible during scanning of the stuff you've put on the belt, and during scanning of the bills, for counterfeit checks. Analyzing your genes from generally collecting particular matter raining out of your personal cloud may seem like science fiction now, but it's not that far around the corner. OTOH, wiping them of some surface someone has seen you sneeze at is possible now. Just not that cheap. Edit: Also https://www.spymuseum.org/exhibition-experiences/about-the-collection/collection-highlights/stasi-scent-jars/ https://www.spymuseum.org/exhibition-experiences/about-the-c... comes to mind.

jnxx 4y ago

> I pay cash. Can we, today, be sure that ATMs do not record serial numbers of the bank notes they dispense?

moremetadata 4y ago
;)
jrockway 4y ago
If they don't, that's the best startup idea I've heard on HN in a long time. I mean, it's evil and everything, but you could make a lot of money probably. Government contracts would probably pay out too.
- kneebonian 4y ago
  10 bucks says Palantir saw the idea and are working on the pitch deck right now.
- Coffee_Overflow 4y ago
  https://www.wheresgeorge.com/ https://www.wheresgeorge.com/
- mrguyorama 4y ago
  The problem is convincing big store chains to put a new dollar barcode scanner machine in their checkout lines at every location, to do something that they have no trouble doing right now with credit card details, rewards cards, and bluetooth tracking.

grishka 4y ago

But if you block ads and third-party cookies, which I'm 146% you do with this mindset, that data collection is of no use either way.

tombert 4y ago
Is that actually true? They still might be using you for demographic details, and indirectly targeting ads at you for things you can't easily block.
JohnFen 4y ago
I don't understand... What does blocking ads and third-party cookies have to do with it? How does doing that affect the usefulness of real-world data collection?
- grishka 4y ago
  I may have said it wrong. I meant that, because of ad blocking, it's impossible to show you targeted ads, that data collection doesn't do anything bad to you personally. They can't use it to try to sell something to you in particular because that requires non-consensually shoving information into you, via your own devices. They can still use it for analytics, of course, but that's not nearly as worrying as creepily targeted ads that follow you around everywhere.
  - JohnFen 4y ago
    Ah, I see. That doesn't address the issue for me. It's not the ads I care about, it's the data collection.

nanidin 4y ago

What is your threat model? Are you buying incriminating goods at the grocery store? What do you gain by putting yourself through all that? Or what are you preventing / protecting yourself from?

pixl97 4y ago
> Are you buying incriminating goods at the grocery store You mean hummus, right? Or do you mean the store selling of your eating habits pretty much every entity out there. Pretty sure eating isn't HIPAA related, but correlated to potential health.
- nanidin 4y ago
  So the threat model is to prevent insurers from gaining knowledge that you buy 5L of sugary soda per week? I agree there is some privacy concern, but I am having a hard time articulating how or why that data might actually impact a person in a net negative way.
  - fsflover 4y ago
    What if I buy everything gluten-free?
  - pixl97 4y ago
    http://web.archive.org/web/20071221122513/http:/cqpolitics.com/wmspage.cfm?parm1=5&docID=hsnews-000002620892 http://web.archive.org/web/20071221122513/http:/cqpolitics.c...
  - mrguyorama 4y ago
    I literally don't care if places don't do anything with this info, I'm saying they have no right to it. If they want it they can negotiate with me and I'll give them an insane price. Right now they just do it whether I consent or not.
breakpointalpha 4y ago
A free person shouldn't have to articulate why they need privacy. Privacy should be the default in free societies. I can play this game though: you are pregnant, but have not shared that information yet with your family because it's early term and there might be complications. The grocery store accurately predicts you are pregnant from your shopping habits (change in diet, per-natal vitamins, "New Mommy Magazine"). The grocery store snail mails you a New Mommy coupon book as a "thank you." Your family sees this and confronts you, forcing you to reveal your medical status against your wishes. This is a scary outcome WHICH HAS ALREADY HAPPENED. https://bit.ly/3S3hlrA https://bit.ly/3S3hlrA

tombert 4y ago

Honestly I think that this a problem that needs to be solved via legislation. I think it's completely unreasonable to tell people to leave their phones at home all the time, or put them in some kind of Faraday cage whenever they go out, and it's become abundantly clear that we cannot trust companies to respect our privacy without ramifications.