7 ms·

It's not clear that a MAC address is personal information. The ICO's own guidance [1] gives the example of telephone number being personal information if the nu

It's not clear that a MAC address is personal information. The ICO's own guidance [1] gives the example of telephone number being personal information if the number is in the telephone directory, making a reverse lookup to identify the owner possible. Is such a directory available for MAC addresses possible? Given a hypothetical MAC address 0c:fd:c3:de:00:d5, could you identify a person with that alone? [1] http://www.ico.org.uk/upload/documents/library/data_protection/detailed_specialist_guides/personal_data_flowchart_v1_with_preface001.pdf http://www.ico.org.uk/upload/documents/library/data_protecti...

knowaveragejoe 13y ago
Not in a public directory similar to a telephone book, no. At most you could learn the make/model of their nic.
DanBC 13y ago
The makers of the bins have a video showing a named person walking around, and the bin collecting information on that person's likes and dislikes. The video makes a comparison between their bins and cookies, describing this as "cookies in real life". It seems difficult to compare their tech to cookies (which have EU wide regulation) and to show information collected about an individual and to then claim exemption from UK data protection laws. (https://news.ycombinator.com/item?id=6194160 https://news.ycombinator.com/item?id=6194160)
chrischen 13y ago
It is not possible unless the user voluntarily associates his personal information with that mac address. It is possible to harvest this information covertly. Up until iOS 7, it's possible for any iphone app to get your mac address. So if you also provide your personal information, an app could covertly associate them.
- sehrope 13y ago
  It doesn't have to be voluntary. If I have a list of all the MAC addresses/timestamps and can cross reference that against a different known list of people times (ex: credit card transactions, rewards card, even face recognition) then you can associate them. With enough data it can be very exact.
  - chrischen 13y ago
    If you had face recognition and rewards cards, you wouldn't even need a MAC address to track someone.
    - krichman 13y ago
      The rewards card would be in one location, you could then know that person's identity at all stores via cell phone connections or cameras.
      - chrischen 13y ago
        It can be feasible if the enough credit card or reward card usage data is gathered for you, across all the stores you visit. Hard, but possible. Still for a lot of users the entropy will be too high.
        cbhl 13y ago
        https://news.ycombinator.com/item?id=2942967 https://news.ycombinator.com/item?id=2942967 87% of the U.S. Population are uniquely identified by {DOB, gender, zip} (latanyasweeney.org) (278 points, 712 days ago, 101 ocmments)
        chrischen 13y ago
        Yes but you'd have to uniquely identify by store visit patterns, and assuming you use a trackable method like credit card, loyalty card (universal one), AND have your wifi turned on. You listed a lot of dimensions, whereas to make the correlation between mac address and customer info, you only have 1 dimension (visits/location) to do the correlation with.
        cbhl 13y ago
        Personally, I heavily use credit cards[0], loyalty cards[1], and I leave my wifi turned on all day because Google Maps gets grumpy when I turn it off. In practice, I find that I've needed a lot fewer dimensions than I'd expect to find people; when I was in grade school one time I cross-referenced the attendance list (for a last name), the reverse phone lookup in the white pages, and a map of the school district boundaries to figure out where a classmate lived. I think that repeated visits to a grocery store like a Safeway would be a really good proxy for home ZIP code. Every Safeway I've visited in the SF bay area has a wifi access point, and I wouldn't be surprised if it was logging the MAC addresses of phones that pass by. Maybe some hackers will try to optimize their route home and pick a grocery store that's half way between work and home, but I hypothesize that a large enough number of people choose to run to the nearest grocery store for that "one item they forgot to buy for dinner" or for dedicated weekly shopping trips that you could draw reasonable conclusions about aggregate behaviour. [0] I like buying stuff online; it's kind of unavoidable there. [1] I always get this weird sense of power when I buy peaches at the Safeway at full price during off-peak and then the next week they go on sale for "Safeway Club" cardholders at the store I usually shop at.
reeses 13y ago
How many samples? All you need to do is wait until they tell you who they are by associating that MAC addr with a hotspot. Share "anonymous" data with vendors who provide wifi access, and suddenly Sephora knows where you live and where you work and can remind you that you're almost out of La Prairie Crème Cellulaire Platine Rare when you bin your cup of coffee outside the office.

knowaveragejoe 13y ago

Not in a public directory similar to a telephone book, no. At most you could learn the make/model of their nic.

DanBC 13y ago

The makers of the bins have a video showing a named person walking around, and the bin collecting information on that person's likes and dislikes. The video makes a comparison between their bins and cookies, describing this as "cookies in real life". It seems difficult to compare their tech to cookies (which have EU wide regulation) and to show information collected about an individual and to then claim exemption from UK data protection laws. (https://news.ycombinator.com/item?id=6194160 https://news.ycombinator.com/item?id=6194160)

chrischen 13y ago

It is not possible unless the user voluntarily associates his personal information with that mac address. It is possible to harvest this information covertly. Up until iOS 7, it's possible for any iphone app to get your mac address. So if you also provide your personal information, an app could covertly associate them.

sehrope 13y ago
It doesn't have to be voluntary. If I have a list of all the MAC addresses/timestamps and can cross reference that against a different known list of people times (ex: credit card transactions, rewards card, even face recognition) then you can associate them. With enough data it can be very exact.
- chrischen 13y ago
  If you had face recognition and rewards cards, you wouldn't even need a MAC address to track someone.
  - krichman 13y ago
    The rewards card would be in one location, you could then know that person's identity at all stores via cell phone connections or cameras.
    - chrischen 13y ago
      It can be feasible if the enough credit card or reward card usage data is gathered for you, across all the stores you visit. Hard, but possible. Still for a lot of users the entropy will be too high.
      - cbhl 13y ago
        https://news.ycombinator.com/item?id=2942967 https://news.ycombinator.com/item?id=2942967 87% of the U.S. Population are uniquely identified by {DOB, gender, zip} (latanyasweeney.org) (278 points, 712 days ago, 101 ocmments)
        chrischen 13y ago
        Yes but you'd have to uniquely identify by store visit patterns, and assuming you use a trackable method like credit card, loyalty card (universal one), AND have your wifi turned on. You listed a lot of dimensions, whereas to make the correlation between mac address and customer info, you only have 1 dimension (visits/location) to do the correlation with.
        cbhl 13y ago
        Personally, I heavily use credit cards[0], loyalty cards[1], and I leave my wifi turned on all day because Google Maps gets grumpy when I turn it off. In practice, I find that I've needed a lot fewer dimensions than I'd expect to find people; when I was in grade school one time I cross-referenced the attendance list (for a last name), the reverse phone lookup in the white pages, and a map of the school district boundaries to figure out where a classmate lived. I think that repeated visits to a grocery store like a Safeway would be a really good proxy for home ZIP code. Every Safeway I've visited in the SF bay area has a wifi access point, and I wouldn't be surprised if it was logging the MAC addresses of phones that pass by. Maybe some hackers will try to optimize their route home and pick a grocery store that's half way between work and home, but I hypothesize that a large enough number of people choose to run to the nearest grocery store for that "one item they forgot to buy for dinner" or for dedicated weekly shopping trips that you could draw reasonable conclusions about aggregate behaviour. [0] I like buying stuff online; it's kind of unavoidable there. [1] I always get this weird sense of power when I buy peaches at the Safeway at full price during off-peak and then the next week they go on sale for "Safeway Club" cardholders at the store I usually shop at.

reeses 13y ago

How many samples? All you need to do is wait until they tell you who they are by associating that MAC addr with a hotspot. Share "anonymous" data with vendors who provide wifi access, and suddenly Sephora knows where you live and where you work and can remind you that you're almost out of La Prairie Crème Cellulaire Platine Rare when you bin your cup of coffee outside the office.