7 ms·

Risky. MAC address tracking is definitely a legal 'grey area' at the moment. I can imagine mining/fingerprinting in this way could easily become illegal in the

Risky. MAC address tracking is definitely a legal 'grey area' at the moment. I can imagine mining/fingerprinting in this way could easily become illegal in the not-to-distant future. In the UK, City of London already banned the wifi-enabled bins that were tracking MAC addresses. It would be really easy to tie a name to MAC address (from point of purchase with a credit card), then see exactly where that person went via the 'sharing' of data with other retailers. This is certainly something you would expect to need 'opt in' to.

alexandros 13y ago
They didn't really "ban" anything. They just instructed the company that was hosting them to stop doing so, in the face of a media shitstorm. And since that company was also a licensee of the City, they saw it fit to do as told. A shop owner in the City can still do as they like. [source: I was doing other work for the bin company (renew) and saw the whole car crash from the inside]
- chrisfarms 13y ago
  You are of course quite right. It wasn't a ban in any legal sense. Though I do think it highlights that the method is already frowned upon... and as and when the public becomes more aware of the fact they are walking around broadcasting their location there will be more pressure to restrict the collection of the data. That said. CCTV does not appear to be going anywhere, and there is very little difference between processing video footage to track people and tracking a MAC address. The only difference in this particular case is that 'sharing' of the data between retailers is touted as a feature (which of course it is).
shiftpgdn 13y ago
City of Houston does MAC address tracking on the freeways and surface streets to power their traffic tracking measures. It's probably used in hundreds of other places you haven't thought about. If you're concerned about your privacy just turn wifi off. http://traffic.houstontranstar.org/layers/ http://traffic.houstontranstar.org/layers/
- parennoob 13y ago
  > If you're concerned about your privacy just turn wifi off. No, you shouldn't have to turn off a very commonly used service so that people can do better business by tracking it in an intrusive manner. Privacy should be the default option in such programs. If the city used a ton of cameras + facial recognition to track you and your car everywhere and then sold that data to companies so they could optimize for whatever meaningless metric, would you still be as casual about this, and go "Oh, you should just cover your face and walk everywhere if you expect privacy."?
  - shiftpgdn 13y ago
    It's trivial to turn off the wireless on your phone. If you want privacy in this day and age it's not going to be convenient. The difference is I can't turn off my face.
    - reddit_clone 13y ago
      I blame the WiFi protocol. Since the routers are already broadcasting their SSID why are devices themselves broadcasting sensitive information back to them before the user has shown any interest in any particular hotspot? This over sharing should be addressed at protocol level.
      - ajcarpy2005 13y ago
        Maybe it's needed for ad-hoc networks between peers without a router. But maybe a one-time key would work?
  - jonknee 13y ago
    > No, you shouldn't have to turn off a very commonly used service so that people can do better business by tracking it in an intrusive manner. Privacy should be the default option in such programs. Maybe, maybe not, but if you care about your privacy you shouldn't assume everyone will follow the rules. Opt-in would be tough too--they need to know who you are before knowing if you have opted in.
dmix 13y ago
CSEC (Canada's NSA) caused a huge controvery for tracking MAC addresses of individuals from Airports to Coffee Shops/Libraries/any public wifi http://www.cbc.ca/news/politics/csec-used-airport-wi-fi-to-track-canadian-travellers-edward-snowden-documents-1.2517881 http://www.cbc.ca/news/politics/csec-used-airport-wi-fi-to-t... They used the wifi purchase at the airport to ID the user. They are likely already vacuuming up MAC addresses everywhere they can.
- throwaway067432 13y ago
  I have heard of a company that does this, which recorded 3 million active devices in a month -- 10% of Canada's population. Data includes, tracking people's movement through subways. CSEC is not the only party to worry about here. I am sure Google has comparable location info as well.
beejiu 13y ago
There are 500,000 CCTV cameras in London, and we are concerned about a few hundred advert-bins counting how many people are nearby...
Rafert 13y ago
Something similar caused a stir in the Netherlands as well, a month ago certain electronics stores where caught using wifi and bluetooth tracking alongside IR cameras. The Dutch Data Protection Authority said customers should be informed and have a possibility to opt-out, while the State Secretary of Security and Justice commented that people should turn off their wifi or bluetooth if they do not want to be tracked. Source: http://translate.google.com/translate?sl=nl&tl=en&js=n&prev=_t&hl=nl&ie=UTF-8&u=http%3A%2F%2Ftweakers.net%2Fnieuws%2F93547%2Fdixons-mycom-en-icentre-volgen-klanten-door-peilen-wifi-signaal.html http://translate.google.com/translate?sl=nl&tl=en&js=n&prev=...
nickporter 13y ago
> It would be really easy to tie a name to MAC address (from point of purchase with a credit card). How would you do it?
- fennecfoxen 13y ago
  Well, it's easy from the data point of view. You basically have two data sources: (location, time, credit card) and (location, time, MAC). The location/timestamp history of any given individual is one of the most unique pieces of data you can have; correlating the two is a trivial data-science exercise. It's the systems-integration part, moving the data from the card swipe onto the right computer, that's actually hard. You might be able to partner with your payment processor to get at that stuff.
aleem 13y ago
At first when I saw this page, I thought they count the number of people in a store through an eye-tracking device or facial recognition. This isn't too far off. In version 3.0 we will be seeing the ability to identify shoppers who are on a shopping spree by ringing a beep as they enter the store. Sad.
chrischen 13y ago
I built a device similar to this (with a raspberry pi). iOS from 7 and up no longer allows getting mac addresses... so it's much harder to tie a mac addresses to actual purchases. You'd have to do some sort of collaborative filtering over tons of visits to reliably tie purchases to a mac address.

alexandros 13y ago

They didn't really "ban" anything. They just instructed the company that was hosting them to stop doing so, in the face of a media shitstorm. And since that company was also a licensee of the City, they saw it fit to do as told. A shop owner in the City can still do as they like. [source: I was doing other work for the bin company (renew) and saw the whole car crash from the inside]

chrisfarms 13y ago
You are of course quite right. It wasn't a ban in any legal sense. Though I do think it highlights that the method is already frowned upon... and as and when the public becomes more aware of the fact they are walking around broadcasting their location there will be more pressure to restrict the collection of the data. That said. CCTV does not appear to be going anywhere, and there is very little difference between processing video footage to track people and tracking a MAC address. The only difference in this particular case is that 'sharing' of the data between retailers is touted as a feature (which of course it is).

shiftpgdn 13y ago

City of Houston does MAC address tracking on the freeways and surface streets to power their traffic tracking measures. It's probably used in hundreds of other places you haven't thought about. If you're concerned about your privacy just turn wifi off. http://traffic.houstontranstar.org/layers/ http://traffic.houstontranstar.org/layers/

parennoob 13y ago
> If you're concerned about your privacy just turn wifi off. No, you shouldn't have to turn off a very commonly used service so that people can do better business by tracking it in an intrusive manner. Privacy should be the default option in such programs. If the city used a ton of cameras + facial recognition to track you and your car everywhere and then sold that data to companies so they could optimize for whatever meaningless metric, would you still be as casual about this, and go "Oh, you should just cover your face and walk everywhere if you expect privacy."?
- shiftpgdn 13y ago
  It's trivial to turn off the wireless on your phone. If you want privacy in this day and age it's not going to be convenient. The difference is I can't turn off my face.
  - reddit_clone 13y ago
    I blame the WiFi protocol. Since the routers are already broadcasting their SSID why are devices themselves broadcasting sensitive information back to them before the user has shown any interest in any particular hotspot? This over sharing should be addressed at protocol level.
    - ajcarpy2005 13y ago
      Maybe it's needed for ad-hoc networks between peers without a router. But maybe a one-time key would work?
- jonknee 13y ago
  > No, you shouldn't have to turn off a very commonly used service so that people can do better business by tracking it in an intrusive manner. Privacy should be the default option in such programs. Maybe, maybe not, but if you care about your privacy you shouldn't assume everyone will follow the rules. Opt-in would be tough too--they need to know who you are before knowing if you have opted in.

dmix 13y ago

CSEC (Canada's NSA) caused a huge controvery for tracking MAC addresses of individuals from Airports to Coffee Shops/Libraries/any public wifi http://www.cbc.ca/news/politics/csec-used-airport-wi-fi-to-track-canadian-travellers-edward-snowden-documents-1.2517881 http://www.cbc.ca/news/politics/csec-used-airport-wi-fi-to-t... They used the wifi purchase at the airport to ID the user. They are likely already vacuuming up MAC addresses everywhere they can.

throwaway067432 13y ago
I have heard of a company that does this, which recorded 3 million active devices in a month -- 10% of Canada's population. Data includes, tracking people's movement through subways. CSEC is not the only party to worry about here. I am sure Google has comparable location info as well.

beejiu 13y ago

There are 500,000 CCTV cameras in London, and we are concerned about a few hundred advert-bins counting how many people are nearby...

Rafert 13y ago

Something similar caused a stir in the Netherlands as well, a month ago certain electronics stores where caught using wifi and bluetooth tracking alongside IR cameras. The Dutch Data Protection Authority said customers should be informed and have a possibility to opt-out, while the State Secretary of Security and Justice commented that people should turn off their wifi or bluetooth if they do not want to be tracked. Source: http://translate.google.com/translate?sl=nl&tl=en&js=n&prev=_t&hl=nl&ie=UTF-8&u=http%3A%2F%2Ftweakers.net%2Fnieuws%2F93547%2Fdixons-mycom-en-icentre-volgen-klanten-door-peilen-wifi-signaal.html http://translate.google.com/translate?sl=nl&tl=en&js=n&prev=...

nickporter 13y ago

> It would be really easy to tie a name to MAC address (from point of purchase with a credit card). How would you do it?

fennecfoxen 13y ago
Well, it's easy from the data point of view. You basically have two data sources: (location, time, credit card) and (location, time, MAC). The location/timestamp history of any given individual is one of the most unique pieces of data you can have; correlating the two is a trivial data-science exercise. It's the systems-integration part, moving the data from the card swipe onto the right computer, that's actually hard. You might be able to partner with your payment processor to get at that stuff.

aleem 13y ago

At first when I saw this page, I thought they count the number of people in a store through an eye-tracking device or facial recognition. This isn't too far off. In version 3.0 we will be seeing the ability to identify shoppers who are on a shopping spree by ringing a beep as they enter the store. Sad.

chrischen 13y ago

I built a device similar to this (with a raspberry pi). iOS from 7 and up no longer allows getting mac addresses... so it's much harder to tie a mac addresses to actual purchases. You'd have to do some sort of collaborative filtering over tons of visits to reliably tie purchases to a mac address.